Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
order 4502657678.exe

Overview

General Information

Sample name:order 4502657678.exe
Analysis ID:1430351
MD5:82df9d1ee9b303d453a7ea91d5f574e2
SHA1:4b121f046e002ac5e2fbeec21079f6fd4c55d370
SHA256:61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a
Tags:exe
Infos:

Detection

DarkTortilla, FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected FormBook
.NET source code contains method to dynamically call methods (often used by packers)
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Drops PE files to the startup folder
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Moves itself to temp directory
Tries to detect virtualization through RDTSC time measurements
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to launch a process as a different user
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • order 4502657678.exe (PID: 7648 cmdline: "C:\Users\user\Desktop\order 4502657678.exe" MD5: 82DF9D1EE9B303D453A7EA91D5F574E2)
    • ghedgegehe.exe (PID: 7172 cmdline: "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" MD5: 82DF9D1EE9B303D453A7EA91D5F574E2)
      • cmd.exe (PID: 8088 cmdline: "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • PING.EXE (PID: 1704 cmdline: ping 127.0.0.1 -n 20 MD5: B3624DD758CCECF93A1226CEF252CA12)
        • PING.EXE (PID: 760 cmdline: ping 127.0.0.1 -n 20 MD5: B3624DD758CCECF93A1226CEF252CA12)
        • purches order.exe (PID: 1696 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" MD5: 82DF9D1EE9B303D453A7EA91D5F574E2)
          • AddInProcess32.exe (PID: 312 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
            • explorer.exe (PID: 3968 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DarkTortillaDarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla
NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.budget-harmony.com/ij84/"], "decoy": ["resetter.xyz", "simonbelanger.me", "kwip.xyz", "7dbb9.baby", "notion-everyday.com", "saftiwall.com", "pulse-gaming.com", "fafafa1.shop", "ihaveahole.com", "sxtzzj.com", "996688x.xyz", "komalili.monster", "haberdashere.store", "nurselifegng.com", "kidtryz.com", "ghvx.xyz", "1minvideopro.com", "hidef.group", "stylishbeststyler.space", "spx21.com", "spatialad.net", "btstarvip.xyz", "gofetcher.net", "cqcready.net", "thecommunitycatalyst.com", "ssduckduckgo.com", "hastingsmortgagegroup.com", "mcminniespostersandmore.com", "xn--vaffelppinne-zcb.com", "thelsao.com", "muddybootssalisbury.com", "repetitionlaces.com", "yao-med.com", "hometotheworldcleaning.com", "ampowersolar.com", "xn--dtruire-bya.com", "cryptofarm.space", "ventaonline.site", "davidedema.com", "forklift-jobs-50425.bond", "laserfusionart.com", "mundosaludable.club", "bndl.fit", "lbexpress.shop", "matthewbrownlee.com", "viega.pro", "recrooglobal.com", "langzzzblog.online", "m-1263bets10.com", "surfacespecialistsnc.com", "conallnolankitchens.com", "80n.icu", "bleeckha.us", "thyselftrench.com", "bawaslu-tual.com", "elevatebuilders.co.za", "spacekat.xyz", "seniorlivinghub.today", "aloyoga-southafricas.com", "pickstreak.com", "boutiquelrdesign.com", "nazook.net", "ifoxclicks.com", "clinicallabpartner.com"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.1359801669.00000000025DC000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
    00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x9bc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x28b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x26b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x21a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x27b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x292f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x141c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x8927:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x992a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        Click to see the 66 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        20.2.AddInProcess32.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          20.2.AddInProcess32.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            20.2.AddInProcess32.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
            • 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
            • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
            20.2.AddInProcess32.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
            • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
            • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
            • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
            • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
            • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
            • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
            • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
            • 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4
            • 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
            20.2.AddInProcess32.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
            • 0x18849:$sqlite3step: 68 34 1C 7B E1
            • 0x1895c:$sqlite3step: 68 34 1C 7B E1
            • 0x18878:$sqlite3text: 68 38 2A 90 C5
            • 0x1899d:$sqlite3text: 68 38 2A 90 C5
            • 0x1888b:$sqlite3blob: 68 53 D8 7F 8C
            • 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
            Click to see the 11 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Startup Folder File Write
            Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\order 4502657678.exe, ProcessId: 7648, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purches order.lnk

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Found malware configuration
            Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.budget-harmony.com/ij84/"], "decoy": ["resetter.xyz", "simonbelanger.me", "kwip.xyz", "7dbb9.baby", "notion-everyday.com", "saftiwall.com", "pulse-gaming.com", "fafafa1.shop", "ihaveahole.com", "sxtzzj.com", "996688x.xyz", "komalili.monster", "haberdashere.store", "nurselifegng.com", "kidtryz.com", "ghvx.xyz", "1minvideopro.com", "hidef.group", "stylishbeststyler.space", "spx21.com", "spatialad.net", "btstarvip.xyz", "gofetcher.net", "cqcready.net", "thecommunitycatalyst.com", "ssduckduckgo.com", "hastingsmortgagegroup.com", "mcminniespostersandmore.com", "xn--vaffelppinne-zcb.com", "thelsao.com", "muddybootssalisbury.com", "repetitionlaces.com", "yao-med.com", "hometotheworldcleaning.com", "ampowersolar.com", "xn--dtruire-bya.com", "cryptofarm.space", "ventaonline.site", "davidedema.com", "forklift-jobs-50425.bond", "laserfusionart.com", "mundosaludable.club", "bndl.fit", "lbexpress.shop", "matthewbrownlee.com", "viega.pro", "recrooglobal.com", "langzzzblog.online", "m-1263bets10.com", "surfacespecialistsnc.com", "conallnolankitchens.com", "80n.icu", "bleeckha.us", "thyselftrench.com", "bawaslu-tual.com", "elevatebuilders.co.za", "spacekat.xyz", "seniorlivinghub.today", "aloyoga-southafricas.com", "pickstreak.com", "boutiquelrdesign.com", "nazook.net", "ifoxclicks.com", "clinicallabpartner.com"]}
            Multi AV Scanner detection for dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeReversingLabs: Detection: 23%
            Multi AV Scanner detection for submitted file
            Source: order 4502657678.exeReversingLabs: Detection: 23%
            Yara detected FormBook
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Machine Learning detection for dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: order 4502657678.exeJoe Sandbox ML: detected
            Source: order 4502657678.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000014.00000002.2551899389.00000000018A0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000014.00000002.2551899389.00000000018A0000.00000040.00001000.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start MenuJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h4_2_05EE4564
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then push dword ptr [ebp-20h]4_2_05EEF7E8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh4_2_05EEF7E8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then push dword ptr [ebp-20h]4_2_05EEF7DD
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh4_2_05EEF7DD
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then push dword ptr [ebp-24h]4_2_05EEFF08
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh4_2_05EEFF08
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then push dword ptr [ebp-24h]4_2_05EEFEFC
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh4_2_05EEFEFC
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h4_2_05EEF66D
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then xor edx, edx4_2_05EEFE40
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then xor edx, edx4_2_05EEFE34
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h4_2_07C92408
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h4_2_07C923A1
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h4_2_07C92334
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h10_2_07C84564
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then push dword ptr [ebp-20h]10_2_07C8F7DD
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh10_2_07C8F7DD
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then push dword ptr [ebp-20h]10_2_07C8F7E8
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh10_2_07C8F7E8
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then push dword ptr [ebp-24h]10_2_07C8FF08
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh10_2_07C8FF08
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then push dword ptr [ebp-24h]10_2_07C8FEFC
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh10_2_07C8FEFC
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then xor edx, edx10_2_07C8FE40
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h10_2_07C8F66D
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h10_2_07CC21A8
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h10_2_07CC2408
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h16_2_07A64564
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then push dword ptr [ebp-20h]16_2_07A6F7E8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh16_2_07A6F7E8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then push dword ptr [ebp-20h]16_2_07A6F7DD
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh16_2_07A6F7DD
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then push dword ptr [ebp-24h]16_2_07A6FF08
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh16_2_07A6FF08
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then push dword ptr [ebp-24h]16_2_07A6FEFC
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh16_2_07A6FEFC
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then xor edx, edx16_2_07A6FE10
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h16_2_07A6F66D
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then xor edx, edx16_2_07A6FE40
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h16_2_07AA21A8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h16_2_07AA2408
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 4x nop then pop ebx20_2_00407B1B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 4x nop then pop esi20_2_00417330
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 4x nop then pop edi20_2_0040E47B

            Networking

            barindex
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: www.budget-harmony.com/ij84/
            Uses ping.exe to check the status of other devices and networks
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20
            Source: explorer.exe, 00000016.00000000.2522467915.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.00000000094DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
            Source: explorer.exe, 00000016.00000000.2522467915.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.00000000094DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
            Source: explorer.exe, 00000016.00000000.2522467915.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.0000000009519000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.0000000009519000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.00000000094DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
            Source: explorer.exe, 00000016.00000000.2522467915.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.000000000955E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.00000000094DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: explorer.exe, 00000016.00000000.2517182041.000000000305D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2554089500.000000000305D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
            Source: order 4502657678.exe, 00000004.00000002.1369737440.0000000006053000.00000004.00000020.00020000.00000000.sdmp, ghedgegehe.exe, 0000000A.00000002.1466724304.0000000006A02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purl.oen
            Source: explorer.exe, 00000016.00000000.2520673588.0000000007AF0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2553005536.0000000002C00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2559813276.0000000007B10000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
            Source: explorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppin
            Source: explorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
            Source: explorer.exe, 00000016.00000002.2562512037.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/$
            Source: explorer.exe, 00000016.00000002.2562512037.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/X
            Source: explorer.exe, 00000016.00000000.2517182041.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2515831260.0000000000889000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2549041838.0000000000889000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2554089500.0000000002FA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
            Source: explorer.exe, 00000016.00000002.2562512037.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=C2BB6DDCE8D847D6B779FE8AEC27D161&timeOut=5000&oc
            Source: explorer.exe, 00000016.00000000.2517182041.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2554089500.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
            Source: explorer.exe, 00000016.00000002.2562512037.0000000009390000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.0000000009390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.comWzE
            Source: explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
            Source: explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
            Source: explorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.comE
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15G9PH.img
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hJkDs.img
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
            Source: explorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comNaP0B
            Source: explorer.exe, 00000016.00000000.2527841871.000000000CFF4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2568699459.000000000CFF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcemberZ
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
            Source: explorer.exe, 00000016.00000000.2523704295.0000000009724000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2563984081.0000000009724000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/bat
            Source: explorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com576
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/health/wellness/7-secrets-to-a-happy-old-age-backed-by-science/ss-AA1hwpvW
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/companies/legacy-park-auction-canceled-liquidation-proposed-here-s-w
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/crime/one-dead-several-wounded-after-drive-by-shootings-in-south-la/a
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/opinion/decline-of-decorum-21-essential-manners-today-s-parents-fail-
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/california-workers-will-get-five-sick-days-instead-of-three-
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
            Source: explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: Process Memory Space: order 4502657678.exe PID: 7648, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: Process Memory Space: ghedgegehe.exe PID: 7172, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: Process Memory Space: purches order.exe PID: 1696, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: Process Memory Space: AddInProcess32.exe PID: 312, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: order 4502657678.exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A360 NtCreateFile,20_2_0041A360
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A410 NtReadFile,20_2_0041A410
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A490 NtClose,20_2_0041A490
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A540 NtAllocateVirtualMemory,20_2_0041A540
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A35A NtCreateFile,20_2_0041A35A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A45A NtReadFile,20_2_0041A45A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A40A NtReadFile,20_2_0041A40A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041A48A NtClose,20_2_0041A48A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912BF0 NtAllocateVirtualMemory,LdrInitializeThunk,20_2_01912BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912B60 NtClose,LdrInitializeThunk,20_2_01912B60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912DF0 NtQuerySystemInformation,LdrInitializeThunk,20_2_01912DF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912D10 NtMapViewOfSection,LdrInitializeThunk,20_2_01912D10
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912C70 NtFreeVirtualMemory,LdrInitializeThunk,20_2_01912C70
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912F30 NtCreateSection,LdrInitializeThunk,20_2_01912F30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,20_2_01912EA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01914340 NtSetContextThread,20_2_01914340
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01914650 NtSuspendThread,20_2_01914650
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912B80 NtQueryInformationFile,20_2_01912B80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912BA0 NtEnumerateValueKey,20_2_01912BA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912BE0 NtQueryValueKey,20_2_01912BE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912AB0 NtWaitForSingleObject,20_2_01912AB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912AD0 NtReadFile,20_2_01912AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912AF0 NtWriteFile,20_2_01912AF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912DB0 NtEnumerateKey,20_2_01912DB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912DD0 NtDelayExecution,20_2_01912DD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912D00 NtSetInformationFile,20_2_01912D00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912D30 NtUnmapViewOfSection,20_2_01912D30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912CA0 NtQueryInformationToken,20_2_01912CA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912CC0 NtQueryVirtualMemory,20_2_01912CC0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912CF0 NtOpenProcess,20_2_01912CF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912C00 NtQueryInformationProcess,20_2_01912C00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912C60 NtCreateKey,20_2_01912C60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912F90 NtProtectVirtualMemory,20_2_01912F90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912FB0 NtResumeThread,20_2_01912FB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912FA0 NtQuerySection,20_2_01912FA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912FE0 NtCreateFile,20_2_01912FE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912F60 NtCreateProcessEx,20_2_01912F60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912E80 NtReadVirtualMemory,20_2_01912E80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912EE0 NtQueueApcThread,20_2_01912EE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912E30 NtWriteVirtualMemory,20_2_01912E30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01913090 NtSetValueKey,20_2_01913090
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01913010 NtOpenDirectoryObject,20_2_01913010
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019135C0 NtCreateMutant,20_2_019135C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019139B0 NtGetContextThread,20_2_019139B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01913D10 NtOpenProcessToken,20_2_01913D10
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01913D70 NtOpenThread,20_2_01913D70
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797DEC0 CreateProcessAsUserW,16_2_0797DEC0
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E95674_2_006E9567
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E55804_2_006E5580
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E1F384_2_006E1F38
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E64604_2_006E6460
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E96524_2_006E9652
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E96194_2_006E9619
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E96AD4_2_006E96AD
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E97584_2_006E9758
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E97044_2_006E9704
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E97FE4_2_006E97FE
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E97DE4_2_006E97DE
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E97A64_2_006E97A6
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E987D4_2_006E987D
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E98C74_2_006E98C7
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E99634_2_006E9963
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E99DB4_2_006E99DB
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E9A374_2_006E9A37
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006E9AE84_2_006E9AE8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_05EC57D84_2_05EC57D8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_05ECF7A84_2_05ECF7A8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_05EE59B84_2_05EE59B8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_05EE12284_2_05EE1228
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_072E22C84_2_072E22C8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_072E6ED84_2_072E6ED8
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_072E00064_2_072E0006
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_07C94D984_2_07C94D98
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_07C904484_2_07C90448
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_07C904384_2_07C90438
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_07C94D814_2_07C94D81
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_02E1956710_2_02E19567
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_02E1585810_2_02E15858
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_02E11F3810_2_02E11F38
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_02E1646010_2_02E16460
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_02E19AFD10_2_02E19AFD
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07C8122810_2_07C81228
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07C859B810_2_07C859B8
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CB80BB10_2_07CB80BB
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CB674510_2_07CB6745
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CBD6B010_2_07CBD6B0
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CC4D9810_2_07CC4D98
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CC4D7F10_2_07CC4D7F
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CC044810_2_07CC0448
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CC043810_2_07CC0438
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_081757D810_2_081757D8
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_081757B810_2_081757B8
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_0817F7A810_2_0817F7A8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB647016_2_00CB6470
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB558016_2_00CB5580
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB9B2A16_2_00CB9B2A
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB1F3816_2_00CB1F38
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0753EF9016_2_0753EF90
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0753CC0A16_2_0753CC0A
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0753E86816_2_0753E868
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0753E7F116_2_0753E7F1
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0753E7B016_2_0753E7B0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0753DC2916_2_0753DC29
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_075339E016_2_075339E0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_075339AD16_2_075339AD
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07952E9016_2_07952E90
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07970F2916_2_07970F29
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07976EF816_2_07976EF8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797866016_2_07978660
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_079791FA16_2_079791FA
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797E54016_2_0797E540
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797889816_2_07978898
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797004016_2_07970040
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797C7F016_2_0797C7F0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797AF0016_2_0797AF00
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07977E9016_2_07977E90
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797328816_2_07973288
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_079736B816_2_079736B8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_079736A916_2_079736A9
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07976EE816_2_07976EE8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797420016_2_07974200
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797865016_2_07978650
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07977E7C16_2_07977E7C
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797327816_2_07973278
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797719816_2_07977198
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797718A16_2_0797718A
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_079729D016_2_079729D0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07971DD816_2_07971DD8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_079729E016_2_079729E0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07971DE816_2_07971DE8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797416116_2_07974161
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797889516_2_07978895
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07972CD016_2_07972CD0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797C0C016_2_0797C0C0
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797000616_2_07970006
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797782216_2_07977822
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797782816_2_07977828
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797305016_2_07973050
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0797304016_2_07973040
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07A457D816_2_07A457D8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07A4F7A816_2_07A4F7A8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07A457B816_2_07A457B8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07A6122816_2_07A61228
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07A659B816_2_07A659B8
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AA4D9816_2_07AA4D98
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AA043816_2_07AA0438
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AA044816_2_07AA0448
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AA4D7F16_2_07AA4D7F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0040103020_2_00401030
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041D94220_2_0041D942
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041E2DA20_2_0041E2DA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041E3DD20_2_0041E3DD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041EBA120_2_0041EBA1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_00402D9020_2_00402D90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041E59E20_2_0041E59E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041D5A620_2_0041D5A6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_00409E6020_2_00409E60
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041DEAE20_2_0041DEAE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041EFF220_2_0041EFF2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041E7F920_2_0041E7F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041E78020_2_0041E780
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041EF9720_2_0041EF97
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_00402FB020_2_00402FB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A01AA20_2_019A01AA
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019941A220_2_019941A2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019981CC20_2_019981CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D010020_2_018D0100
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197A11820_2_0197A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0196815820_2_01968158
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197200020_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A03E620_2_019A03E6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE3F020_2_018EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199A35220_2_0199A352
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019602C020_2_019602C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198027420_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A059120_2_019A0591
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E053520_2_018E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198E4F620_2_0198E4F6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198442020_2_01984420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199244620_2_01992446
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DC7C020_2_018DC7C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190475020_2_01904750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E077020_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FC6E020_2_018FC6E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A020_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019AA9A620_2_019AA9A6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F696220_2_018F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C68B820_2_018C68B8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E8F020_2_0190E8F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EA84020_2_018EA840
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E284020_2_018E2840
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01996BD720_2_01996BD7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199AB4020_2_0199AB40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA8020_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F8DBF20_2_018F8DBF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DADE020_2_018DADE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197CD1F20_2_0197CD1F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EAD0020_2_018EAD00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980CB520_2_01980CB5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0CF220_2_018D0CF2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0C0020_2_018E0C00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195EFA020_2_0195EFA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D2FC820_2_018D2FC8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018ECFE020_2_018ECFE0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01900F3020_2_01900F30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01982F3020_2_01982F30
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01922F2820_2_01922F28
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01954F4020_2_01954F40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199CE9320_2_0199CE93
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F2E9020_2_018F2E90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199EEDB20_2_0199EEDB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199EE2620_2_0199EE26
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0E5920_2_018E0E59
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EB1B020_2_018EB1B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019AB16B20_2_019AB16B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0191516C20_2_0191516C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CF17220_2_018CF172
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E70C020_2_018E70C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198F0CC20_2_0198F0CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019970E920_2_019970E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199F0E020_2_0199F0E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0192739A20_2_0192739A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199132D20_2_0199132D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CD34C20_2_018CD34C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E52A020_2_018E52A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FB2C020_2_018FB2C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019812ED20_2_019812ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197D5B020_2_0197D5B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A95C320_2_019A95C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199757120_2_01997571
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199F43F20_2_0199F43F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D146020_2_018D1460
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199F7B020_2_0199F7B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D17EC20_2_018D17EC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019916CC20_2_019916CC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0192563020_2_01925630
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197591020_2_01975910
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E995020_2_018E9950
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FB95020_2_018FB950
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E38E020_2_018E38E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194D80020_2_0194D800
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FFB8020_2_018FFB80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01955BF020_2_01955BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0191DBF920_2_0191DBF9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199FB7620_2_0199FB76
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01925AA020_2_01925AA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197DAAC20_2_0197DAAC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01981AA320_2_01981AA3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198DAC620_2_0198DAC6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199FA4920_2_0199FA49
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01997A4620_2_01997A46
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01953A6C20_2_01953A6C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FFDC020_2_018FFDC0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01991D5A20_2_01991D5A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E3D4020_2_018E3D40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01997D7320_2_01997D73
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199FCF220_2_0199FCF2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01959C3220_2_01959C32
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E1F9220_2_018E1F92
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199FFB120_2_0199FFB1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199FF0920_2_0199FF09
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E9EB020_2_018E9EB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 01915130 appears 58 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 0194EA12 appears 86 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 01927E54 appears 109 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 018CB970 appears 283 times
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: String function: 0195F290 appears 105 times
            Source: order 4502657678.exe, 00000004.00000002.1359041869.00000000007FE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs order 4502657678.exe
            Source: order 4502657678.exe, 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiPro.dll, vs order 4502657678.exe
            Source: order 4502657678.exe, 00000004.00000002.1363182798.000000000373B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMiPro.dll, vs order 4502657678.exe
            Source: order 4502657678.exe, 00000004.00000000.1267594504.0000000000648000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameifeanyi 1.exe( vs order 4502657678.exe
            Source: order 4502657678.exe, 00000004.00000002.1365654712.0000000005090000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMiPro.dll, vs order 4502657678.exe
            Source: order 4502657678.exeBinary or memory string: OriginalFilenameifeanyi 1.exe( vs order 4502657678.exe
            Source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: Process Memory Space: order 4502657678.exe PID: 7648, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: Process Memory Space: ghedgegehe.exe PID: 7172, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: Process Memory Space: purches order.exe PID: 1696, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: Process Memory Space: AddInProcess32.exe PID: 312, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.adwa.evad.winEXE@14/8@0/1
            Source: C:\Users\user\Desktop\order 4502657678.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purches order.lnkJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMutant created: NULL
            Source: order 4502657678.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: order 4502657678.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
            Source: C:\Users\user\Desktop\order 4502657678.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: order 4502657678.exeReversingLabs: Detection: 23%
            Source: unknownProcess created: C:\Users\user\Desktop\order 4502657678.exe "C:\Users\user\Desktop\order 4502657678.exe"
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess created: C:\Users\user\AppData\Local\Temp\ghedgegehe.exe "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe"
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess created: C:\Users\user\AppData\Local\Temp\ghedgegehe.exe "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: scrrun.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: order 4502657678.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: order 4502657678.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000014.00000002.2551899389.00000000018A0000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000014.00000002.2551899389.00000000018A0000.00000040.00001000.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            Yara detected DarkTortilla Crypter
            Source: Yara matchFile source: 4.2.order 4502657678.exe.373b7f0.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.order 4502657678.exe.373b7f0.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.order 4502657678.exe.36add90.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.order 4502657678.exe.36add90.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.order 4502657678.exe.5090000.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.order 4502657678.exe.5090000.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000004.00000002.1359801669.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1463152963.00000000041AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1463152963.00000000040C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.000000000373B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1459376158.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.000000000399B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.0000000003882000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1463152963.0000000004092000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.00000000038B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1365654712.0000000005090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1359801669.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1459376158.00000000030DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2515396631.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: order 4502657678.exe PID: 7648, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: ghedgegehe.exe PID: 7172, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: purches order.exe PID: 1696, type: MEMORYSTR
            .NET source code contains method to dynamically call methods (often used by packers)
            Source: order 4502657678.exe, n0LYq.cs.Net Code: NewLateBinding.LateCall(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(array2[2], (Type)null, "GetTypes", new object[0], (string[])null, (Type[])null, (bool[])null), new object[1] { 24 }, (string[])null), (Type)null, "GetMethods", new object[0], (string[])null, (Type[])null, (bool[])null), new object[1] { 0 }, (string[])null), (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)
            Source: purches order.exe.12.dr, n0LYq.cs.Net Code: NewLateBinding.LateCall(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(NewLateBinding.LateIndexGet(NewLateBinding.LateGet(array2[2], (Type)null, "GetTypes", new object[0], (string[])null, (Type[])null, (bool[])null), new object[1] { 24 }, (string[])null), (Type)null, "GetMethods", new object[0], (string[])null, (Type[])null, (bool[])null), new object[1] { 0 }, (string[])null), (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_006EC110 pushad ; ret 4_2_006EC111
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_072E7DB5 push FFFFFF8Bh; iretd 4_2_072E7DB7
            Source: C:\Users\user\Desktop\order 4502657678.exeCode function: 4_2_072E44BA pushad ; retf 4_2_072E44C1
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_02E1C110 pushad ; ret 10_2_02E1C111
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CB66E2 pushad ; retf 10_2_07CB66EB
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CB669E push eax; retf 10_2_07CB669F
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CBE58D push FFFFFF8Bh; iretd 10_2_07CBE58F
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_07CBB518 push es; ret 10_2_07CBB552
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeCode function: 10_2_0817CB82 push eax; retf 10_2_0817CB89
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB1915 push ss; retf 16_2_00CB18EA
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CBC110 pushad ; ret 16_2_00CBC111
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB18ED push ss; retf 16_2_00CB18EE
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB18E1 push ss; retf 16_2_00CB18E2
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB18F3 push ss; retf 16_2_00CB18F6
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB18F0 push ss; retf 16_2_00CB18F2
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_00CB18F7 push ss; retf 16_2_00CB18FA
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_075396C0 pushfd ; iretd 16_2_075396C9
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07535C01 push edi; retf 16_2_07535C02
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07535B7C pushfd ; retf 16_2_07535B7D
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_0795279D push FFFFFF8Bh; iretd 16_2_0795279F
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07A4CB82 push eax; retf 16_2_07A4CB89
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07A6F388 push 0000005Dh; ret 16_2_07A6F3AA
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AAE400 pushad ; ret 16_2_07AAE963
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AAC7E6 pushad ; ret 16_2_07AAC823
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AAE8FD pushad ; ret 16_2_07AAE963
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeCode function: 16_2_07AAC871 pushad ; ret 16_2_07AAC823
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_00417B98 push ecx; retf 20_2_00417BB1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_00419C86 push sp; retf 20_2_00419C88
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041D4B5 push eax; ret 20_2_0041D508
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041D56C push eax; ret 20_2_0041D572
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0041D502 push eax; ret 20_2_0041D508
            Source: order 4502657678.exeStatic PE information: section name: .text entropy: 6.918820158334831
            Source: purches order.exe.12.drStatic PE information: section name: .text entropy: 6.918820158334831
            Source: order 4502657678.exe, i2C7.csHigh entropy of concatenated method names: 'Jd91', 'Xt8a', 'Qj62Cz', 'r0SPw2', 'Pc4n5E', 'Wm40Yi', 'e2TNb6', 'j2B6Zg', 's0YDq8', 'm9P4Mf'
            Source: purches order.exe.12.dr, i2C7.csHigh entropy of concatenated method names: 'Jd91', 'Xt8a', 'Qj62Cz', 'r0SPw2', 'Pc4n5E', 'Wm40Yi', 'e2TNb6', 'j2B6Zg', 's0YDq8', 'm9P4Mf'
            Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeJump to dropped file

            Boot Survival

            barindex
            Drops PE files to the startup folder
            Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeJump to dropped file
            Source: C:\Users\user\Desktop\order 4502657678.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purches order.lnkJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purches order.lnkJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skypeJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe\:Zone.Identifier:$DATAJump to behavior

            Hooking and other Techniques for Hiding and Protection

            barindex
            Hides that the sample has been downloaded from the Internet (zone.identifier)
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\Desktop\order 4502657678.exe\:Zone.Identifier read attributes | deleteJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeFile opened: C:\Users\user\AppData\Local\Temp\ghedgegehe.exe\:Zone.Identifier read attributes | deleteJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe\:Zone.Identifier read attributes | deleteJump to behavior
            Moves itself to temp directory
            Source: c:\users\user\desktop\order 4502657678.exeFile moved: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Yara detected AntiVM3
            Source: Yara matchFile source: Process Memory Space: order 4502657678.exe PID: 7648, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: ghedgegehe.exe PID: 7172, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: purches order.exe PID: 1696, type: MEMORYSTR
            Tries to detect virtualization through RDTSC time measurements
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Uses ping.exe to sleep
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20Jump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeMemory allocated: 6E0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeMemory allocated: 24F0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeMemory allocated: 2300000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeMemory allocated: 2DD0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeMemory allocated: 2FF0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeMemory allocated: 2E40000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: CB0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: 27E0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: 2500000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: 7BE0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: 8BE0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: 8DB0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: 9DB0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: A140000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: B140000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: C140000 memory reserve | memory write watchJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_00409AB0 rdtsc 20_2_00409AB0
            Source: C:\Users\user\Desktop\order 4502657678.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeAPI coverage: 1.0 %
            Source: C:\Users\user\Desktop\order 4502657678.exe TID: 7704Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exe TID: 7584Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exe TID: 7332Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe TID: 3792Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe TID: 1864Thread sleep time: -53000s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe TID: 1528Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\PING.EXELast function: Thread delayed
            Source: C:\Users\user\Desktop\order 4502657678.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppDataJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start MenuJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\userJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
            Source: purches order.exe, 00000010.00000002.2512716806.0000000000B21000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
            Source: explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: )d2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: explorer.exe, 00000016.00000002.2549041838.0000000000889000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000/;
            Source: explorer.exe, 00000016.00000002.2549041838.0000000000889000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000o;
            Source: explorer.exe, 00000016.00000000.2523704295.00000000095B9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
            Source: order 4502657678.exe, 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, order 4502657678.exe, 00000004.00000002.1363182798.000000000373B000.00000004.00000800.00020000.00000000.sdmp, order 4502657678.exe, 00000004.00000002.1365654712.0000000005090000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: VBoxTray
            Source: order 4502657678.exe, 00000004.00000002.1365654712.0000000005090000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth
            Source: explorer.exe, 00000016.00000000.2523704295.00000000095B9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
            Source: explorer.exe, 00000016.00000000.2523704295.00000000095B9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: explorer.exe, 00000016.00000000.2522467915.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.00000000094DC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp
            Source: explorer.exe, 00000016.00000000.2523704295.00000000095B9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTbrVMWare
            Source: explorer.exe, 00000016.00000000.2523704295.00000000095B9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}?
            Source: order 4502657678.exe, 00000004.00000002.1365909679.00000000058A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
            Source: explorer.exe, 00000016.00000000.2522467915.000000000952D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2562512037.000000000952D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
            Source: explorer.exe, 00000016.00000002.2562512037.00000000094DC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: %SystemRoot%\system32\mswsock.dlldRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
            Source: explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
            Source: ghedgegehe.exe, 0000000A.00000002.1457506563.00000000010CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
            Source: order 4502657678.exe, 00000004.00000002.1359041869.0000000000832000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: explorer.exe, 00000016.00000000.2523704295.00000000095B9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
            Source: explorer.exe, 00000016.00000002.2554089500.0000000002FA0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_00409AB0 rdtsc 20_2_00409AB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0040ACF0 LdrLoadDll,20_2_0040ACF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195019F mov eax, dword ptr fs:[00000030h]20_2_0195019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195019F mov eax, dword ptr fs:[00000030h]20_2_0195019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195019F mov eax, dword ptr fs:[00000030h]20_2_0195019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195019F mov eax, dword ptr fs:[00000030h]20_2_0195019F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198C188 mov eax, dword ptr fs:[00000030h]20_2_0198C188
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198C188 mov eax, dword ptr fs:[00000030h]20_2_0198C188
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01910185 mov eax, dword ptr fs:[00000030h]20_2_01910185
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01974180 mov eax, dword ptr fs:[00000030h]20_2_01974180
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01974180 mov eax, dword ptr fs:[00000030h]20_2_01974180
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CA197 mov eax, dword ptr fs:[00000030h]20_2_018CA197
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CA197 mov eax, dword ptr fs:[00000030h]20_2_018CA197
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CA197 mov eax, dword ptr fs:[00000030h]20_2_018CA197
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E1D0 mov eax, dword ptr fs:[00000030h]20_2_0194E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E1D0 mov eax, dword ptr fs:[00000030h]20_2_0194E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E1D0 mov ecx, dword ptr fs:[00000030h]20_2_0194E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E1D0 mov eax, dword ptr fs:[00000030h]20_2_0194E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E1D0 mov eax, dword ptr fs:[00000030h]20_2_0194E1D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019961C3 mov eax, dword ptr fs:[00000030h]20_2_019961C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019961C3 mov eax, dword ptr fs:[00000030h]20_2_019961C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019001F8 mov eax, dword ptr fs:[00000030h]20_2_019001F8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A61E5 mov eax, dword ptr fs:[00000030h]20_2_019A61E5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01990115 mov eax, dword ptr fs:[00000030h]20_2_01990115
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197A118 mov ecx, dword ptr fs:[00000030h]20_2_0197A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197A118 mov eax, dword ptr fs:[00000030h]20_2_0197A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197A118 mov eax, dword ptr fs:[00000030h]20_2_0197A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197A118 mov eax, dword ptr fs:[00000030h]20_2_0197A118
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov eax, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov ecx, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov eax, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov eax, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov ecx, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov eax, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov eax, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov ecx, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov eax, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E10E mov ecx, dword ptr fs:[00000030h]20_2_0197E10E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01900124 mov eax, dword ptr fs:[00000030h]20_2_01900124
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01968158 mov eax, dword ptr fs:[00000030h]20_2_01968158
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01964144 mov eax, dword ptr fs:[00000030h]20_2_01964144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01964144 mov eax, dword ptr fs:[00000030h]20_2_01964144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01964144 mov ecx, dword ptr fs:[00000030h]20_2_01964144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01964144 mov eax, dword ptr fs:[00000030h]20_2_01964144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01964144 mov eax, dword ptr fs:[00000030h]20_2_01964144
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D6154 mov eax, dword ptr fs:[00000030h]20_2_018D6154
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D6154 mov eax, dword ptr fs:[00000030h]20_2_018D6154
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CC156 mov eax, dword ptr fs:[00000030h]20_2_018CC156
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4164 mov eax, dword ptr fs:[00000030h]20_2_019A4164
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4164 mov eax, dword ptr fs:[00000030h]20_2_019A4164
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D208A mov eax, dword ptr fs:[00000030h]20_2_018D208A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019960B8 mov eax, dword ptr fs:[00000030h]20_2_019960B8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019960B8 mov ecx, dword ptr fs:[00000030h]20_2_019960B8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C80A0 mov eax, dword ptr fs:[00000030h]20_2_018C80A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019680A8 mov eax, dword ptr fs:[00000030h]20_2_019680A8
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019520DE mov eax, dword ptr fs:[00000030h]20_2_019520DE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019120F0 mov ecx, dword ptr fs:[00000030h]20_2_019120F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D80E9 mov eax, dword ptr fs:[00000030h]20_2_018D80E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CA0E3 mov ecx, dword ptr fs:[00000030h]20_2_018CA0E3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019560E0 mov eax, dword ptr fs:[00000030h]20_2_019560E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CC0F0 mov eax, dword ptr fs:[00000030h]20_2_018CC0F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01954000 mov ecx, dword ptr fs:[00000030h]20_2_01954000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01972000 mov eax, dword ptr fs:[00000030h]20_2_01972000
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE016 mov eax, dword ptr fs:[00000030h]20_2_018EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE016 mov eax, dword ptr fs:[00000030h]20_2_018EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE016 mov eax, dword ptr fs:[00000030h]20_2_018EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE016 mov eax, dword ptr fs:[00000030h]20_2_018EE016
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01966030 mov eax, dword ptr fs:[00000030h]20_2_01966030
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CA020 mov eax, dword ptr fs:[00000030h]20_2_018CA020
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CC020 mov eax, dword ptr fs:[00000030h]20_2_018CC020
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956050 mov eax, dword ptr fs:[00000030h]20_2_01956050
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D2050 mov eax, dword ptr fs:[00000030h]20_2_018D2050
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FC073 mov eax, dword ptr fs:[00000030h]20_2_018FC073
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F438F mov eax, dword ptr fs:[00000030h]20_2_018F438F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F438F mov eax, dword ptr fs:[00000030h]20_2_018F438F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CE388 mov eax, dword ptr fs:[00000030h]20_2_018CE388
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CE388 mov eax, dword ptr fs:[00000030h]20_2_018CE388
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CE388 mov eax, dword ptr fs:[00000030h]20_2_018CE388
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C8397 mov eax, dword ptr fs:[00000030h]20_2_018C8397
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C8397 mov eax, dword ptr fs:[00000030h]20_2_018C8397
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C8397 mov eax, dword ptr fs:[00000030h]20_2_018C8397
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019743D4 mov eax, dword ptr fs:[00000030h]20_2_019743D4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019743D4 mov eax, dword ptr fs:[00000030h]20_2_019743D4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E3DB mov eax, dword ptr fs:[00000030h]20_2_0197E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E3DB mov eax, dword ptr fs:[00000030h]20_2_0197E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E3DB mov ecx, dword ptr fs:[00000030h]20_2_0197E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197E3DB mov eax, dword ptr fs:[00000030h]20_2_0197E3DB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA3C0 mov eax, dword ptr fs:[00000030h]20_2_018DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA3C0 mov eax, dword ptr fs:[00000030h]20_2_018DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA3C0 mov eax, dword ptr fs:[00000030h]20_2_018DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA3C0 mov eax, dword ptr fs:[00000030h]20_2_018DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA3C0 mov eax, dword ptr fs:[00000030h]20_2_018DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA3C0 mov eax, dword ptr fs:[00000030h]20_2_018DA3C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D83C0 mov eax, dword ptr fs:[00000030h]20_2_018D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D83C0 mov eax, dword ptr fs:[00000030h]20_2_018D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D83C0 mov eax, dword ptr fs:[00000030h]20_2_018D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D83C0 mov eax, dword ptr fs:[00000030h]20_2_018D83C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198C3CD mov eax, dword ptr fs:[00000030h]20_2_0198C3CD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E03E9 mov eax, dword ptr fs:[00000030h]20_2_018E03E9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019063FF mov eax, dword ptr fs:[00000030h]20_2_019063FF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE3F0 mov eax, dword ptr fs:[00000030h]20_2_018EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE3F0 mov eax, dword ptr fs:[00000030h]20_2_018EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE3F0 mov eax, dword ptr fs:[00000030h]20_2_018EE3F0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A30B mov eax, dword ptr fs:[00000030h]20_2_0190A30B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A30B mov eax, dword ptr fs:[00000030h]20_2_0190A30B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A30B mov eax, dword ptr fs:[00000030h]20_2_0190A30B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CC310 mov ecx, dword ptr fs:[00000030h]20_2_018CC310
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F0310 mov ecx, dword ptr fs:[00000030h]20_2_018F0310
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A8324 mov eax, dword ptr fs:[00000030h]20_2_019A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A8324 mov ecx, dword ptr fs:[00000030h]20_2_019A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A8324 mov eax, dword ptr fs:[00000030h]20_2_019A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A8324 mov eax, dword ptr fs:[00000030h]20_2_019A8324
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01978350 mov ecx, dword ptr fs:[00000030h]20_2_01978350
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195035C mov eax, dword ptr fs:[00000030h]20_2_0195035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195035C mov eax, dword ptr fs:[00000030h]20_2_0195035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195035C mov eax, dword ptr fs:[00000030h]20_2_0195035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195035C mov ecx, dword ptr fs:[00000030h]20_2_0195035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195035C mov eax, dword ptr fs:[00000030h]20_2_0195035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195035C mov eax, dword ptr fs:[00000030h]20_2_0195035C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199A352 mov eax, dword ptr fs:[00000030h]20_2_0199A352
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A634F mov eax, dword ptr fs:[00000030h]20_2_019A634F
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01952349 mov eax, dword ptr fs:[00000030h]20_2_01952349
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197437C mov eax, dword ptr fs:[00000030h]20_2_0197437C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E284 mov eax, dword ptr fs:[00000030h]20_2_0190E284
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E284 mov eax, dword ptr fs:[00000030h]20_2_0190E284
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01950283 mov eax, dword ptr fs:[00000030h]20_2_01950283
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01950283 mov eax, dword ptr fs:[00000030h]20_2_01950283
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01950283 mov eax, dword ptr fs:[00000030h]20_2_01950283
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E02A0 mov eax, dword ptr fs:[00000030h]20_2_018E02A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E02A0 mov eax, dword ptr fs:[00000030h]20_2_018E02A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019662A0 mov eax, dword ptr fs:[00000030h]20_2_019662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019662A0 mov ecx, dword ptr fs:[00000030h]20_2_019662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019662A0 mov eax, dword ptr fs:[00000030h]20_2_019662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019662A0 mov eax, dword ptr fs:[00000030h]20_2_019662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019662A0 mov eax, dword ptr fs:[00000030h]20_2_019662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019662A0 mov eax, dword ptr fs:[00000030h]20_2_019662A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A62D6 mov eax, dword ptr fs:[00000030h]20_2_019A62D6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA2C3 mov eax, dword ptr fs:[00000030h]20_2_018DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA2C3 mov eax, dword ptr fs:[00000030h]20_2_018DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA2C3 mov eax, dword ptr fs:[00000030h]20_2_018DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA2C3 mov eax, dword ptr fs:[00000030h]20_2_018DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA2C3 mov eax, dword ptr fs:[00000030h]20_2_018DA2C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E02E1 mov eax, dword ptr fs:[00000030h]20_2_018E02E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E02E1 mov eax, dword ptr fs:[00000030h]20_2_018E02E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E02E1 mov eax, dword ptr fs:[00000030h]20_2_018E02E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C823B mov eax, dword ptr fs:[00000030h]20_2_018C823B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A625D mov eax, dword ptr fs:[00000030h]20_2_019A625D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198A250 mov eax, dword ptr fs:[00000030h]20_2_0198A250
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198A250 mov eax, dword ptr fs:[00000030h]20_2_0198A250
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D6259 mov eax, dword ptr fs:[00000030h]20_2_018D6259
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01958243 mov eax, dword ptr fs:[00000030h]20_2_01958243
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01958243 mov ecx, dword ptr fs:[00000030h]20_2_01958243
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CA250 mov eax, dword ptr fs:[00000030h]20_2_018CA250
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C826B mov eax, dword ptr fs:[00000030h]20_2_018C826B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01980274 mov eax, dword ptr fs:[00000030h]20_2_01980274
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D4260 mov eax, dword ptr fs:[00000030h]20_2_018D4260
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D4260 mov eax, dword ptr fs:[00000030h]20_2_018D4260
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D4260 mov eax, dword ptr fs:[00000030h]20_2_018D4260
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E59C mov eax, dword ptr fs:[00000030h]20_2_0190E59C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D2582 mov eax, dword ptr fs:[00000030h]20_2_018D2582
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D2582 mov ecx, dword ptr fs:[00000030h]20_2_018D2582
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01904588 mov eax, dword ptr fs:[00000030h]20_2_01904588
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019505A7 mov eax, dword ptr fs:[00000030h]20_2_019505A7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019505A7 mov eax, dword ptr fs:[00000030h]20_2_019505A7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019505A7 mov eax, dword ptr fs:[00000030h]20_2_019505A7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F45B1 mov eax, dword ptr fs:[00000030h]20_2_018F45B1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F45B1 mov eax, dword ptr fs:[00000030h]20_2_018F45B1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A5D0 mov eax, dword ptr fs:[00000030h]20_2_0190A5D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A5D0 mov eax, dword ptr fs:[00000030h]20_2_0190A5D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D65D0 mov eax, dword ptr fs:[00000030h]20_2_018D65D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E5CF mov eax, dword ptr fs:[00000030h]20_2_0190E5CF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E5CF mov eax, dword ptr fs:[00000030h]20_2_0190E5CF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE5E7 mov eax, dword ptr fs:[00000030h]20_2_018FE5E7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D25E0 mov eax, dword ptr fs:[00000030h]20_2_018D25E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C5ED mov eax, dword ptr fs:[00000030h]20_2_0190C5ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C5ED mov eax, dword ptr fs:[00000030h]20_2_0190C5ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01966500 mov eax, dword ptr fs:[00000030h]20_2_01966500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4500 mov eax, dword ptr fs:[00000030h]20_2_019A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4500 mov eax, dword ptr fs:[00000030h]20_2_019A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4500 mov eax, dword ptr fs:[00000030h]20_2_019A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4500 mov eax, dword ptr fs:[00000030h]20_2_019A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4500 mov eax, dword ptr fs:[00000030h]20_2_019A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4500 mov eax, dword ptr fs:[00000030h]20_2_019A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4500 mov eax, dword ptr fs:[00000030h]20_2_019A4500
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE53E mov eax, dword ptr fs:[00000030h]20_2_018FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE53E mov eax, dword ptr fs:[00000030h]20_2_018FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE53E mov eax, dword ptr fs:[00000030h]20_2_018FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE53E mov eax, dword ptr fs:[00000030h]20_2_018FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE53E mov eax, dword ptr fs:[00000030h]20_2_018FE53E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0535 mov eax, dword ptr fs:[00000030h]20_2_018E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0535 mov eax, dword ptr fs:[00000030h]20_2_018E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0535 mov eax, dword ptr fs:[00000030h]20_2_018E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0535 mov eax, dword ptr fs:[00000030h]20_2_018E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0535 mov eax, dword ptr fs:[00000030h]20_2_018E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0535 mov eax, dword ptr fs:[00000030h]20_2_018E0535
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8550 mov eax, dword ptr fs:[00000030h]20_2_018D8550
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8550 mov eax, dword ptr fs:[00000030h]20_2_018D8550
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190656A mov eax, dword ptr fs:[00000030h]20_2_0190656A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190656A mov eax, dword ptr fs:[00000030h]20_2_0190656A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190656A mov eax, dword ptr fs:[00000030h]20_2_0190656A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198A49A mov eax, dword ptr fs:[00000030h]20_2_0198A49A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019044B0 mov ecx, dword ptr fs:[00000030h]20_2_019044B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195A4B0 mov eax, dword ptr fs:[00000030h]20_2_0195A4B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D64AB mov eax, dword ptr fs:[00000030h]20_2_018D64AB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D04E5 mov ecx, dword ptr fs:[00000030h]20_2_018D04E5
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01908402 mov eax, dword ptr fs:[00000030h]20_2_01908402
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01908402 mov eax, dword ptr fs:[00000030h]20_2_01908402
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01908402 mov eax, dword ptr fs:[00000030h]20_2_01908402
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A430 mov eax, dword ptr fs:[00000030h]20_2_0190A430
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CC427 mov eax, dword ptr fs:[00000030h]20_2_018CC427
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CE420 mov eax, dword ptr fs:[00000030h]20_2_018CE420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CE420 mov eax, dword ptr fs:[00000030h]20_2_018CE420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CE420 mov eax, dword ptr fs:[00000030h]20_2_018CE420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956420 mov eax, dword ptr fs:[00000030h]20_2_01956420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956420 mov eax, dword ptr fs:[00000030h]20_2_01956420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956420 mov eax, dword ptr fs:[00000030h]20_2_01956420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956420 mov eax, dword ptr fs:[00000030h]20_2_01956420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956420 mov eax, dword ptr fs:[00000030h]20_2_01956420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956420 mov eax, dword ptr fs:[00000030h]20_2_01956420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01956420 mov eax, dword ptr fs:[00000030h]20_2_01956420
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0198A456 mov eax, dword ptr fs:[00000030h]20_2_0198A456
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C645D mov eax, dword ptr fs:[00000030h]20_2_018C645D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190E443 mov eax, dword ptr fs:[00000030h]20_2_0190E443
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F245A mov eax, dword ptr fs:[00000030h]20_2_018F245A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195C460 mov ecx, dword ptr fs:[00000030h]20_2_0195C460
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FA470 mov eax, dword ptr fs:[00000030h]20_2_018FA470
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FA470 mov eax, dword ptr fs:[00000030h]20_2_018FA470
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FA470 mov eax, dword ptr fs:[00000030h]20_2_018FA470
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197678E mov eax, dword ptr fs:[00000030h]20_2_0197678E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D07AF mov eax, dword ptr fs:[00000030h]20_2_018D07AF
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019847A0 mov eax, dword ptr fs:[00000030h]20_2_019847A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DC7C0 mov eax, dword ptr fs:[00000030h]20_2_018DC7C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019507C3 mov eax, dword ptr fs:[00000030h]20_2_019507C3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F27ED mov eax, dword ptr fs:[00000030h]20_2_018F27ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F27ED mov eax, dword ptr fs:[00000030h]20_2_018F27ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F27ED mov eax, dword ptr fs:[00000030h]20_2_018F27ED
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195E7E1 mov eax, dword ptr fs:[00000030h]20_2_0195E7E1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D47FB mov eax, dword ptr fs:[00000030h]20_2_018D47FB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D47FB mov eax, dword ptr fs:[00000030h]20_2_018D47FB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01900710 mov eax, dword ptr fs:[00000030h]20_2_01900710
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C700 mov eax, dword ptr fs:[00000030h]20_2_0190C700
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0710 mov eax, dword ptr fs:[00000030h]20_2_018D0710
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194C730 mov eax, dword ptr fs:[00000030h]20_2_0194C730
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190273C mov eax, dword ptr fs:[00000030h]20_2_0190273C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190273C mov ecx, dword ptr fs:[00000030h]20_2_0190273C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190273C mov eax, dword ptr fs:[00000030h]20_2_0190273C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C720 mov eax, dword ptr fs:[00000030h]20_2_0190C720
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C720 mov eax, dword ptr fs:[00000030h]20_2_0190C720
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01954755 mov eax, dword ptr fs:[00000030h]20_2_01954755
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912750 mov eax, dword ptr fs:[00000030h]20_2_01912750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912750 mov eax, dword ptr fs:[00000030h]20_2_01912750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195E75D mov eax, dword ptr fs:[00000030h]20_2_0195E75D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190674D mov esi, dword ptr fs:[00000030h]20_2_0190674D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190674D mov eax, dword ptr fs:[00000030h]20_2_0190674D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190674D mov eax, dword ptr fs:[00000030h]20_2_0190674D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0750 mov eax, dword ptr fs:[00000030h]20_2_018D0750
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8770 mov eax, dword ptr fs:[00000030h]20_2_018D8770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0770 mov eax, dword ptr fs:[00000030h]20_2_018E0770
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D4690 mov eax, dword ptr fs:[00000030h]20_2_018D4690
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D4690 mov eax, dword ptr fs:[00000030h]20_2_018D4690
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019066B0 mov eax, dword ptr fs:[00000030h]20_2_019066B0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C6A6 mov eax, dword ptr fs:[00000030h]20_2_0190C6A6
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A6C7 mov ebx, dword ptr fs:[00000030h]20_2_0190A6C7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A6C7 mov eax, dword ptr fs:[00000030h]20_2_0190A6C7
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019506F1 mov eax, dword ptr fs:[00000030h]20_2_019506F1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019506F1 mov eax, dword ptr fs:[00000030h]20_2_019506F1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E6F2 mov eax, dword ptr fs:[00000030h]20_2_0194E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E6F2 mov eax, dword ptr fs:[00000030h]20_2_0194E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E6F2 mov eax, dword ptr fs:[00000030h]20_2_0194E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E6F2 mov eax, dword ptr fs:[00000030h]20_2_0194E6F2
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E260B mov eax, dword ptr fs:[00000030h]20_2_018E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E260B mov eax, dword ptr fs:[00000030h]20_2_018E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E260B mov eax, dword ptr fs:[00000030h]20_2_018E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E260B mov eax, dword ptr fs:[00000030h]20_2_018E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E260B mov eax, dword ptr fs:[00000030h]20_2_018E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E260B mov eax, dword ptr fs:[00000030h]20_2_018E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E260B mov eax, dword ptr fs:[00000030h]20_2_018E260B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01912619 mov eax, dword ptr fs:[00000030h]20_2_01912619
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E609 mov eax, dword ptr fs:[00000030h]20_2_0194E609
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D262C mov eax, dword ptr fs:[00000030h]20_2_018D262C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EE627 mov eax, dword ptr fs:[00000030h]20_2_018EE627
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01906620 mov eax, dword ptr fs:[00000030h]20_2_01906620
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01908620 mov eax, dword ptr fs:[00000030h]20_2_01908620
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018EC640 mov eax, dword ptr fs:[00000030h]20_2_018EC640
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01902674 mov eax, dword ptr fs:[00000030h]20_2_01902674
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A660 mov eax, dword ptr fs:[00000030h]20_2_0190A660
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A660 mov eax, dword ptr fs:[00000030h]20_2_0190A660
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199866E mov eax, dword ptr fs:[00000030h]20_2_0199866E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199866E mov eax, dword ptr fs:[00000030h]20_2_0199866E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D09AD mov eax, dword ptr fs:[00000030h]20_2_018D09AD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D09AD mov eax, dword ptr fs:[00000030h]20_2_018D09AD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019589B3 mov esi, dword ptr fs:[00000030h]20_2_019589B3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019589B3 mov eax, dword ptr fs:[00000030h]20_2_019589B3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019589B3 mov eax, dword ptr fs:[00000030h]20_2_019589B3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E29A0 mov eax, dword ptr fs:[00000030h]20_2_018E29A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019049D0 mov eax, dword ptr fs:[00000030h]20_2_019049D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199A9D3 mov eax, dword ptr fs:[00000030h]20_2_0199A9D3
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019669C0 mov eax, dword ptr fs:[00000030h]20_2_019669C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA9D0 mov eax, dword ptr fs:[00000030h]20_2_018DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA9D0 mov eax, dword ptr fs:[00000030h]20_2_018DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA9D0 mov eax, dword ptr fs:[00000030h]20_2_018DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA9D0 mov eax, dword ptr fs:[00000030h]20_2_018DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA9D0 mov eax, dword ptr fs:[00000030h]20_2_018DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DA9D0 mov eax, dword ptr fs:[00000030h]20_2_018DA9D0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019029F9 mov eax, dword ptr fs:[00000030h]20_2_019029F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019029F9 mov eax, dword ptr fs:[00000030h]20_2_019029F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195E9E0 mov eax, dword ptr fs:[00000030h]20_2_0195E9E0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195C912 mov eax, dword ptr fs:[00000030h]20_2_0195C912
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C8918 mov eax, dword ptr fs:[00000030h]20_2_018C8918
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C8918 mov eax, dword ptr fs:[00000030h]20_2_018C8918
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E908 mov eax, dword ptr fs:[00000030h]20_2_0194E908
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194E908 mov eax, dword ptr fs:[00000030h]20_2_0194E908
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0196892B mov eax, dword ptr fs:[00000030h]20_2_0196892B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195892A mov eax, dword ptr fs:[00000030h]20_2_0195892A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01950946 mov eax, dword ptr fs:[00000030h]20_2_01950946
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4940 mov eax, dword ptr fs:[00000030h]20_2_019A4940
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195C97C mov eax, dword ptr fs:[00000030h]20_2_0195C97C
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F6962 mov eax, dword ptr fs:[00000030h]20_2_018F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F6962 mov eax, dword ptr fs:[00000030h]20_2_018F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F6962 mov eax, dword ptr fs:[00000030h]20_2_018F6962
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01974978 mov eax, dword ptr fs:[00000030h]20_2_01974978
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01974978 mov eax, dword ptr fs:[00000030h]20_2_01974978
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0191096E mov eax, dword ptr fs:[00000030h]20_2_0191096E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0191096E mov edx, dword ptr fs:[00000030h]20_2_0191096E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0191096E mov eax, dword ptr fs:[00000030h]20_2_0191096E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195C89D mov eax, dword ptr fs:[00000030h]20_2_0195C89D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0887 mov eax, dword ptr fs:[00000030h]20_2_018D0887
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FE8C0 mov eax, dword ptr fs:[00000030h]20_2_018FE8C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A08C0 mov eax, dword ptr fs:[00000030h]20_2_019A08C0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C8F9 mov eax, dword ptr fs:[00000030h]20_2_0190C8F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190C8F9 mov eax, dword ptr fs:[00000030h]20_2_0190C8F9
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199A8E4 mov eax, dword ptr fs:[00000030h]20_2_0199A8E4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195C810 mov eax, dword ptr fs:[00000030h]20_2_0195C810
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190A830 mov eax, dword ptr fs:[00000030h]20_2_0190A830
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197483A mov eax, dword ptr fs:[00000030h]20_2_0197483A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197483A mov eax, dword ptr fs:[00000030h]20_2_0197483A
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F2835 mov eax, dword ptr fs:[00000030h]20_2_018F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F2835 mov eax, dword ptr fs:[00000030h]20_2_018F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F2835 mov eax, dword ptr fs:[00000030h]20_2_018F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F2835 mov ecx, dword ptr fs:[00000030h]20_2_018F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F2835 mov eax, dword ptr fs:[00000030h]20_2_018F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F2835 mov eax, dword ptr fs:[00000030h]20_2_018F2835
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01900854 mov eax, dword ptr fs:[00000030h]20_2_01900854
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E2840 mov ecx, dword ptr fs:[00000030h]20_2_018E2840
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D4859 mov eax, dword ptr fs:[00000030h]20_2_018D4859
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D4859 mov eax, dword ptr fs:[00000030h]20_2_018D4859
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01966870 mov eax, dword ptr fs:[00000030h]20_2_01966870
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01966870 mov eax, dword ptr fs:[00000030h]20_2_01966870
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195E872 mov eax, dword ptr fs:[00000030h]20_2_0195E872
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195E872 mov eax, dword ptr fs:[00000030h]20_2_0195E872
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01984BB0 mov eax, dword ptr fs:[00000030h]20_2_01984BB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01984BB0 mov eax, dword ptr fs:[00000030h]20_2_01984BB0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0BBE mov eax, dword ptr fs:[00000030h]20_2_018E0BBE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0BBE mov eax, dword ptr fs:[00000030h]20_2_018E0BBE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0BCD mov eax, dword ptr fs:[00000030h]20_2_018D0BCD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0BCD mov eax, dword ptr fs:[00000030h]20_2_018D0BCD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0BCD mov eax, dword ptr fs:[00000030h]20_2_018D0BCD
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F0BCB mov eax, dword ptr fs:[00000030h]20_2_018F0BCB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F0BCB mov eax, dword ptr fs:[00000030h]20_2_018F0BCB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F0BCB mov eax, dword ptr fs:[00000030h]20_2_018F0BCB
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197EBD0 mov eax, dword ptr fs:[00000030h]20_2_0197EBD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195CBF0 mov eax, dword ptr fs:[00000030h]20_2_0195CBF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FEBFC mov eax, dword ptr fs:[00000030h]20_2_018FEBFC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8BF0 mov eax, dword ptr fs:[00000030h]20_2_018D8BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8BF0 mov eax, dword ptr fs:[00000030h]20_2_018D8BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8BF0 mov eax, dword ptr fs:[00000030h]20_2_018D8BF0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0194EB1D mov eax, dword ptr fs:[00000030h]20_2_0194EB1D
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4B00 mov eax, dword ptr fs:[00000030h]20_2_019A4B00
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FEB20 mov eax, dword ptr fs:[00000030h]20_2_018FEB20
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FEB20 mov eax, dword ptr fs:[00000030h]20_2_018FEB20
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01998B28 mov eax, dword ptr fs:[00000030h]20_2_01998B28
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01998B28 mov eax, dword ptr fs:[00000030h]20_2_01998B28
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0197EB50 mov eax, dword ptr fs:[00000030h]20_2_0197EB50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A2B57 mov eax, dword ptr fs:[00000030h]20_2_019A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A2B57 mov eax, dword ptr fs:[00000030h]20_2_019A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A2B57 mov eax, dword ptr fs:[00000030h]20_2_019A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A2B57 mov eax, dword ptr fs:[00000030h]20_2_019A2B57
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01984B4B mov eax, dword ptr fs:[00000030h]20_2_01984B4B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01984B4B mov eax, dword ptr fs:[00000030h]20_2_01984B4B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01978B42 mov eax, dword ptr fs:[00000030h]20_2_01978B42
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01966B40 mov eax, dword ptr fs:[00000030h]20_2_01966B40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01966B40 mov eax, dword ptr fs:[00000030h]20_2_01966B40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0199AB40 mov eax, dword ptr fs:[00000030h]20_2_0199AB40
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018C8B50 mov eax, dword ptr fs:[00000030h]20_2_018C8B50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018CCB7E mov eax, dword ptr fs:[00000030h]20_2_018CCB7E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01908A90 mov edx, dword ptr fs:[00000030h]20_2_01908A90
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018DEA80 mov eax, dword ptr fs:[00000030h]20_2_018DEA80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_019A4A80 mov eax, dword ptr fs:[00000030h]20_2_019A4A80
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8AA0 mov eax, dword ptr fs:[00000030h]20_2_018D8AA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D8AA0 mov eax, dword ptr fs:[00000030h]20_2_018D8AA0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01926AA4 mov eax, dword ptr fs:[00000030h]20_2_01926AA4
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01904AD0 mov eax, dword ptr fs:[00000030h]20_2_01904AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01904AD0 mov eax, dword ptr fs:[00000030h]20_2_01904AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D0AD0 mov eax, dword ptr fs:[00000030h]20_2_018D0AD0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01926ACC mov eax, dword ptr fs:[00000030h]20_2_01926ACC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01926ACC mov eax, dword ptr fs:[00000030h]20_2_01926ACC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_01926ACC mov eax, dword ptr fs:[00000030h]20_2_01926ACC
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190AAEE mov eax, dword ptr fs:[00000030h]20_2_0190AAEE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190AAEE mov eax, dword ptr fs:[00000030h]20_2_0190AAEE
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0195CA11 mov eax, dword ptr fs:[00000030h]20_2_0195CA11
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018FEA2E mov eax, dword ptr fs:[00000030h]20_2_018FEA2E
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190CA38 mov eax, dword ptr fs:[00000030h]20_2_0190CA38
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_0190CA24 mov eax, dword ptr fs:[00000030h]20_2_0190CA24
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F4A35 mov eax, dword ptr fs:[00000030h]20_2_018F4A35
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018F4A35 mov eax, dword ptr fs:[00000030h]20_2_018F4A35
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0A5B mov eax, dword ptr fs:[00000030h]20_2_018E0A5B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018E0A5B mov eax, dword ptr fs:[00000030h]20_2_018E0A5B
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D6A50 mov eax, dword ptr fs:[00000030h]20_2_018D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D6A50 mov eax, dword ptr fs:[00000030h]20_2_018D6A50
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 20_2_018D6A50 mov eax, dword ptr fs:[00000030h]20_2_018D6A50
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Allocates memory in foreign processes
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
            Injects a PE file into a foreign processes
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1139008Jump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeProcess created: C:\Users\user\AppData\Local\Temp\ghedgegehe.exe "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 20Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "c:\users\user\appdata\local\temp\ghedgegehe.exe" "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\skype\purches order.exe" && ping 127.0.0.1 -n 20 > nul && "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\skype\purches order.exe"
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "c:\users\user\appdata\local\temp\ghedgegehe.exe" "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\skype\purches order.exe" && ping 127.0.0.1 -n 20 > nul && "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\skype\purches order.exe"Jump to behavior
            Source: explorer.exe, 00000016.00000002.2563984081.00000000095B9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2530675285.000000000D5C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2551944962.0000000001080000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: explorer.exe, 00000016.00000002.2551944962.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.2516288310.0000000001080000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: explorer.exe, 00000016.00000002.2551944962.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.2516288310.0000000001080000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: EProgram Manager
            Source: explorer.exe, 00000016.00000000.2515831260.0000000000889000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2549041838.0000000000889000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
            Source: explorer.exe, 00000016.00000002.2551944962.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.2516288310.0000000001080000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\order 4502657678.exeQueries volume information: C:\Users\user\Desktop\order 4502657678.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeQueries volume information: C:\Users\user\AppData\Local\Temp\ghedgegehe.exe VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\ghedgegehe.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\order 4502657678.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 20.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure1
            Valid Accounts            		1
            Command and Scripting Interpreter            		1
            Valid Accounts            		1
            Valid Accounts            		11
            Masquerading            		OS Credential Dumping221
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/Job12
            Registry Run Keys / Startup Folder            		1
            Access Token Manipulation            		1
            Valid Accounts            		LSASS Memory2
            Process Discovery            		Remote Desktop ProtocolData from Removable Media1
            Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAt1
            DLL Side-Loading            		412
            Process Injection            		1
            Access Token Manipulation            		Security Account Manager41
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook12
            Registry Run Keys / Startup Folder            		1
            Disable or Modify Tools            		NTDS1
            Remote System Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
            DLL Side-Loading            		41
            Virtualization/Sandbox Evasion            		LSA Secrets1
            System Network Configuration Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts412
            Process Injection            		Cached Domain Credentials2
            File and Directory Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            Deobfuscate/Decode Files or Information            		DCSync112
            System Information Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Hidden Files and Directories            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt4
            Obfuscated Files or Information            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron11
            Software Packing            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
            Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
            DLL Side-Loading            		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430351 Sample: order 4502657678.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for dropped file 2->49 51 9 other signatures 2->51 10 order 4502657678.exe 5 2->10         started        process3 signatures4 61 Moves itself to temp directory 10->61 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 10->63 13 ghedgegehe.exe 4 10->13         started        process5 signatures6 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->65 16 cmd.exe 3 13->16         started        process7 file8 35 C:\Users\user\AppData\...\purches order.exe, PE32 16->35 dropped 39 Uses ping.exe to sleep 16->39 41 Drops PE files to the startup folder 16->41 43 Uses ping.exe to check the status of other devices and networks 16->43 20 purches order.exe 3 16->20         started        23 PING.EXE 1 16->23         started        26 conhost.exe 16->26         started        28 PING.EXE 1 16->28         started        signatures9 process10 dnsIp11 53 Writes to foreign memory regions 20->53 55 Allocates memory in foreign processes 20->55 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->57 59 Injects a PE file into a foreign processes 20->59 30 AddInProcess32.exe 20->30         started        37 127.0.0.1 unknown unknown 23->37 signatures12 process13 signatures14 67 Maps a DLL or memory area into another process 30->67 69 Tries to detect virtualization through RDTSC time measurements 30->69 33 explorer.exe 30->33 injected process15

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            order 4502657678.exe24%ReversingLabs
            order 4502657678.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe24%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://schemas.micro0%URL Reputationsafe
            http://purl.oen0%URL Reputationsafe
            https://word.office.com5760%Avira URL Cloudsafe
            www.budget-harmony.com/ij84/0%Avira URL Cloudsafe
            https://excel.office.comE0%Avira URL Cloudsafe
            https://outlook.comNaP0B0%Avira URL Cloudsafe
            https://powerpoint.office.comcemberZ0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            www.budget-harmony.com/ij84/true
            • Avira URL Cloud: safe
            		low

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000016.00000002.2562512037.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpfalse
              		high
              https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-alexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                		high
                https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                  		high
                  https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    https://wns.windows.com/batexplorer.exe, 00000016.00000000.2523704295.0000000009724000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2563984081.0000000009724000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-yearsexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://www.msn.com/en-us/health/wellness/7-secrets-to-a-happy-old-age-backed-by-science/ss-AA1hwpvWexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000016.00000000.2517182041.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2554089500.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.msn.com/en-us/news/politics/california-workers-will-get-five-sick-days-instead-of-three-explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    https://api.msn.com/v1/news/Feed/Windows?activityId=C2BB6DDCE8D847D6B779FE8AEC27D161&timeOut=5000&ocexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        http://schemas.microexplorer.exe, 00000016.00000000.2520673588.0000000007AF0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2553005536.0000000002C00000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2559813276.0000000007B10000.00000002.00000001.00040000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svgexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            https://word.office.com576explorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://www.msn.com/en-us/news/opinion/decline-of-decorum-21-essential-manners-today-s-parents-fail-explorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppinexplorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://purl.oenorder 4502657678.exe, 00000004.00000002.1369737440.0000000006053000.00000004.00000020.00020000.00000000.sdmp, ghedgegehe.exe, 0000000A.00000002.1466724304.0000000006A02000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reveexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.msn.com/en-us/money/companies/legacy-park-auction-canceled-liquidation-proposed-here-s-wexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://excel.office.comEexplorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://android.notify.windows.com/iOSexplorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.msn.com/en-us/news/crime/one-dead-several-wounded-after-drive-by-shootings-in-south-la/aexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://powerpoint.office.comcemberZexplorer.exe, 00000016.00000000.2527841871.000000000CFF4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2568699459.000000000CFF4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svgexplorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://api.msn.com/Xexplorer.exe, 00000016.00000002.2562512037.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controvexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://api.msn.com/$explorer.exe, 00000016.00000002.2562512037.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2522467915.00000000093B4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://www.msn.com:443/en-us/feedexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsiexplorer.exe, 00000016.00000002.2557784325.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2519166634.0000000006F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://outlook.comNaP0Bexplorer.exe, 00000016.00000002.2569046857.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.2527841871.000000000D1B6000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown

                                                                      World Map of Contacted IPs

                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs

                                                                      Public IPs

                                                                      IPDomainCountryFlagASNASN NameMalicious

                                                                      Private

                                                                      IP
                                                                      127.0.0.1

                                                                      General Information

                                                                      Joe Sandbox version:40.0.0 Tourmaline
                                                                      Analysis ID:1430351
                                                                      Start date and time:2024-04-23 15:12:11 +02:00
                                                                      Joe Sandbox product:CloudBasic
                                                                      Overall analysis duration:0h 8m 21s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:full
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                      Number of analysed new started processes analysed:22
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:1
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Sample name:order 4502657678.exe
                                                                      Detection:MAL
                                                                      Classification:mal100.troj.adwa.evad.winEXE@14/8@0/1
                                                                      EGA Information:
                                                                      • Successful, ratio: 100%
                                                                      HCA Information:
                                                                      • Successful, ratio: 97%
                                                                      • Number of executed functions: 204
                                                                      • Number of non-executed functions: 11
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .exe

                                                                      Warnings

                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                      • VT rate limit hit for: order 4502657678.exe

                                                                      Simulations

                                                                      Behavior and APIs

                                                                      TimeTypeDescription
                                                                      15:13:13AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purches order.lnk
                                                                      15:13:28AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype
                                                                      15:15:11API Interceptor1x Sleep call for process: explorer.exe modified

                                                                      Joe Sandbox View / Context

                                                                      IPs

                                                                      ⊘No context

                                                                      Domains

                                                                      ⊘No context

                                                                      ASNs

                                                                      ⊘No context

                                                                      JA3 Fingerprints

                                                                      ⊘No context

                                                                      Dropped Files

                                                                      ⊘No context

                                                                      Created / dropped Files

                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ghedgegehe.exe.log

                                                                      Download File
                                                                      Process:C:\Users\user\AppData\Local\Temp\ghedgegehe.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1301
                                                                      Entropy (8bit):5.334025345208678
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLU84qpE4KlKDE4KhKiKhIE4Kx1qE4qXKIE4oKNzKoZAE4Kze0E4VE4j:Mgv2HKlYHKh3oIHKx1qHitHo6hAHKzeG
                                                                      MD5:CF3554ECA7BCFAA7592F661A29CB1474
                                                                      SHA1:1CDB763E4126E6798948F08F3FB1E7E0EA8CF21F
                                                                      SHA-256:DFB08F86711FAD1F63C4548AEB9D259C8B4768CC7F1A9EB45A00DED023F085EA
                                                                      SHA-512:D46446B5116FF7639608AD2F2DEA29FEE3EB03F43C8D0BE4790F924A520B20C0DFCA5BDBFDD4A16E69ECF1840CB5A0411AC85A559C2651C372A538E19830B087
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\order 4502657678.exe.log

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\order 4502657678.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1301
                                                                      Entropy (8bit):5.334025345208678
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLU84qpE4KlKDE4KhKiKhIE4Kx1qE4qXKIE4oKNzKoZAE4Kze0E4VE4j:Mgv2HKlYHKh3oIHKx1qHitHo6hAHKzeG
                                                                      MD5:CF3554ECA7BCFAA7592F661A29CB1474
                                                                      SHA1:1CDB763E4126E6798948F08F3FB1E7E0EA8CF21F
                                                                      SHA-256:DFB08F86711FAD1F63C4548AEB9D259C8B4768CC7F1A9EB45A00DED023F085EA
                                                                      SHA-512:D46446B5116FF7639608AD2F2DEA29FEE3EB03F43C8D0BE4790F924A520B20C0DFCA5BDBFDD4A16E69ECF1840CB5A0411AC85A559C2651C372A538E19830B087
                                                                      Malicious:false
                                                                      Reputation:low
                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\purches order.exe.log

                                                                      Download File
                                                                      Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1216
                                                                      Entropy (8bit):5.34331486778365
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLU84qpE4KlKDE4KhKiKhIE4Kx1qE4qXKIE4oKNzKoZAE4Kze0E4j:Mgv2HKlYHKh3oIHKx1qHitHo6hAHKzea
                                                                      MD5:FB53815DEEC334028DBDE4E3660E26D0
                                                                      SHA1:7F491359EC244406DFC8AA39FC9B727D677E4FDF
                                                                      SHA-256:C3EC8D6C079B1940D82374A85E9DC41ED9FF683ADA338F89E375AA7AC777749D
                                                                      SHA-512:5CC466901D7911BE1E1731162CC01C371444AAFA9A504F1F22516F60C888048EB78B5C5A12215EE2B127BD67A19677E370686465E85E08BC14015F8FAB049E49
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\purches order.lnk

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\order 4502657678.exe
                                                                      File Type:MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
                                                                      Category:dropped
                                                                      Size (bytes):1554
                                                                      Entropy (8bit):3.016362436864724
                                                                      Encrypted:false
                                                                      SSDEEP:24:8c2CzKgWLgD4/BOmRC87q8Md9aR1AyjCyjMaR1wsd04qy:8rgDsvRC87tMdMCyjMj1y
                                                                      MD5:682B4185EA23B50E3987CCA1A900BD22
                                                                      SHA1:5E66A8CB6FDC15667B9C1C0543293E3CFB1C1ECC
                                                                      SHA-256:E540E3B03DCE0D2DEC8807061C1F881B5763EE679292A2D892494CDACABB570E
                                                                      SHA-512:53671EF45EC87BB4D6304939BC779D4E718CECCE61E05036E6FDF37A866D8D5A3EC6844B02957C55D4C7E63C80ADB6744B294D0AC25D5DAE438325695095498B
                                                                      Malicious:false
                                                                      Preview:L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....N.1...........user..:............................................b.r.o.k.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.....Z.1...........Programs..B............................................P.r.o.g.r.a.m.s.....V.1...........Startup.@............................................S.t.a.r.t.u.p.....P.1...........skype.<............................................s.k.y.p.e.....t.2...........pur

                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\cmd.exe
                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Category:dropped
                                                                      Size (bytes):808448
                                                                      Entropy (8bit):6.910274645407733
                                                                      Encrypted:false
                                                                      SSDEEP:12288:2uOpmBwGXjdX32ogZ+g/yHgtK+CVIN5X9yKBg7vjlRziln:ZOpmB3XZnMZ4goi39yKe/DA
                                                                      MD5:82DF9D1EE9B303D453A7EA91D5F574E2
                                                                      SHA1:4B121F046E002AC5E2FBEEC21079F6FD4C55D370
                                                                      SHA-256:61E2A9DB8F357380B18BA1017F2AE52D656D2C5F4DE8851E244566B8C986D88A
                                                                      SHA-512:D685FCD4D408F7421D9546AD82435B555563FDDD698E3FC5499204935B0556F7BBF2156C1A60F49CDBDEE2A289D122405992CFD0B63A1D59B05B4B545471270C
                                                                      Malicious:true
                                                                      Antivirus:
                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                      • Antivirus: ReversingLabs, Detection: 24%
                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~.YK.........."...P..N...........l... ........@.. ....................................`..................................k..W.................................................................................... ............... ..H............text...$L... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H.......X1..l:......m...d.............................................................................................................................(....*&..(.....*.s.........s ........s!........s"........s#........*Z........o6...........*&..(7....*&........*".......*Vs....(@...t.........*..(A...*~.(7.....s7...(8...}*....("....*&.{....+.*&.{....+.*"..}....*&.{....+.*"..}....*&.{....+.*&.{....+.*&.{....+.*6..(8...}....*&.{....+.*"..}....*&.{....+.*"..}....*&.{....+.*"..}....

                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe:Zone.Identifier

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\cmd.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:modified
                                                                      Size (bytes):26
                                                                      Entropy (8bit):3.95006375643621
                                                                      Encrypted:false
                                                                      SSDEEP:3:ggPYV:rPYV
                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                      Malicious:false
                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                      \Device\Null

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\PING.EXE
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1215
                                                                      Entropy (8bit):4.7956307298586704
                                                                      Encrypted:false
                                                                      SSDEEP:12:PKMRJpTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeT0s3oAFSkIrxMVlmJHal:/xTAokItULVDv
                                                                      MD5:F3B28DC684DC4263884837E562B73F21
                                                                      SHA1:C422C4992C34EF4E37F49CDA0E4281ADAD04BCDA
                                                                      SHA-256:E5CF8961CBFED02944C6B03672FE979E0F5B75B0F062AC906F479908FED6E448
                                                                      SHA-512:6D771CAC6A5325F319509A0F8F3571903E9DD3B73BB386F89E196892EEE29C3B8C6823FF1837F6B1C83A4B95F2E333A5AA58A0C256182C71E4C4CE91D3267B00
                                                                      Malicious:false
                                                                      Preview:..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: byt

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Entropy (8bit):6.910274645407733
                                                                      TrID:
                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                      • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                      • Windows Screen Saver (13104/52) 0.07%
                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                      File name:order 4502657678.exe
                                                                      File size:808'448 bytes
                                                                      MD5:82df9d1ee9b303d453a7ea91d5f574e2
                                                                      SHA1:4b121f046e002ac5e2fbeec21079f6fd4c55d370
                                                                      SHA256:61e2a9db8f357380b18ba1017f2ae52d656d2c5f4de8851e244566b8c986d88a
                                                                      SHA512:d685fcd4d408f7421d9546ad82435b555563fddd698e3fc5499204935b0556f7bbf2156c1a60f49cdbdee2a289d122405992cfd0b63a1d59b05b4b545471270c
                                                                      SSDEEP:12288:2uOpmBwGXjdX32ogZ+g/yHgtK+CVIN5X9yKBg7vjlRziln:ZOpmB3XZnMZ4goi39yKe/DA
                                                                      TLSH:38056BE613D4FE00D07E777475A1680483F7A8CAE661D60B189C63DA77F3A096BE2352
                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~.YK.........."...P..N...........l... ........@.. ....................................`................................

                                                                      File Icon

                                                                      Icon Hash:90cececece8e8eb0

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x4c6c1e
                                                                      Entrypoint Section:.text
                                                                      Digitally signed:false
                                                                      Imagebase:0x400000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                      Time Stamp:0x4B590D7E [Fri Jan 22 02:29:18 2010 UTC]
                                                                      TLS Callbacks:
                                                                      CLR (.Net) Version:
                                                                      OS Version Major:4
                                                                      OS Version Minor:0
                                                                      File Version Major:4
                                                                      File Version Minor:0
                                                                      Subsystem Version Major:4
                                                                      Subsystem Version Minor:0
                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      jmp dword ptr [00402000h]
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xc6bc40x57.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xc80000x30c.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xca0000xc.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x20000xc4c240xc4e00ef70aad02048a276aaf90d7dccc3557cFalse0.662359871031746data6.918820158334831IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .rsrc0xc80000x30c0x40042700c2ce489e7d7b07df5f6c6de6ff7False0.337890625data2.5631650588102186IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .reloc0xca0000xc0x20046ee06c369a35505702b21961786472aFalse0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                      RT_VERSION0xc80580x2b4data0.45375722543352603

                                                                      Imports

                                                                      DLLImport
                                                                      mscoree.dll_CorExeMain

                                                                      Network Behavior

                                                                      ⊘No network behavior found

                                                                      Statistics

                                                                      CPU Usage

                                                                      Click to jump to process

                                                                      Memory Usage

                                                                      Click to jump to process

                                                                      High Level Behavior Distribution

                                                                      Click to dive into process behavior distribution

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Target ID:4
                                                                      Start time:15:13:03
                                                                      Start date:23/04/2024
                                                                      Path:C:\Users\user\Desktop\order 4502657678.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"C:\Users\user\Desktop\order 4502657678.exe"
                                                                      Imagebase:0x580000
                                                                      File size:808'448 bytes
                                                                      MD5 hash:82DF9D1EE9B303D453A7EA91D5F574E2
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000004.00000002.1359801669.00000000025DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.1363182798.000000000367C000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000004.00000002.1363182798.000000000373B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.1363182798.0000000003535000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.1363182798.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.1363182798.00000000035D9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000004.00000002.1365654712.0000000005090000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000004.00000002.1359801669.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:low
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:10
                                                                      Start time:15:13:11
                                                                      Start date:23/04/2024
                                                                      Path:C:\Users\user\AppData\Local\Temp\ghedgegehe.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\ghedgegehe.exe"
                                                                      Imagebase:0x580000
                                                                      File size:808'448 bytes
                                                                      MD5 hash:82DF9D1EE9B303D453A7EA91D5F574E2
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 0000000A.00000002.1463152963.00000000041AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 0000000A.00000002.1463152963.00000000040C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 0000000A.00000002.1459376158.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.1463152963.00000000042E7000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 0000000A.00000002.1463152963.0000000004092000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 0000000A.00000002.1459376158.00000000030DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:low
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:12
                                                                      Start time:15:13:21
                                                                      Start date:23/04/2024
                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\user\AppData\Local\Temp\ghedgegehe.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"
                                                                      Imagebase:0xd70000
                                                                      File size:236'544 bytes
                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:false

                                                                      General

                                                                      Target ID:13
                                                                      Start time:15:13:22
                                                                      Start date:23/04/2024
                                                                      Path:C:\Windows\System32\conhost.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      Imagebase:0x7ff620390000
                                                                      File size:862'208 bytes
                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:high
                                                                      Has exited:false

                                                                      General

                                                                      Target ID:14
                                                                      Start time:15:13:22
                                                                      Start date:23/04/2024
                                                                      Path:C:\Windows\SysWOW64\PING.EXE
                                                                      Wow64 process (32bit):true
                                                                      Commandline:ping 127.0.0.1 -n 20
                                                                      Imagebase:0x670000
                                                                      File size:18'944 bytes
                                                                      MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:moderate
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:15
                                                                      Start time:15:13:42
                                                                      Start date:23/04/2024
                                                                      Path:C:\Windows\SysWOW64\PING.EXE
                                                                      Wow64 process (32bit):true
                                                                      Commandline:ping 127.0.0.1 -n 20
                                                                      Imagebase:0x670000
                                                                      File size:18'944 bytes
                                                                      MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:moderate
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:16
                                                                      Start time:15:14:01
                                                                      Start date:23/04/2024
                                                                      Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\purches order.exe"
                                                                      Imagebase:0x20000
                                                                      File size:808'448 bytes
                                                                      MD5 hash:82DF9D1EE9B303D453A7EA91D5F574E2
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.2532555388.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000010.00000002.2532555388.000000000399B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000010.00000002.2532555388.0000000003882000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.2532555388.0000000003ACC000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000010.00000002.2532555388.00000000038B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000010.00000002.2515396631.00000000027E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      Antivirus matches:
                                                                      • Detection: 100%, Joe Sandbox ML
                                                                      • Detection: 24%, ReversingLabs
                                                                      Reputation:low
                                                                      Has exited:true

                                                                      General

                                                                      Target ID:20
                                                                      Start time:15:14:34
                                                                      Start date:23/04/2024
                                                                      Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                      Imagebase:0xe70000
                                                                      File size:43'008 bytes
                                                                      MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000014.00000002.2548486119.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      Reputation:moderate
                                                                      Has exited:false

                                                                      General

                                                                      Target ID:22
                                                                      Start time:15:15:08
                                                                      Start date:23/04/2024
                                                                      Path:C:\Windows\explorer.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                      Imagebase:0x7ff609fd0000
                                                                      File size:5'141'208 bytes
                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                      Has elevated privileges:false
                                                                      Has administrator privileges:false
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000016.00000002.2562378664.0000000009159000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      Reputation:high
                                                                      Has exited:false

                                                                      Disassembly

                                                                      Reset < >

                                                                        Execution Graph

                                                                        Execution Coverage:19.3%
                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                        Signature Coverage:6.9%
                                                                        Total number of Nodes:145
                                                                        Total number of Limit Nodes:4
                                                                        execution_graph 47877 5ee59b8 47878 5ee59ea 47877->47878 47881 5eec7df 47878->47881 47882 5eec821 47881->47882 47888 5eeca78 47882->47888 47883 5eec8d9 47892 7c94d98 47883->47892 47896 7c94d81 47883->47896 47884 5eeb089 47889 5eeca8c 47888->47889 47900 5eecdea 47889->47900 47893 7c94dc6 47892->47893 47908 7c9c871 47893->47908 47894 7c9ac1c 47894->47884 47897 7c94d98 47896->47897 47899 7c9c871 2 API calls 47897->47899 47898 7c9ac1c 47898->47884 47899->47898 47901 5eece3b 47900->47901 47904 5eed2b8 47901->47904 47905 5eed302 DeleteFileW 47904->47905 47907 5eecd82 47905->47907 47907->47883 47910 7c9c878 47908->47910 47909 7c9c814 47909->47894 47910->47909 47914 7c9ca00 47910->47914 47922 7c9c9f0 47910->47922 47911 7c9c8b9 47911->47894 47915 7c9ca20 47914->47915 47916 7c9ced4 47915->47916 47930 7c9dd70 47915->47930 47934 72e2d78 47916->47934 47938 72e2d67 47916->47938 47942 72e31f0 47916->47942 47917 7c9ceda 47917->47911 47928 7c9ca00 47922->47928 47923 7c9ced4 47925 72e2d78 2 API calls 47923->47925 47926 72e2d67 2 API calls 47923->47926 47927 72e31f0 2 API calls 47923->47927 47924 7c9ceda 47924->47911 47925->47924 47926->47924 47927->47924 47928->47923 47929 7c9dd70 2 API calls 47928->47929 47929->47923 47932 7c9dda4 47930->47932 47946 7c9e400 47932->47946 47936 72e2da4 47934->47936 47935 72e2efc 47935->47917 47936->47935 47969 72e3a01 47936->47969 47940 72e2da4 47938->47940 47939 72e2efc 47939->47917 47940->47939 47941 72e3a01 2 API calls 47940->47941 47941->47939 47944 72e3205 47942->47944 47943 72e3685 47943->47917 47944->47943 47945 72e3a01 2 API calls 47944->47945 47945->47943 47947 7c9e41f 47946->47947 47948 7c9e10f 47947->47948 47950 7c9e9e5 47947->47950 47948->47916 47951 7c9e98d 47950->47951 47952 7c9ea02 47950->47952 47951->47948 47953 7c9ee4a 47952->47953 47956 72e0006 47952->47956 47960 72e0040 47952->47960 47953->47948 47957 72e001f 47956->47957 47958 72e0e4a 47957->47958 47964 6ed620 47957->47964 47961 72e004d 47960->47961 47962 72e0e4a 47961->47962 47963 6ed620 2 API calls 47961->47963 47963->47962 47965 6ed644 47964->47965 47966 6ed628 47964->47966 47965->47958 47966->47965 47967 72e2d78 2 API calls 47966->47967 47968 72e2d67 2 API calls 47966->47968 47967->47965 47968->47965 47970 72e3a39 47969->47970 47977 72e4b5a 47970->47977 47989 72e4b68 47970->47989 47971 72e3b4c 48001 72e54a8 47971->48001 48005 72e5497 47971->48005 47972 72e3b54 47972->47935 47978 72e4b65 47977->47978 47987 72e4b5a MoveFileExW 47978->47987 47988 72e4b68 MoveFileExW 47978->47988 47979 72e4bb1 47981 72e4c44 47979->47981 47983 72e4d5d 47979->47983 47980 72e4c62 47980->47971 47981->47980 48009 72e47e8 47981->48009 47984 72e4b5a MoveFileExW 47983->47984 47985 72e4e04 47983->47985 47986 72e4b68 MoveFileExW 47983->47986 47984->47985 47985->47971 47986->47985 47987->47979 47988->47979 47990 72e4b93 47989->47990 47997 72e4b5a MoveFileExW 47990->47997 47998 72e4b68 MoveFileExW 47990->47998 47991 72e4bb1 47992 72e4c44 47991->47992 47995 72e4d5d 47991->47995 47993 72e47e8 MoveFileExW 47992->47993 47994 72e4c62 47992->47994 47993->47994 47994->47971 47996 72e4e04 47995->47996 47999 72e4b5a MoveFileExW 47995->47999 48000 72e4b68 MoveFileExW 47995->48000 47996->47971 47997->47991 47998->47991 47999->47996 48000->47996 48002 72e54c1 48001->48002 48003 72e5576 48002->48003 48013 72e55aa 48002->48013 48003->47972 48006 72e54c1 48005->48006 48007 72e5576 48006->48007 48008 72e55aa PostMessageW 48006->48008 48007->47972 48008->48007 48011 72e5368 MoveFileExW 48009->48011 48012 72e5446 48011->48012 48012->47980 48015 72e55cd 48013->48015 48016 72e55e6 48015->48016 48017 72e485c 48015->48017 48016->48003 48018 72e5a48 PostMessageW 48017->48018 48020 72e5af5 48018->48020 48020->48015 48021 6e1335 48022 6e1341 48021->48022 48024 6ed620 2 API calls 48022->48024 48023 6e152f 48024->48023 48025 6e0cd0 48026 6e0cf2 48025->48026 48030 6e18d9 48026->48030 48035 6e1881 48026->48035 48027 6e0e7b 48031 6e1924 48030->48031 48040 6e1f38 48031->48040 48044 6e1f27 48031->48044 48032 6e1ac4 48032->48027 48036 6e1890 48035->48036 48038 6e1f38 InternetGetConnectedState 48036->48038 48039 6e1f27 InternetGetConnectedState 48036->48039 48037 6e1ac4 48037->48027 48038->48037 48039->48037 48041 6e1f5c 48040->48041 48048 6e24f8 48041->48048 48042 6e1f88 48042->48032 48045 6e1f2c 48044->48045 48047 6e24f8 InternetGetConnectedState 48045->48047 48046 6e1f88 48046->48032 48047->48046 48049 6e2502 48048->48049 48050 6e2554 48048->48050 48053 6e2648 48049->48053 48057 6e2658 48049->48057 48050->48042 48054 6e266f 48053->48054 48061 6e22f8 48054->48061 48058 6e266f 48057->48058 48059 6e22f8 InternetGetConnectedState 48058->48059 48060 6e268b 48059->48060 48060->48050 48062 6e26b0 InternetGetConnectedState 48061->48062 48064 6e268b 48062->48064 48064->48050

                                                                        Executed Functions

                                                                        Function 006E5580 Relevance: 7.4, Strings: 5, Instructions: 1159COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$$Vi$$Vi$$Vi
                                                                        • API String ID: 0-2749721217
                                                                        • Opcode ID: cfc27b8a76b537da362c25e952dd16f10d47abafb0237d1382e76768afa274fe
                                                                        • Instruction ID: 016051367fc2e6f81de22f7cdae65844c4eec510236b4484ae9acf27ab79d1b5
                                                                        • Opcode Fuzzy Hash: cfc27b8a76b537da362c25e952dd16f10d47abafb0237d1382e76768afa274fe
                                                                        • Instruction Fuzzy Hash: CFA27F70A016599FDB14CF6AC894AAEBBB3FF88344F258169E416EB361DB30DD41CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E987D Relevance: 6.6, Strings: 5, Instructions: 390COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 730 6e987d-6e98a7 732 6e98ad-6e98b1 730->732 733 6e9a67-6e9b63 730->733 732->733 734 6e98b7-6e98bc 732->734 750 6e9b6a-6e9cef call 6ea1c8 733->750 751 6e9b65 733->751 734->733 736 6e98c2-6e9a66 734->736 764 6e9cf5-6e9e99 call 6e4248 * 2 750->764 751->750 777 6e9e9b 764->777 778 6e9ea0-6e9eae 764->778 777->778 779 6e9eb5-6e9f04 call 6e4248 778->779 780 6e9eb0 778->780 783 6e9f0b-6e9f0f 779->783 784 6e9f06 779->784 780->779 785 6e9f14-6e9f4d 783->785 786 6e9f11-6e9f12 783->786 784->783 793 6e9f4f 785->793 794 6e9f54-6e9f8a 785->794 787 6e9f8b-6e9f92 786->787 789 6e9f99-6e9f9d 787->789 790 6e9f94 787->790 791 6e9f9f-6e9fa0 789->791 792 6e9fa2-6e9fdb 789->792 790->789 795 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 791->795 798 6e9fdd 792->798 799 6e9fe2-6ea018 792->799 793->794 794->787 814 6ea0ba-6ea0c3 795->814 815 6ea0c4 795->815 798->799 799->795 814->815 816 6ea0c5 815->816 816->816
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$>$dLq$Yq
                                                                        • API String ID: 0-3626083297
                                                                        • Opcode ID: 8651f0f6688477af1c04e776fcbbb81b5549e51bbf410bf77ad7aab71d8a9598
                                                                        • Instruction ID: 582080c04c56da0bcd2737e3134156cd34fc818e3aa399555651b84f1477b952
                                                                        • Opcode Fuzzy Hash: 8651f0f6688477af1c04e776fcbbb81b5549e51bbf410bf77ad7aab71d8a9598
                                                                        • Instruction Fuzzy Hash: 5902F774E003588FEB24DFA5C855B9DBBB2BF89300F1480AAD509AB3A5DB705E81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9619 Relevance: 6.6, Strings: 5, Instructions: 386COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 819 6e9619-6e9647 821 6e964d-6e9a66 819->821 822 6e9a67-6e9b63 819->822 837 6e9b6a-6e9cef call 6ea1c8 822->837 838 6e9b65 822->838 851 6e9cf5-6e9e99 call 6e4248 * 2 837->851 838->837 864 6e9e9b 851->864 865 6e9ea0-6e9eae 851->865 864->865 866 6e9eb5-6e9f04 call 6e4248 865->866 867 6e9eb0 865->867 870 6e9f0b-6e9f0f 866->870 871 6e9f06 866->871 867->866 872 6e9f14-6e9f4d 870->872 873 6e9f11-6e9f12 870->873 871->870 880 6e9f4f 872->880 881 6e9f54-6e9f8a 872->881 874 6e9f8b-6e9f92 873->874 876 6e9f99-6e9f9d 874->876 877 6e9f94 874->877 878 6e9f9f-6e9fa0 876->878 879 6e9fa2-6e9fdb 876->879 877->876 882 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 878->882 885 6e9fdd 879->885 886 6e9fe2-6ea018 879->886 880->881 881->874 901 6ea0ba-6ea0c3 882->901 902 6ea0c4 882->902 885->886 886->882 901->902 903 6ea0c5 902->903 903->903
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$>$dLq$Yq
                                                                        • API String ID: 0-3626083297
                                                                        • Opcode ID: 0772eca29353c61538ecbe7024416e4ff35c92acc5962edc2b4eddc9199bc6ce
                                                                        • Instruction ID: 28679b30e6f72fc5371659de99a60bdd8b01bf58112e821057c5fbfa00886730
                                                                        • Opcode Fuzzy Hash: 0772eca29353c61538ecbe7024416e4ff35c92acc5962edc2b4eddc9199bc6ce
                                                                        • Instruction Fuzzy Hash: F7020774E003588FEB24DFA5C845B9DBBB2BF89300F1480AAD509AB3A5DB705D82DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E97A6 Relevance: 6.6, Strings: 5, Instructions: 386COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 906 6e97a6-6e97d3 908 6e97d9-6e9a66 906->908 909 6e9a67-6e9b63 906->909 924 6e9b6a-6e9cef call 6ea1c8 909->924 925 6e9b65 909->925 938 6e9cf5-6e9e99 call 6e4248 * 2 924->938 925->924 951 6e9e9b 938->951 952 6e9ea0-6e9eae 938->952 951->952 953 6e9eb5-6e9f04 call 6e4248 952->953 954 6e9eb0 952->954 957 6e9f0b-6e9f0f 953->957 958 6e9f06 953->958 954->953 959 6e9f14-6e9f4d 957->959 960 6e9f11-6e9f12 957->960 958->957 967 6e9f4f 959->967 968 6e9f54-6e9f8a 959->968 961 6e9f8b-6e9f92 960->961 963 6e9f99-6e9f9d 961->963 964 6e9f94 961->964 965 6e9f9f-6e9fa0 963->965 966 6e9fa2-6e9fdb 963->966 964->963 969 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 965->969 972 6e9fdd 966->972 973 6e9fe2-6ea018 966->973 967->968 968->961 988 6ea0ba-6ea0c3 969->988 989 6ea0c4 969->989 972->973 973->969 988->989 990 6ea0c5 989->990 990->990
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$>$dLq$Yq
                                                                        • API String ID: 0-3626083297
                                                                        • Opcode ID: d7d85e1763b4cc96f91cef4f9ffb6f6bf29333b73f5bb0ee3d836d825bbf9953
                                                                        • Instruction ID: f94795e147e24412957a77bade75b7ee02b52f4f0e4acd9a3367b86423c9c347
                                                                        • Opcode Fuzzy Hash: d7d85e1763b4cc96f91cef4f9ffb6f6bf29333b73f5bb0ee3d836d825bbf9953
                                                                        • Instruction Fuzzy Hash: A002E774E003588FEB24DFA5C855B9DBBB2BF89300F1480AAD509AB3A5DB705D82DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C94D81 Relevance: 5.6, Instructions: 5642COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1096 7c94d81-7c94fc7 1125 7c94fcd-7c9586b 1096->1125 1126 7c9701c-7c97302 1096->1126 1386 7c95873-7c95d12 1125->1386 1201 7c97308-7c982b3 1126->1201 1202 7c982bb-7c99336 1126->1202 1201->1202 1792 7c9967d-7c99690 1202->1792 1793 7c9933c-7c99675 1202->1793 1535 7c95d18-7c95ff6 1386->1535 1536 7c95ffe-7c97014 1386->1536 1535->1536 1536->1126 1797 7c99d3d-7c9ac16 call 7c9c871 1792->1797 1798 7c99696-7c99d35 1792->1798 1793->1792 2180 7c9ac1c-7c9ac23 1797->2180 1798->1797
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 342e57bd8db3f657d26e16661ae06f6ce75ac286432f0b28fac5c706d4eb095b
                                                                        • Instruction ID: b45cd6560e67d1b57946f600dd09265fa81967446198e8c0fc0418acc7ad6fa9
                                                                        • Opcode Fuzzy Hash: 342e57bd8db3f657d26e16661ae06f6ce75ac286432f0b28fac5c706d4eb095b
                                                                        • Instruction Fuzzy Hash: 84C3D874A016188FCB58EF78DA9966DBBB2FB89300F0089E9D449A7354DF349E94CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C94D98 Relevance: 5.6, Instructions: 5633COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 2182 7c94d98-7c94fc7 2210 7c94fcd-7c9586b 2182->2210 2211 7c9701c-7c97302 2182->2211 2471 7c95873-7c95d12 2210->2471 2286 7c97308-7c982b3 2211->2286 2287 7c982bb-7c99336 2211->2287 2286->2287 2877 7c9967d-7c99690 2287->2877 2878 7c9933c-7c99675 2287->2878 2620 7c95d18-7c95ff6 2471->2620 2621 7c95ffe-7c97014 2471->2621 2620->2621 2621->2211 2882 7c99d3d-7c9ac16 call 7c9c871 2877->2882 2883 7c99696-7c99d35 2877->2883 2878->2877 3265 7c9ac1c-7c9ac23 2882->3265 2883->2882
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ffc7ef5284cf23665ad878183c17eab86608ae8de2bab4c2974f47fcd6f08d90
                                                                        • Instruction ID: 179a567714760b02eeaee8bf71823f472ba24c95738d43d75a1fed76fc746823
                                                                        • Opcode Fuzzy Hash: ffc7ef5284cf23665ad878183c17eab86608ae8de2bab4c2974f47fcd6f08d90
                                                                        • Instruction Fuzzy Hash: 9EC3D874A016188FCB58EF78DA9966DBBB2FB89300F0089E9D449A7354DF349E94CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9567 Relevance: 5.5, Strings: 4, Instructions: 451COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 3267 6e9567-6e9584 3269 6e958d-6e959d 3267->3269 3270 6e9586-6e9588 3267->3270 3273 6e9a6c-6e9b63 3269->3273 3274 6e95a3-6e95b1 3269->3274 3271 6e9a60-6e9a66 3270->3271 3289 6e9b6a-6e9cef call 6ea1c8 3273->3289 3290 6e9b65 3273->3290 3274->3273 3277 6e95b7 3274->3277 3277->3271 3303 6e9cf5-6e9e99 call 6e4248 * 2 3289->3303 3290->3289 3316 6e9e9b 3303->3316 3317 6e9ea0-6e9eae 3303->3317 3316->3317 3318 6e9eb5-6e9f04 call 6e4248 3317->3318 3319 6e9eb0 3317->3319 3322 6e9f0b-6e9f0f 3318->3322 3323 6e9f06 3318->3323 3319->3318 3324 6e9f14-6e9f4d 3322->3324 3325 6e9f11-6e9f12 3322->3325 3323->3322 3332 6e9f4f 3324->3332 3333 6e9f54-6e9f8a 3324->3333 3326 6e9f8b-6e9f92 3325->3326 3328 6e9f99-6e9f9d 3326->3328 3329 6e9f94 3326->3329 3330 6e9f9f-6e9fa0 3328->3330 3331 6e9fa2-6e9fdb 3328->3331 3329->3328 3334 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 3330->3334 3337 6e9fdd 3331->3337 3338 6e9fe2-6ea018 3331->3338 3332->3333 3333->3326 3353 6ea0ba-6ea0c3 3334->3353 3354 6ea0c4 3334->3354 3337->3338 3338->3334 3353->3354 3355 6ea0c5 3354->3355 3355->3355
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: cb164f91c04ecd191261cc323e3ce096789c71e6be470125c04b7ae880171bec
                                                                        • Instruction ID: b3e6573268c7c37bcba193849d049a9ba234847cd04b63b1e33066777f2a4872
                                                                        • Opcode Fuzzy Hash: cb164f91c04ecd191261cc323e3ce096789c71e6be470125c04b7ae880171bec
                                                                        • Instruction Fuzzy Hash: F112F774E002588FEB24DFA5C845B9DBBB2BF89300F1480AAD509AB3A5DB705E81DF55
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9963 Relevance: 5.4, Strings: 4, Instructions: 425COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 3358 6e9963-6e9967 3359 6e9969-6e9972 3358->3359 3360 6e9921-6e995d 3358->3360 3361 6e99a8-6e99ca 3359->3361 3362 6e9974-6e997a 3359->3362 3372 6e9a60-6e9a66 3360->3372 3369 6e9a67-6e9b63 3361->3369 3373 6e99d0 3361->3373 3363 6e997c-6e997e 3362->3363 3364 6e9988-6e999d 3362->3364 3363->3364 3364->3369 3370 6e99a3 3364->3370 3387 6e9b6a-6e9cef call 6ea1c8 3369->3387 3388 6e9b65 3369->3388 3370->3372 3373->3372 3401 6e9cf5-6e9e99 call 6e4248 * 2 3387->3401 3388->3387 3414 6e9e9b 3401->3414 3415 6e9ea0-6e9eae 3401->3415 3414->3415 3416 6e9eb5-6e9f04 call 6e4248 3415->3416 3417 6e9eb0 3415->3417 3420 6e9f0b-6e9f0f 3416->3420 3421 6e9f06 3416->3421 3417->3416 3422 6e9f14-6e9f4d 3420->3422 3423 6e9f11-6e9f12 3420->3423 3421->3420 3430 6e9f4f 3422->3430 3431 6e9f54-6e9f8a 3422->3431 3424 6e9f8b-6e9f92 3423->3424 3426 6e9f99-6e9f9d 3424->3426 3427 6e9f94 3424->3427 3428 6e9f9f-6e9fa0 3426->3428 3429 6e9fa2-6e9fdb 3426->3429 3427->3426 3432 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 3428->3432 3435 6e9fdd 3429->3435 3436 6e9fe2-6ea018 3429->3436 3430->3431 3431->3424 3451 6ea0ba-6ea0c3 3432->3451 3452 6ea0c4 3432->3452 3435->3436 3436->3432 3451->3452 3453 6ea0c5 3452->3453 3453->3453
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: cac110fc8e27300fd8e7a2dde90d528b5857b4100309ecb0cfac39a2333a1c3b
                                                                        • Instruction ID: e14dc23731369d15e6db4609308ddee6d6c24adccf8db9441e75d587a61969b6
                                                                        • Opcode Fuzzy Hash: cac110fc8e27300fd8e7a2dde90d528b5857b4100309ecb0cfac39a2333a1c3b
                                                                        • Instruction Fuzzy Hash: E9020774E003588FEB14DFAAC844B9DBBB2BF89300F1481AAD509AB3A5DB705D85DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E96AD Relevance: 5.4, Strings: 4, Instructions: 408COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 3456 6e96ad-6e96af 3457 6e9669-6e9671 3456->3457 3458 6e96b1-6e96ba 3456->3458 3461 6e962b-6e9647 3457->3461 3462 6e9673-6e967c 3457->3462 3459 6e96bc-6e96c2 3458->3459 3460 6e96e4-6e96f3 3458->3460 3463 6e96c4-6e96c6 3459->3463 3464 6e96d0-6e96d9 3459->3464 3469 6e9a67-6e9b63 3460->3469 3475 6e96f9 3460->3475 3461->3469 3473 6e964d 3461->3473 3465 6e967e-6e9684 3462->3465 3466 6e969b-6e96a5 3462->3466 3463->3464 3468 6e96df 3464->3468 3464->3469 3470 6e9686-6e9688 3465->3470 3471 6e9692-6e9696 3465->3471 3474 6e9a60-6e9a66 3466->3474 3468->3474 3490 6e9b6a-6e9cef call 6ea1c8 3469->3490 3491 6e9b65 3469->3491 3470->3471 3471->3474 3473->3474 3475->3474 3504 6e9cf5-6e9e99 call 6e4248 * 2 3490->3504 3491->3490 3517 6e9e9b 3504->3517 3518 6e9ea0-6e9eae 3504->3518 3517->3518 3519 6e9eb5-6e9f04 call 6e4248 3518->3519 3520 6e9eb0 3518->3520 3523 6e9f0b-6e9f0f 3519->3523 3524 6e9f06 3519->3524 3520->3519 3525 6e9f14-6e9f4d 3523->3525 3526 6e9f11-6e9f12 3523->3526 3524->3523 3533 6e9f4f 3525->3533 3534 6e9f54-6e9f8a 3525->3534 3527 6e9f8b-6e9f92 3526->3527 3529 6e9f99-6e9f9d 3527->3529 3530 6e9f94 3527->3530 3531 6e9f9f-6e9fa0 3529->3531 3532 6e9fa2-6e9fdb 3529->3532 3530->3529 3535 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 3531->3535 3538 6e9fdd 3532->3538 3539 6e9fe2-6ea018 3532->3539 3533->3534 3534->3527 3554 6ea0ba-6ea0c3 3535->3554 3555 6ea0c4 3535->3555 3538->3539 3539->3535 3554->3555 3556 6ea0c5 3555->3556 3556->3556
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: dc50151087199ef9d5e2269388bdd898678d25a5f05d82f1b8e991add2b8b883
                                                                        • Instruction ID: 020bfd45e6522a1fdaa1fd378f4275c7103b799ef10124deee3404380f7bdb7a
                                                                        • Opcode Fuzzy Hash: dc50151087199ef9d5e2269388bdd898678d25a5f05d82f1b8e991add2b8b883
                                                                        • Instruction Fuzzy Hash: 70021974E013588FEB24DFA6C854B9DBBB2BF89300F1480AAD509AB3A5DB705D81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E97FE Relevance: 5.4, Strings: 4, Instructions: 404COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 3559 6e97fe-6e9808 3560 6e980a-6e9810 3559->3560 3561 6e984b-6e9857 3559->3561 3562 6e981e-6e9823 3560->3562 3563 6e9812-6e9814 3560->3563 3570 6e9859-6e985b 3561->3570 3571 6e9863-6e9866 3561->3571 3564 6e9825-6e9829 3562->3564 3565 6e9831-6e9835 3562->3565 3563->3562 3567 6e982f 3564->3567 3568 6e9a67-6e9b63 3564->3568 3565->3568 3569 6e983b-6e9840 3565->3569 3567->3569 3590 6e9b6a-6e9cef call 6ea1c8 3568->3590 3591 6e9b65 3568->3591 3569->3568 3573 6e9846 3569->3573 3570->3568 3575 6e9861 3570->3575 3571->3568 3572 6e986c-6e9871 3571->3572 3572->3568 3576 6e9877 3572->3576 3577 6e9a60-6e9a66 3573->3577 3575->3572 3576->3577 3604 6e9cf5-6e9e99 call 6e4248 * 2 3590->3604 3591->3590 3617 6e9e9b 3604->3617 3618 6e9ea0-6e9eae 3604->3618 3617->3618 3619 6e9eb5-6e9f04 call 6e4248 3618->3619 3620 6e9eb0 3618->3620 3623 6e9f0b-6e9f0f 3619->3623 3624 6e9f06 3619->3624 3620->3619 3625 6e9f14-6e9f4d 3623->3625 3626 6e9f11-6e9f12 3623->3626 3624->3623 3633 6e9f4f 3625->3633 3634 6e9f54-6e9f8a 3625->3634 3627 6e9f8b-6e9f92 3626->3627 3629 6e9f99-6e9f9d 3627->3629 3630 6e9f94 3627->3630 3631 6e9f9f-6e9fa0 3629->3631 3632 6e9fa2-6e9fdb 3629->3632 3630->3629 3635 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 3631->3635 3638 6e9fdd 3632->3638 3639 6e9fe2-6ea018 3632->3639 3633->3634 3634->3627 3654 6ea0ba-6ea0c3 3635->3654 3655 6ea0c4 3635->3655 3638->3639 3639->3635 3654->3655 3656 6ea0c5 3655->3656 3656->3656
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: 5376ea89ffffa84a2013b71c976e909b8ab5b9b4c5f51388a1df96a10bf8fbd7
                                                                        • Instruction ID: 637740a889df1de70bd202a5593f74d7ce79e692e2c04e6a10775f3e65dfd942
                                                                        • Opcode Fuzzy Hash: 5376ea89ffffa84a2013b71c976e909b8ab5b9b4c5f51388a1df96a10bf8fbd7
                                                                        • Instruction Fuzzy Hash: F102FA74E013588FEB24DFA6C844B9DBBB2BF89300F1481AAD509AB3A5DB705D81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E99DB Relevance: 5.4, Strings: 4, Instructions: 398COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 3659 6e99db-6e99e5 3660 6e99e7-6e99ed 3659->3660 3661 6e9a14-6e9a30 3659->3661 3662 6e99ef-6e99f1 3660->3662 3663 6e99fb-6e9a10 3660->3663 3667 6e9a67-6e9b63 3661->3667 3670 6e9a32 3661->3670 3662->3663 3663->3667 3668 6e9a12 3663->3668 3684 6e9b6a-6e9cef call 6ea1c8 3667->3684 3685 6e9b65 3667->3685 3669 6e9a60-6e9a66 3668->3669 3670->3669 3698 6e9cf5-6e9e99 call 6e4248 * 2 3684->3698 3685->3684 3711 6e9e9b 3698->3711 3712 6e9ea0-6e9eae 3698->3712 3711->3712 3713 6e9eb5-6e9f04 call 6e4248 3712->3713 3714 6e9eb0 3712->3714 3717 6e9f0b-6e9f0f 3713->3717 3718 6e9f06 3713->3718 3714->3713 3719 6e9f14-6e9f4d 3717->3719 3720 6e9f11-6e9f12 3717->3720 3718->3717 3727 6e9f4f 3719->3727 3728 6e9f54-6e9f8a 3719->3728 3721 6e9f8b-6e9f92 3720->3721 3723 6e9f99-6e9f9d 3721->3723 3724 6e9f94 3721->3724 3725 6e9f9f-6e9fa0 3723->3725 3726 6e9fa2-6e9fdb 3723->3726 3724->3723 3729 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 3725->3729 3732 6e9fdd 3726->3732 3733 6e9fe2-6ea018 3726->3733 3727->3728 3728->3721 3748 6ea0ba-6ea0c3 3729->3748 3749 6ea0c4 3729->3749 3732->3733 3733->3729 3748->3749 3750 6ea0c5 3749->3750 3750->3750
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: f9d6dad9ae759ebeba00a66cf859ddd8b8059a3a804d8d4d1867a3e79d3010f4
                                                                        • Instruction ID: f397271b04ca754a7035424789e1ff9303c03e323b59163c9396dcd267fe3b6e
                                                                        • Opcode Fuzzy Hash: f9d6dad9ae759ebeba00a66cf859ddd8b8059a3a804d8d4d1867a3e79d3010f4
                                                                        • Instruction Fuzzy Hash: 2A020974E003588FEB14DFA9C845B9DBBB2BF89300F1480AAD509AB3A5DB705D85DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9758 Relevance: 5.4, Strings: 4, Instructions: 390COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: d612e7ef6dc4fa0fd9b15ed45c5a3c4542c00a7f4c149d410c3cdb5777243b63
                                                                        • Instruction ID: 2992df12f4554ff51b11c0fe739e9f5e72bea62b5222a55957f83597f352533d
                                                                        • Opcode Fuzzy Hash: d612e7ef6dc4fa0fd9b15ed45c5a3c4542c00a7f4c149d410c3cdb5777243b63
                                                                        • Instruction Fuzzy Hash: 8202E874E003588FEB24DFA5C845B9DBBB2BF89300F1481AAD509AB3A5DB705D81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9704 Relevance: 5.4, Strings: 4, Instructions: 390COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 3753 6e9704-6e970e 3754 6e9738-6e9747 3753->3754 3755 6e9710-6e9716 3753->3755 3758 6e9a67-6e9b63 3754->3758 3762 6e974d 3754->3762 3756 6e9718-6e971a 3755->3756 3757 6e9724-6e972d 3755->3757 3756->3757 3757->3758 3759 6e9733 3757->3759 3776 6e9b6a-6e9cef call 6ea1c8 3758->3776 3777 6e9b65 3758->3777 3761 6e9a60-6e9a66 3759->3761 3762->3761 3790 6e9cf5-6e9e99 call 6e4248 * 2 3776->3790 3777->3776 3803 6e9e9b 3790->3803 3804 6e9ea0-6e9eae 3790->3804 3803->3804 3805 6e9eb5-6e9f04 call 6e4248 3804->3805 3806 6e9eb0 3804->3806 3809 6e9f0b-6e9f0f 3805->3809 3810 6e9f06 3805->3810 3806->3805 3811 6e9f14-6e9f4d 3809->3811 3812 6e9f11-6e9f12 3809->3812 3810->3809 3819 6e9f4f 3811->3819 3820 6e9f54-6e9f8a 3811->3820 3813 6e9f8b-6e9f92 3812->3813 3815 6e9f99-6e9f9d 3813->3815 3816 6e9f94 3813->3816 3817 6e9f9f-6e9fa0 3815->3817 3818 6e9fa2-6e9fdb 3815->3818 3816->3815 3821 6ea019-6ea0b8 call 6e8a30 call 6e8a40 call 6e8a50 3817->3821 3824 6e9fdd 3818->3824 3825 6e9fe2-6ea018 3818->3825 3819->3820 3820->3813 3840 6ea0ba-6ea0c3 3821->3840 3841 6ea0c4 3821->3841 3824->3825 3825->3821 3840->3841 3842 6ea0c5 3841->3842 3842->3842
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: 6885878b7f2941e0e48982bbe9a07ff63c5fc48b1af9dafd37bb739e536d5400
                                                                        • Instruction ID: fb9bd4054c49ccf319f6222d52a3f919d0e090c17b0c114c95b5f86aa8f63a91
                                                                        • Opcode Fuzzy Hash: 6885878b7f2941e0e48982bbe9a07ff63c5fc48b1af9dafd37bb739e536d5400
                                                                        • Instruction Fuzzy Hash: 8F02F874E003588FEB24DFA6C844B9DBBB2BF89300F1480AAD509AB3A5DB705D81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E98C7 Relevance: 5.4, Strings: 4, Instructions: 381COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: 5bf21584d83efddb8489e77e60efbe3d4d62e82385d4c55cc3d9038bb407026b
                                                                        • Instruction ID: 26f537ed1edb781e218b351c1115db76497a93819eef5e0f609a865c4a5c02cd
                                                                        • Opcode Fuzzy Hash: 5bf21584d83efddb8489e77e60efbe3d4d62e82385d4c55cc3d9038bb407026b
                                                                        • Instruction Fuzzy Hash: B5F1E674E003588FEB14DFA6C855B9DBBB2BF89300F1480AAD509AB3A5DB705E81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9652 Relevance: 5.4, Strings: 4, Instructions: 377COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: ba6438f978c151d5e7552a69d07d8bdbe8b63521be01f5a5fb9d27f5afbc9217
                                                                        • Instruction ID: 5584359295ba0b15ba5220a6d4ca424d1e7c4d7e12bfa16df43d2ff40fa70348
                                                                        • Opcode Fuzzy Hash: ba6438f978c151d5e7552a69d07d8bdbe8b63521be01f5a5fb9d27f5afbc9217
                                                                        • Instruction Fuzzy Hash: C2F1E674E002588FEB24DFA5C855B9DBBB2BF89300F1480AAD509AB3A5DB705E81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E97DE Relevance: 5.4, Strings: 4, Instructions: 377COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$dLq$Yq
                                                                        • API String ID: 0-1062966345
                                                                        • Opcode ID: 344018827b9fe80ae89bc8e84aabb695b9ea9333abc0beddaad47f5ed3db3c98
                                                                        • Instruction ID: a730a60868189242943cad5e5989ad9db5a00c80227935649cd1cd904aeb4c9a
                                                                        • Opcode Fuzzy Hash: 344018827b9fe80ae89bc8e84aabb695b9ea9333abc0beddaad47f5ed3db3c98
                                                                        • Instruction Fuzzy Hash: A8F1E674E002588FEB14DFA5C855B9DBBB2BF89300F14C0AAD509AB3A5DB705E81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EE59B8 Relevance: 5.2, Instructions: 5170COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 88276e5a087acc97d279991b7e10bbd899a576670eb66b7310f5122ee4e3ed85
                                                                        • Instruction ID: 559779196622028b8dac5f08cab14f05640e92fd67b8db660aab396ea7e989c2
                                                                        • Opcode Fuzzy Hash: 88276e5a087acc97d279991b7e10bbd899a576670eb66b7310f5122ee4e3ed85
                                                                        • Instruction Fuzzy Hash: DDB3E874A112288FCB18EF79DA9965DBBF2FB88300F0489E9E489A7254DF345D94CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 072E22C8 Relevance: 4.2, Strings: 3, Instructions: 480COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1370695668.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_72e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$]
                                                                        • API String ID: 0-1365087916
                                                                        • Opcode ID: f7892727dec0d36836362f39b4350c2d2f419c0c598bab246280f0c7661984b0
                                                                        • Instruction ID: 0ae6db22841cbe2e6e50ce42a0e9893a619227a8aa02baa033fba072cb1826c0
                                                                        • Opcode Fuzzy Hash: f7892727dec0d36836362f39b4350c2d2f419c0c598bab246280f0c7661984b0
                                                                        • Instruction Fuzzy Hash: CB027070B1061ACFEB14DF24C854B6A77AABF89710F558069E90AAB361CB70DD81CF91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9A37 Relevance: 4.1, Strings: 3, Instructions: 359COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$dLq$Yq
                                                                        • API String ID: 0-152223484
                                                                        • Opcode ID: 403f071144b51fd3e738200ddcf7643b4751c563b2ab772bf906e5536218e3f0
                                                                        • Instruction ID: 5302e9fd68d7b7d569cf858b1e0f893da47fa206c944b2de66938e7ce73f415a
                                                                        • Opcode Fuzzy Hash: 403f071144b51fd3e738200ddcf7643b4751c563b2ab772bf906e5536218e3f0
                                                                        • Instruction Fuzzy Hash: 5CF1E574E002588FEB24DFA5C845B9DBBB2BF89300F14C0AAE509AB365DB705E85DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E9AE8 Relevance: 2.8, Strings: 2, Instructions: 330COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: dLq$Yq
                                                                        • API String ID: 0-2150267734
                                                                        • Opcode ID: 45c4ab2e1f6091f5ff527e94cde2dc117629dd6bafca383328dec08ff8288cf6
                                                                        • Instruction ID: 1869af084e3d00bdb01ff90a54868b254f0bc9a855f5731de5c546161d021bdd
                                                                        • Opcode Fuzzy Hash: 45c4ab2e1f6091f5ff527e94cde2dc117629dd6bafca383328dec08ff8288cf6
                                                                        • Instruction Fuzzy Hash: 55E1E574E002588FEB24DFA6C945B9DBBB2BF89300F14C0AAD509AB365DB705E81DF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 072E0006 Relevance: 1.0, Instructions: 970COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1370695668.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_72e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6fa21c66759512c522c2cb167416da2b598a3b5d08372773d4c361ccd72a97e0
                                                                        • Instruction ID: b5ec033f58ab45bf65f94addd3292266f5f16c92ae7438254f7ffe3f326f2e9e
                                                                        • Opcode Fuzzy Hash: 6fa21c66759512c522c2cb167416da2b598a3b5d08372773d4c361ccd72a97e0
                                                                        • Instruction Fuzzy Hash: 5772B170A402188FCB18FF7CEA9972EBBB6BB88300F4085B9D489A7354EE345D54CB55
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EE1228 Relevance: .8, Instructions: 814COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4a5efcf75d6d443fe0589f753ea56429c29758b965bb3e8e1d8e9134737b58cb
                                                                        • Instruction ID: e3560324131020e323f0888affc639aec4e3ba58c572d6412312b0f1aaf3957c
                                                                        • Opcode Fuzzy Hash: 4a5efcf75d6d443fe0589f753ea56429c29758b965bb3e8e1d8e9134737b58cb
                                                                        • Instruction Fuzzy Hash: 5A529E317002148FEB18AB78C859B6E7BE7BF88710F158568E45ADB7A1CE34DC42CB95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EC57D8 Relevance: .6, Instructions: 596COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1368908631.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ec0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 81af2aabda62b68f4d79e8ba6751d08aa32563aa0c8df083cf5a9f8f64062536
                                                                        • Instruction ID: c9cae4b3b758c5d63bdd0d09970e6a059eab056b59e6f5bc4f508421f731d140
                                                                        • Opcode Fuzzy Hash: 81af2aabda62b68f4d79e8ba6751d08aa32563aa0c8df083cf5a9f8f64062536
                                                                        • Instruction Fuzzy Hash: E8525D34A003498FDB14DF68C944B99B7F2BF85314F2582E9D5586F3A2DBB1A982CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C92334 Relevance: .2, Instructions: 186COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3f69cee5933d7003cf77106b758947d64373a1d261b821f73c8ee0653abd7622
                                                                        • Instruction ID: c44b8f3396363c987c679c738a4b5603703270e7ead70537fd7aedb5c645bdef
                                                                        • Opcode Fuzzy Hash: 3f69cee5933d7003cf77106b758947d64373a1d261b821f73c8ee0653abd7622
                                                                        • Instruction Fuzzy Hash: 627143B4E043089FEF18DFA9C488A9EBFF1BB49300F20946AD445AB351DB309945CF59
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E1F38 Relevance: .1, Instructions: 140COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9f0f66bcfca5f5f0edafb89226231e8e751ae69a3ffb2402f28649f9f9c5aad5
                                                                        • Instruction ID: 34c118c8c0847714354faefb8733621286b92ebbe46a7840d435988d5bab147f
                                                                        • Opcode Fuzzy Hash: 9f0f66bcfca5f5f0edafb89226231e8e751ae69a3ffb2402f28649f9f9c5aad5
                                                                        • Instruction Fuzzy Hash: C451BF74E012099FDB04DFAAD994AEDBBF6BF88310F24802AE419BB364DB345941CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C923A1 Relevance: .1, Instructions: 132COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 127a81a28b1a76b579fc64e08ba4199dfb364be9543669f04b128c6f5fc41de2
                                                                        • Instruction ID: 5535ecc94e5e7a1b3c521907537e7c68d51ab5209c9dda2eb726142395b5b464
                                                                        • Opcode Fuzzy Hash: 127a81a28b1a76b579fc64e08ba4199dfb364be9543669f04b128c6f5fc41de2
                                                                        • Instruction Fuzzy Hash: B051DEB4D00308DFEB14CFA9C588A9DBBF1BB09300F20952AE459BB2A1D731A946CF55
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C92408 Relevance: .1, Instructions: 102COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5335ea993b86adbc734c74dca9669ceac94d45177740b74999fd2a272a6cc5b2
                                                                        • Instruction ID: 9ecd0cc69f6c97314433729c0afc83a5e45d5c09403e88e485405f68f50fc9de
                                                                        • Opcode Fuzzy Hash: 5335ea993b86adbc734c74dca9669ceac94d45177740b74999fd2a272a6cc5b2
                                                                        • Instruction Fuzzy Hash: 88417AB4D01348EFDB14CFAAC588ADEBBF5BB09300F20942AE819BB251D775A945CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EE4564 Relevance: .1, Instructions: 97COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6f0d20f491f9bee5e02f44d60386fc38c10d388592bace275b1d9e6b16f3fc46
                                                                        • Instruction ID: 3714657c88263f7bbc5e2eb0002d1c8f27173159cc7fcb985ffe277e255cbe0b
                                                                        • Opcode Fuzzy Hash: 6f0d20f491f9bee5e02f44d60386fc38c10d388592bace275b1d9e6b16f3fc46
                                                                        • Instruction Fuzzy Hash: 8841ACB4D113089FEB10CFA9C585B9EFBF1BB09300F20A42AE419BB250D775A945CF58
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EEF66D Relevance: .1, Instructions: 95COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1ab0e0ee58ddd612260b2e0f8e426502520ff0b7664775a810d230c58984fc69
                                                                        • Instruction ID: c3f607161b07e315ebf4530505fef6df040a1b4e9c8945b1a9d9db93342e7d8e
                                                                        • Opcode Fuzzy Hash: 1ab0e0ee58ddd612260b2e0f8e426502520ff0b7664775a810d230c58984fc69
                                                                        • Instruction Fuzzy Hash: CD41A8B5D113089FEB10CFA9C585B9EFBF1BB09300F20A42AE429BB250D775A945CF58
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 072E5168 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 273COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1370695668.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_72e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: $Vi$$Vi$$Vi$$Vi
                                                                        • API String ID: 0-719171371
                                                                        • Opcode ID: 373d24ff9adec1745e7baf8e2b3d2eaca1e723404aa14d4fea536d9d1cf8d701
                                                                        • Instruction ID: 0da448093db1d45bd7e7d58009ce38db99abbb7b945ed51793e35b51d85dafa7
                                                                        • Opcode Fuzzy Hash: 373d24ff9adec1745e7baf8e2b3d2eaca1e723404aa14d4fea536d9d1cf8d701
                                                                        • Instruction Fuzzy Hash: 15A1CC70E142099FDB04DFA9D848BAEBFF6FF85304F14806AD405AB3A1DB348946CB55
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 072E47E8 Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • MoveFileExW.KERNEL32(?,?,?), ref: 072E5434
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1370695668.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_72e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID: FileMove
                                                                        • String ID:
                                                                        • API String ID: 3562171763-0
                                                                        • Opcode ID: 288efee008ba129fc777c0ab9c9dc2f1e9536cbe6e4e4324182e5ae59e96d4b6
                                                                        • Instruction ID: 489a5fabb81cb8dc86e84ad2bfafd8b13f29b17e8a4bbd30cc49a952b7cbba34
                                                                        • Opcode Fuzzy Hash: 288efee008ba129fc777c0ab9c9dc2f1e9536cbe6e4e4324182e5ae59e96d4b6
                                                                        • Instruction Fuzzy Hash: 8141BCB4D11259DFCB10CFAAD884AEDFBF5BB49314F14806AE818B7220D374A946CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 072E5A40 Relevance: 1.6, APIs: 1, Instructions: 90windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • PostMessageW.USER32(?,?,?,00000000), ref: 072E5AE3
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1370695668.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_72e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID: MessagePost
                                                                        • String ID:
                                                                        • API String ID: 410705778-0
                                                                        • Opcode ID: d0ed43ca8ac9080767c779f0ef3a529352da84598ba6463fe60271a0d68804a0
                                                                        • Instruction ID: db860fc14a36b7cdfe0cbf15f71b4459a9386f5c0a46962eb43015c20013396c
                                                                        • Opcode Fuzzy Hash: d0ed43ca8ac9080767c779f0ef3a529352da84598ba6463fe60271a0d68804a0
                                                                        • Instruction Fuzzy Hash: 3A31ACB9D10248AFCB10CF9AD984ADEFBF4BB09310F14901AE814B7310D375A945CF64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 072E485C Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • PostMessageW.USER32(?,?,?,00000000), ref: 072E5AE3
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1370695668.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_72e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID: MessagePost
                                                                        • String ID:
                                                                        • API String ID: 410705778-0
                                                                        • Opcode ID: 5588d21c18a102e5526b09ea02d63ddc059f29f48b25449774a269570ea5223c
                                                                        • Instruction ID: a7b2f2a3956df40bda13e57ac38457601fa8f267ff56a9489cd712c3474b53ec
                                                                        • Opcode Fuzzy Hash: 5588d21c18a102e5526b09ea02d63ddc059f29f48b25449774a269570ea5223c
                                                                        • Instruction Fuzzy Hash: 033188B9D14258AFCF10CF9AD984A9EFBF4EB09310F14902AE818B7310D375A945CF64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E22F8 Relevance: 1.6, APIs: 1, Instructions: 83networkCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • InternetGetConnectedState.WININET(?,?), ref: 006E2741
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID: ConnectedInternetState
                                                                        • String ID:
                                                                        • API String ID: 97057780-0
                                                                        • Opcode ID: 10ce910dc154bca7adb1abb8cf7fe72c21cf8a1c28b53855857c06f1c8e375e0
                                                                        • Instruction ID: bf2e5634c8cb84cddbc03d1a288a2acfcf1478618ce1fae51d7645c4859555e5
                                                                        • Opcode Fuzzy Hash: 10ce910dc154bca7adb1abb8cf7fe72c21cf8a1c28b53855857c06f1c8e375e0
                                                                        • Instruction Fuzzy Hash: 073198B9D052599FCF10CFAAD884A9EFBF5BB09310F14902AE818B7310D375A945CBA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EED2B8 Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID: DeleteFile
                                                                        • String ID:
                                                                        • API String ID: 4033686569-0
                                                                        • Opcode ID: efe1e8f083468bd586eef0ef45645b0911687f405c372a0acd03f8f861545ed4
                                                                        • Instruction ID: 70ca13c9f2dbe6052f70728da2ac563a0e72c3e8eb1960a08026aa32049e0fc9
                                                                        • Opcode Fuzzy Hash: efe1e8f083468bd586eef0ef45645b0911687f405c372a0acd03f8f861545ed4
                                                                        • Instruction Fuzzy Hash: 2831B8B4D01218DFDB10CFAAD984AEEFBF5BB49310F14906AE858B7310D374AA45CB64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 006E26A8 Relevance: 1.6, APIs: 1, Instructions: 82networkCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • InternetGetConnectedState.WININET(?,?), ref: 006E2741
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID: ConnectedInternetState
                                                                        • String ID:
                                                                        • API String ID: 97057780-0
                                                                        • Opcode ID: 44577a14dc71e8e5d4988fc07ea7a223a14fed3a99d7882d5ba9e9d8c497a8dc
                                                                        • Instruction ID: dfb04e31e9e99366b8023bbf20c27c4434e694bef90e5ccf7ddea063b97dee0c
                                                                        • Opcode Fuzzy Hash: 44577a14dc71e8e5d4988fc07ea7a223a14fed3a99d7882d5ba9e9d8c497a8dc
                                                                        • Instruction Fuzzy Hash: 8A319AB9D05259DFCB10CFAAD884ADEFBF5BB09310F24902AE818B7350D375A945CB54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C94A23 Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: D
                                                                        • API String ID: 0-2746444292
                                                                        • Opcode ID: 35f217c617fb5363d6d4c3d2ab8abfd8ebcaffb3b7b1948951ca6fa2f2bf29f0
                                                                        • Instruction ID: 7d2378214da53b097c8b02498281a066538391d18c905b2921ac831ed79fec02
                                                                        • Opcode Fuzzy Hash: 35f217c617fb5363d6d4c3d2ab8abfd8ebcaffb3b7b1948951ca6fa2f2bf29f0
                                                                        • Instruction Fuzzy Hash: 7541579140E3C25FDB1387749CA42967FB09F03124B1A05EBC0D1DB6F3EA180A0AC767
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C93B3A Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: TJq
                                                                        • API String ID: 0-48878262
                                                                        • Opcode ID: 1481d3e4c2417fc90d93e2afc3b1ada5975d7633adb9d05b6f5478e845d6f7c5
                                                                        • Instruction ID: 2a94bd453161791e2551c4e8a733354b9f955c5c3891b4c12f8f2a146910c4dc
                                                                        • Opcode Fuzzy Hash: 1481d3e4c2417fc90d93e2afc3b1ada5975d7633adb9d05b6f5478e845d6f7c5
                                                                        • Instruction Fuzzy Hash: C731AE717445149FC704BBBDE999A2E7BEAFBC8310F004969E44AD7350DF389C058796
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C93B48 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: TJq
                                                                        • API String ID: 0-48878262
                                                                        • Opcode ID: 991d39facf115ba0a07924a349495932d1f46c0945f2505355652d86a29fc893
                                                                        • Instruction ID: 14c301c7be1668b9c152f617e8715b5ea3f7048a855c0c19ec03f0278b255365
                                                                        • Opcode Fuzzy Hash: 991d39facf115ba0a07924a349495932d1f46c0945f2505355652d86a29fc893
                                                                        • Instruction Fuzzy Hash: D0218D707045149FC708BBBDE699A2E7BEAFFC8710B004969E44AD7350DF349C198796
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9CEEF Relevance: .5, Instructions: 527COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 139203b13bb72622f4b1512c55eca5eaeb61b68f581bcadfdebc1241e5b4b4de
                                                                        • Instruction ID: 8c0d5489c658efde69181a1e640b813773740639eeff25805dbaf93f3e90c485
                                                                        • Opcode Fuzzy Hash: 139203b13bb72622f4b1512c55eca5eaeb61b68f581bcadfdebc1241e5b4b4de
                                                                        • Instruction Fuzzy Hash: 4112AD70B056848FC705EFBCD6A965D7FB1BF89300F4448AAD48AEB391DA38AC09C755
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9E9E5 Relevance: .5, Instructions: 461COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6cb30df77c5019dbda9624d779d2148f18a15f8520e9226946eeccc4716b8793
                                                                        • Instruction ID: b26a905d65603d77b1776c9f8d3aec924b369d401a37540d23c484066f69e4a7
                                                                        • Opcode Fuzzy Hash: 6cb30df77c5019dbda9624d779d2148f18a15f8520e9226946eeccc4716b8793
                                                                        • Instruction Fuzzy Hash: 9AF1D7716092808FC305EB7CDA5961E7FE6BF85310F4949AED4C9E7291EE389C08C366
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9CFC1 Relevance: .5, Instructions: 453COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fe96193ea03d5f36dd0e1ec3f2b9dda8721cdf52f7eb88aaaedbd41537548906
                                                                        • Instruction ID: e70698a0ce31a325a927f277626d9448398f6f1be5076c1bcd1d8589ff38a9e5
                                                                        • Opcode Fuzzy Hash: fe96193ea03d5f36dd0e1ec3f2b9dda8721cdf52f7eb88aaaedbd41537548906
                                                                        • Instruction Fuzzy Hash: AFF16870B116148FCB48FFBCE69A65D7BF6BB88300F404968D48AE7354DA38AC05CB95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9E400 Relevance: .4, Instructions: 438COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1ee5d44d92fa85caa00aada74f06888e3350b8ca45359ed1fd5e333cd46f7865
                                                                        • Instruction ID: c33a39e7872d1588e501d53392792b8b451df9b77d16977f27593466241510a5
                                                                        • Opcode Fuzzy Hash: 1ee5d44d92fa85caa00aada74f06888e3350b8ca45359ed1fd5e333cd46f7865
                                                                        • Instruction Fuzzy Hash: D8E18B71A101148FC748FFBCE69A66D7FB6FB88310F854928D489E7354DE389844C7A9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C927F8 Relevance: .4, Instructions: 416COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6b810e46001f76b7819fba855b2a47ca9a2b2578c3d6dec8eaf7de7b2105adff
                                                                        • Instruction ID: 9f350427bf379133c758178b5242fbf3df3ca07a9a9f439ff127ab12170a515b
                                                                        • Opcode Fuzzy Hash: 6b810e46001f76b7819fba855b2a47ca9a2b2578c3d6dec8eaf7de7b2105adff
                                                                        • Instruction Fuzzy Hash: D0D19071B002149FDB48BBBCDA9966E7BA6BFC8300F404929D485E7394DF389C15C7A9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9CA00 Relevance: .4, Instructions: 366COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2064983d5a4febade29f1d7b8bce4a65b2c178b90a5d167a3fe3c3104f3f5255
                                                                        • Instruction ID: 3746a58d2b08c8e06b26148809f04f6a8a7330382ceab19fa5966226f9e5a13a
                                                                        • Opcode Fuzzy Hash: 2064983d5a4febade29f1d7b8bce4a65b2c178b90a5d167a3fe3c3104f3f5255
                                                                        • Instruction Fuzzy Hash: 3BC18B71A102148FC748BFBCE69E22DBFF2FB88310F454869D885A7394DE389859C795
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C93E6C Relevance: .3, Instructions: 311COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 95bd05bca6eab2a37c8d0e01d4acd1377d84c8d469af32c46bbc477d5f7423cf
                                                                        • Instruction ID: 69dfe7360241db491a5bcc5ffd0371c08569f08024208aed30405139f4414fc7
                                                                        • Opcode Fuzzy Hash: 95bd05bca6eab2a37c8d0e01d4acd1377d84c8d469af32c46bbc477d5f7423cf
                                                                        • Instruction Fuzzy Hash: 1CC15670610254CFCB98EF39D5988697BF2BF8971076484ADE44ADB761CB39ED01CB81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9DD70 Relevance: .3, Instructions: 273COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4997fb35d2887ca0eb3adb445d59d3ff93bb42e17a32ff60b421c6fd9c31cba4
                                                                        • Instruction ID: da91847771284eacc9052b2e023e1de8e01ff9fab1dd35ac9e4be97c4e208244
                                                                        • Opcode Fuzzy Hash: 4997fb35d2887ca0eb3adb445d59d3ff93bb42e17a32ff60b421c6fd9c31cba4
                                                                        • Instruction Fuzzy Hash: 04916871A10114CFCB08FBBCEA9A66D7BF6FB88300F414969D485A7354DE389819C7A9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9C9F0 Relevance: .3, Instructions: 271COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4be2f79bb532bad1070869f01be682f71aa883c0ce76ee0286a895acb9d6564f
                                                                        • Instruction ID: 11df3b444efc01715905bc82473b83b00e237b23103957d29b89242d44f778ae
                                                                        • Opcode Fuzzy Hash: 4be2f79bb532bad1070869f01be682f71aa883c0ce76ee0286a895acb9d6564f
                                                                        • Instruction Fuzzy Hash: 5D916B71A10614CFCB04BBBCE69922DBBF2FB88310F444979D885A7394DE389859C7A5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9D9EE Relevance: .2, Instructions: 174COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a974b28a7323d73d34474fb65101d8ed3f4b3fc89069b2691e611acc830c20b2
                                                                        • Instruction ID: e1cb3166a4826d4bd24305f39acd48dfe9ba9f9f17722122a8b19900edeb394e
                                                                        • Opcode Fuzzy Hash: a974b28a7323d73d34474fb65101d8ed3f4b3fc89069b2691e611acc830c20b2
                                                                        • Instruction Fuzzy Hash: C96100B0E042589FDF20CFA9C885B9DBBB1BF0A304F14916AE859F7251D774A986CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9DA18 Relevance: .2, Instructions: 161COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6bb629c00d5d218ca619c1dc6e04ca645ccb79369e2d86730b5c58593d5cf51c
                                                                        • Instruction ID: 13b0a7835aac65d86ea758faca800ce9f7913b791520332f3a4a31e38090b995
                                                                        • Opcode Fuzzy Hash: 6bb629c00d5d218ca619c1dc6e04ca645ccb79369e2d86730b5c58593d5cf51c
                                                                        • Instruction Fuzzy Hash: 8351CCB4E00258DFDF64CFA9D985B9DBBF1BB09304F209129E819B7250D774A982CF45
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C92E58 Relevance: .1, Instructions: 149COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c7982c08fa07c4ae0ec3e8bd995a9b048f72fff57627ce03e704a05643e65aa8
                                                                        • Instruction ID: d14b66109b9a55e2148f62a564cdfa85956ba1e2a8a8b5e8ac9a018a84dfde00
                                                                        • Opcode Fuzzy Hash: c7982c08fa07c4ae0ec3e8bd995a9b048f72fff57627ce03e704a05643e65aa8
                                                                        • Instruction Fuzzy Hash: 1B519AB5D01258AFCF40CFA9D984A9EBBF0BB09310F10846AE818F7311E334AA45CF65
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9D6E9 Relevance: .1, Instructions: 146COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 74ba323849b494b1633c1e5f1f2594184ab65256f8f6285e8a381f69d506b6cf
                                                                        • Instruction ID: 054c54a3dfcecd85b693c34f445d0d3f5d3c89f87af632519d6fe81f73468254
                                                                        • Opcode Fuzzy Hash: 74ba323849b494b1633c1e5f1f2594184ab65256f8f6285e8a381f69d506b6cf
                                                                        • Instruction Fuzzy Hash: C2419170B001148FC748BBBCE69A62EBBF6FB84310F404829D586B7351DE785818C7DA
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9D6F0 Relevance: .1, Instructions: 144COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9a1a7aa9c74a19fecebfc57c4bb98bacd670312ff40d7555aab1905c41fc93b9
                                                                        • Instruction ID: 7cd33e1e0805ef7a3a5e7ce85e8781d566b3b4fe107b21daa37c8a22e5374015
                                                                        • Opcode Fuzzy Hash: 9a1a7aa9c74a19fecebfc57c4bb98bacd670312ff40d7555aab1905c41fc93b9
                                                                        • Instruction Fuzzy Hash: 11419070B001048FC748BFBCE69A62EBBF6FB88300F404829D586A7351DE785818C7DA
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C91AE0 Relevance: .1, Instructions: 132COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 10f14140bf2633011167f94e4ac5450d1d1042fad804befdae0e9a44654867e9
                                                                        • Instruction ID: 5d1bc32c18d17f3eb75747e3d62892d55f20aeaee2ca0c507cbd737a90fdb53f
                                                                        • Opcode Fuzzy Hash: 10f14140bf2633011167f94e4ac5450d1d1042fad804befdae0e9a44654867e9
                                                                        • Instruction Fuzzy Hash: 0751F3B5E102199FDF00CFA9D989AEEBBF1BB48310F24842AE815B7350E734A9458B54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9D8CE Relevance: .1, Instructions: 100COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5ec0bd45a962b63acc2fb50096028c259b16adb1262b81c1ef41a2572602738a
                                                                        • Instruction ID: 5ffb9b5ea606547da5caccfe31afc3a40e334eac77f02ab0180f77a77e7e219f
                                                                        • Opcode Fuzzy Hash: 5ec0bd45a962b63acc2fb50096028c259b16adb1262b81c1ef41a2572602738a
                                                                        • Instruction Fuzzy Hash: E8316E70B092454FD305BBBC9E9925EBFB5EF86324F0546AAD4C5E7292DA384C05C3A2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C92772 Relevance: .1, Instructions: 98COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 78415910316de260cad2d6babbd68e47035fa0ddb5316167f49fd22e3f673214
                                                                        • Instruction ID: c24531a7d767e272c3a4a554f6fec32180c2a70b5f2eecf5e8828fc47b6d84ee
                                                                        • Opcode Fuzzy Hash: 78415910316de260cad2d6babbd68e47035fa0ddb5316167f49fd22e3f673214
                                                                        • Instruction Fuzzy Hash: C831C0B6700A129FCB24DB69D8C896BB7F6FFC86203158539E5AAD7760CB30EC018750
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C921CF Relevance: .1, Instructions: 93COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9d9359cd1a7683bd0309dd94f606943a371560d61d32b0952db8e3e44af99437
                                                                        • Instruction ID: b7d9f6de689ed1083088cec1755c6235443ff710ce0b61783e0b63e17dc528b7
                                                                        • Opcode Fuzzy Hash: 9d9359cd1a7683bd0309dd94f606943a371560d61d32b0952db8e3e44af99437
                                                                        • Instruction Fuzzy Hash: CD417C70900B0ADFCF14DFA9C4846DDBBB1FF88310F15C669D4496B261EB70AA81CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0069D01C Relevance: .1, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358604096.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_69d000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 841454658fd4fae3b6cdfddea70d43965359b271b0c5248095329a3a9bbcf397
                                                                        • Instruction ID: 640f4dca940b3f0732569c2d811458866371349e690cd26c437192482f27c1a7
                                                                        • Opcode Fuzzy Hash: 841454658fd4fae3b6cdfddea70d43965359b271b0c5248095329a3a9bbcf397
                                                                        • Instruction Fuzzy Hash: 1821F271604344DFDF14DF24D984B26BB6AFB84314F20C579E80A4B786C33AD847CA62
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0069D1D4 Relevance: .1, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358604096.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_69d000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 603b4fb219a09ed9e2a5dd6ab4bd8d3ce44cf9836ffdc5c3cad71a59a9ef836c
                                                                        • Instruction ID: 7dfe68194a270de2d89f89febb2034facfc409bbf3867f8a0fe1258fc8a3da8a
                                                                        • Opcode Fuzzy Hash: 603b4fb219a09ed9e2a5dd6ab4bd8d3ce44cf9836ffdc5c3cad71a59a9ef836c
                                                                        • Instruction Fuzzy Hash: 4D21D071504204EFDF05DF10D980B26BBAAFB84314F20C5B9EA094B796C336D946CA62
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0069D006 Relevance: .1, Instructions: 61COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358604096.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_69d000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0014368cb58c6b574de71eb651ae2ed7956c5ea4e61dacff939475d2edb74900
                                                                        • Instruction ID: 7d783ed4228236eea86a30d3090374d0c7861888ea461ffa6bed3d60281506ff
                                                                        • Opcode Fuzzy Hash: 0014368cb58c6b574de71eb651ae2ed7956c5ea4e61dacff939475d2edb74900
                                                                        • Instruction Fuzzy Hash: 81219F755083809FCB06CF14D994B11BFB6FB46314F24C5EAD8498F6A7C33A9816CB62
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C91A40 Relevance: .1, Instructions: 58COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a394a707c1dd0ac76db6955cf047f505399b93e46458d0767c2abf7c2126c596
                                                                        • Instruction ID: ec94794e503cb4c6a8746f80b2f7274c66dbc320e30ceef3a3efab3faafa59db
                                                                        • Opcode Fuzzy Hash: a394a707c1dd0ac76db6955cf047f505399b93e46458d0767c2abf7c2126c596
                                                                        • Instruction Fuzzy Hash: B711F675D0060A8FCF50EFA9D8814EEFBF4FF48310B14866AD559B3211EB30AA91CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0069D1CF Relevance: .1, Instructions: 53COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358604096.000000000069D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0069D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_69d000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: af0032d31c21eee98164703ed9ecbad4511e5bcd2f12e312fdd1ff5dc5c24f5f
                                                                        • Instruction ID: d8e66f2d58912d3e41b5613d036e329aadce2cf8e3640fe35993e71aefb306b0
                                                                        • Opcode Fuzzy Hash: af0032d31c21eee98164703ed9ecbad4511e5bcd2f12e312fdd1ff5dc5c24f5f
                                                                        • Instruction Fuzzy Hash: BE11BB75504280DFCB05CF10C6C0B55BBA2FB84324F24C6A9D9494B796C33AD80ACB61
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C927EA Relevance: .1, Instructions: 52COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b0d0ff58199c5648edcdf7f7f399b0bad5599d377648bf1be897ea372fae7891
                                                                        • Instruction ID: 9ef840d60d62dc04635c7487dbc07c9e633bb804021a28d975df960a068a1773
                                                                        • Opcode Fuzzy Hash: b0d0ff58199c5648edcdf7f7f399b0bad5599d377648bf1be897ea372fae7891
                                                                        • Instruction Fuzzy Hash: 6901A2B2B006221B9F14E56A9C84A7FA3EBEFC81607558539D058D7340EE34DD025294
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C94ACE Relevance: .0, Instructions: 47COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: cf9e38ed05d383e43830f850226e01e902e5ceadd21f9691b5d0b7111d554849
                                                                        • Instruction ID: b31695b114249fff8f285b7a34518bc27c0c5b8dc2ee19ab90015e786a5071d1
                                                                        • Opcode Fuzzy Hash: cf9e38ed05d383e43830f850226e01e902e5ceadd21f9691b5d0b7111d554849
                                                                        • Instruction Fuzzy Hash: 9B01F1A2A0D3CA9FE703E770DC652487FB0CB13144F0940E7C085DF1A3E9681E098766
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C92E4A Relevance: .0, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4c44b94e69d9952cda1e5d154560d49a9a44bebfd09d012af25056acad9ae8e2
                                                                        • Instruction ID: daf99b4d5afb79308437cc5c8a55154a7c19693862b2221dad05527e4d243408
                                                                        • Opcode Fuzzy Hash: 4c44b94e69d9952cda1e5d154560d49a9a44bebfd09d012af25056acad9ae8e2
                                                                        • Instruction Fuzzy Hash: 350100B6D01249AFCF80DFA8D881ADE7BF4FF19210F144066E854E7301E3349A10CBA2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C919D8 Relevance: .0, Instructions: 36COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2b7962052803033a160c53f6d7acd6ed01b0483dcec5c74be706841a6eb5277f
                                                                        • Instruction ID: 28782daecef2290b04439152c41217c20bb17ac57732fd8b2c255607274247dd
                                                                        • Opcode Fuzzy Hash: 2b7962052803033a160c53f6d7acd6ed01b0483dcec5c74be706841a6eb5277f
                                                                        • Instruction Fuzzy Hash: BFF059627092840FF7095769581976F3F968BCA202B18406ED586DB392CC149D0283E9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C94B48 Relevance: .0, Instructions: 28COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: dd237b83683ed7e8115e4b9049207c95343c0d3130f92c5033028d131f449ea0
                                                                        • Instruction ID: bd6a61804520a97a0bed72ca997ec02e614b0ebc4d23a5c35effdf76df68c21c
                                                                        • Opcode Fuzzy Hash: dd237b83683ed7e8115e4b9049207c95343c0d3130f92c5033028d131f449ea0
                                                                        • Instruction Fuzzy Hash: 15E0D835B002246BD3085676A88577E6967E7D0620F44C439E446CB390CEB9CC025390
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C9C871 Relevance: .0, Instructions: 26COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 985dc1cdf250491e29f907b3b51a29f91ec70daa141cdf74d7861868b3dd8c5a
                                                                        • Instruction ID: e7eeeb78233a7f4303ded179615e4f874d2e2f3b367bd9f11a9b362133643fa0
                                                                        • Opcode Fuzzy Hash: 985dc1cdf250491e29f907b3b51a29f91ec70daa141cdf74d7861868b3dd8c5a
                                                                        • Instruction Fuzzy Hash: 23F08CB0508391CFEB25AF30D89C2297BB4EFA234274940A6E045D66A2CB29D802CB25
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C92E00 Relevance: .0, Instructions: 24COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6011fa7c05af8362aa32936cc3e73095f22fe2c23fcc06cf845f3558505c40ac
                                                                        • Instruction ID: 9a3ea7ac96886799a8eb41aa4509957f1c2846b3e0e8a73a816365d0c39fef0b
                                                                        • Opcode Fuzzy Hash: 6011fa7c05af8362aa32936cc3e73095f22fe2c23fcc06cf845f3558505c40ac
                                                                        • Instruction Fuzzy Hash: 49E04F32B10608668705BAADD4048EBBBF9DFCA220B04C26BF54D97221EE70998193A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C919C8 Relevance: .0, Instructions: 23COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 66f890acf29328f3fd1c0adcef0301c32c485f07bfe6f57163172803d35f39f1
                                                                        • Instruction ID: ab1a8134a7e280460951658283ce30f4d0c2df74400b58b3c34438f03dbcae59
                                                                        • Opcode Fuzzy Hash: 66f890acf29328f3fd1c0adcef0301c32c485f07bfe6f57163172803d35f39f1
                                                                        • Instruction Fuzzy Hash: 15E0C2B33562482BD728668AAD56F7B7B5D8BC9663F09802FFA05C6280DC50580247E8
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C94B10 Relevance: .0, Instructions: 17COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 464c81e51386260625bd93b40c3b653138e7bad5d086a94cad9165c04d24acad
                                                                        • Instruction ID: f147ba4919bd85c37a6a62c93c1a8a90a8d83c584207480f60a01e675fa25fa2
                                                                        • Opcode Fuzzy Hash: 464c81e51386260625bd93b40c3b653138e7bad5d086a94cad9165c04d24acad
                                                                        • Instruction Fuzzy Hash: 0FD02BB0A0020CEFCB00EFF4E94455DB7F5EB49200B1084A9D809E7310EA312F019B50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C94283 Relevance: .0, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 356d7ee956735d3add6742e61f4e560b120aba2211bf73e8062d6c30942a5ddc
                                                                        • Instruction ID: 9b269b7579fd121f8f737d87ed6f845f4f42aa730fd471086bf6967a0aa6d0cb
                                                                        • Opcode Fuzzy Hash: 356d7ee956735d3add6742e61f4e560b120aba2211bf73e8062d6c30942a5ddc
                                                                        • Instruction Fuzzy Hash: E5B092363401048FC6452A78A108068B7A2EAC427631480BAE50DCA610C93688428700
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Non-executed Functions

                                                                        Function 006E6460 Relevance: 1.0, Instructions: 970COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1358916871.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_6e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f03269500fe870062b41f23b9c458400225a9769446f867aec95181cdc13a78c
                                                                        • Instruction ID: 8624c490070283ee188f34c30e902559a5e0e640ada4f346aa079d8d5a18fd2f
                                                                        • Opcode Fuzzy Hash: f03269500fe870062b41f23b9c458400225a9769446f867aec95181cdc13a78c
                                                                        • Instruction Fuzzy Hash: 0A925A70A01289DFDB14CF6AC984AAEBBF2FF58354F258559E405AB3A1D730ED41CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05ECF7A8 Relevance: .3, Instructions: 318COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1368908631.0000000005EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ec0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 66194b0e312f0e6311b6be53cbeae9a127d98a744e85cedaaa21503d804bdb26
                                                                        • Instruction ID: 655e702ca1998dbaef9a0dec47b331083527e3477bbc1b66f6aeb869823c8164
                                                                        • Opcode Fuzzy Hash: 66194b0e312f0e6311b6be53cbeae9a127d98a744e85cedaaa21503d804bdb26
                                                                        • Instruction Fuzzy Hash: 4DA17D70B002085FFF48ABB9885477E6AEBAFC8310F14853C905AEB794DE789D439795
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 072E6ED8 Relevance: .3, Instructions: 290COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1370695668.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_72e0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fd3467ac8d64b3dc23ddaaf32cd7a2bbbd05e72dee9c960ae674e83b7d677da1
                                                                        • Instruction ID: 00a67907e95931c6ad1ddce082b5cabd55f811f1d80dddcd0ae4792e5f8bb147
                                                                        • Opcode Fuzzy Hash: fd3467ac8d64b3dc23ddaaf32cd7a2bbbd05e72dee9c960ae674e83b7d677da1
                                                                        • Instruction Fuzzy Hash: D6D1B374A10209CFDB14DF69C598AA9B7F6FF8D701F6580A8E506AB361DB31AD40CF60
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C90438 Relevance: .3, Instructions: 269COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d31e213ee8ef76055bee22dae53a16136029854c68ce22c42f83dbc8f15e0443
                                                                        • Instruction ID: bde0ba16a5ab45704e95ba46cf0eeaed1643705c77f938338fda1621dddf8ba0
                                                                        • Opcode Fuzzy Hash: d31e213ee8ef76055bee22dae53a16136029854c68ce22c42f83dbc8f15e0443
                                                                        • Instruction Fuzzy Hash: 11D14835C2070A8ADB10EB64D9946D9B7B1FFD5300F20CB9AE0493B225EB706AD4CF91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C90448 Relevance: .3, Instructions: 264COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1371077934.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_7c90000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d7c564b886af6eb98b852658b8b1f6ee4163f2f6d3b8c5255f017b704ea1dbe9
                                                                        • Instruction ID: 18220d0fc974604071266852183ff77cea9396b370f8342e436f216d5c1b5b40
                                                                        • Opcode Fuzzy Hash: d7c564b886af6eb98b852658b8b1f6ee4163f2f6d3b8c5255f017b704ea1dbe9
                                                                        • Instruction Fuzzy Hash: C2D1383582071A8ADB10EB64D9946D9B7B1FFD5300F20DB9AE0493B225EF706AD4CF91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EEFE34 Relevance: .1, Instructions: 76COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 055e4dc9cd0bbd6b4e66c5da5ecee990ca8851f2cbcaad920d320a4d6c8e7747
                                                                        • Instruction ID: 3033679a12d80ce577f30ce7d367b7a969ad1c59f8ec97f1f86c1e5e41c579e5
                                                                        • Opcode Fuzzy Hash: 055e4dc9cd0bbd6b4e66c5da5ecee990ca8851f2cbcaad920d320a4d6c8e7747
                                                                        • Instruction Fuzzy Hash: 00213EB6E042089FDB04CFA9D8419EEFBF1EB9A320F14E16BD558E7721D73498018B64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EEF7DD Relevance: .1, Instructions: 75COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bdbda7c609e365d2b79900ad75a51b4d2d0791bcb0f9569b72852efd2b013e57
                                                                        • Instruction ID: 683b618f589adb5474d9b77882f57427f1b1624d7b060aedffc271ba3a9842c4
                                                                        • Opcode Fuzzy Hash: bdbda7c609e365d2b79900ad75a51b4d2d0791bcb0f9569b72852efd2b013e57
                                                                        • Instruction Fuzzy Hash: 1D318DB4D15208DFDB54CFA9D484AADBBF2BF89310F24A16AE824A7350D3349981CF58
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EEF7E8 Relevance: .1, Instructions: 71COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7adbe44d601bc65170511da8f674c3b88b7694a965f8a996ec163f6784977f01
                                                                        • Instruction ID: 171a05b12354bb6962fb33edca40b704eeaa5fa1a44b996bcca583ab457c17c9
                                                                        • Opcode Fuzzy Hash: 7adbe44d601bc65170511da8f674c3b88b7694a965f8a996ec163f6784977f01
                                                                        • Instruction Fuzzy Hash: 7E317EB4D05208DFDB14CFA9D584AADBBF2BF89310F24A169E824B7350D3349981CF58
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EEFEFC Relevance: .1, Instructions: 62COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bdeef154ee51172403185e285cda954a9f482b8607797342f7456c0dc777c994
                                                                        • Instruction ID: 9b71c89eeab089457ef559a6d06c515d9976fe54253200695338c968e2e49c98
                                                                        • Opcode Fuzzy Hash: bdeef154ee51172403185e285cda954a9f482b8607797342f7456c0dc777c994
                                                                        • Instruction Fuzzy Hash: 00212774D04258DBDF14CFA9D4846EDBBB1BF8A320F24E225E865B7290C7348941CF94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EEFF08 Relevance: .1, Instructions: 59COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 61d27d3c49f1a9c3ef82a503e4760ed60e87ce423b764b34960a8716635bb597
                                                                        • Instruction ID: 8ac1f762b1fceabff9225680658fb6e74fc39106749ef235709222b8851a0f10
                                                                        • Opcode Fuzzy Hash: 61d27d3c49f1a9c3ef82a503e4760ed60e87ce423b764b34960a8716635bb597
                                                                        • Instruction Fuzzy Hash: 7E219F74D04218DFDB04CFAAD4846EEBBF1BB8A314F24E129E864B7250D7349941CF98
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05EEFE40 Relevance: .0, Instructions: 34COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000004.00000002.1369057862.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_4_2_5ee0000_order 4502657678.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
                                                                        • Instruction ID: d8ea1b4739859de6c7eae1fe466ac0313b31378688e25b0f1bae162f1eff58a4
                                                                        • Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
                                                                        • Instruction Fuzzy Hash: 17F042B5D0520C9F8F04DFA9D5418EEFBF2AB5E310F10A16AE814B3310E73599518FA8
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Execution Graph

                                                                        Execution Coverage:18.1%
                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                        Signature Coverage:0%
                                                                        Total number of Nodes:49
                                                                        Total number of Limit Nodes:2
                                                                        execution_graph 45622 7c859b8 45623 7c859ea 45622->45623 45626 7c8c7df 45623->45626 45624 7c8b089 45627 7c8c821 45626->45627 45630 7c8ca78 45627->45630 45628 7c8c8d9 45628->45624 45631 7c8ca8c 45630->45631 45634 7c8cdea 45631->45634 45635 7c8ce3b 45634->45635 45638 7c8d2b8 45635->45638 45639 7c8d302 DeleteFileW 45638->45639 45641 7c8cd82 45639->45641 45641->45628 45642 2e10cd0 45643 2e10cf2 45642->45643 45647 2e118d9 45643->45647 45652 2e11889 45643->45652 45644 2e10e7b 45648 2e118e0 45647->45648 45657 2e11f27 45648->45657 45661 2e11f38 45648->45661 45649 2e11ac4 45649->45644 45654 2e1188e 45652->45654 45653 2e11ac4 45653->45644 45655 2e11f27 InternetGetConnectedState 45654->45655 45656 2e11f38 InternetGetConnectedState 45654->45656 45655->45653 45656->45653 45658 2e11f38 45657->45658 45665 2e124f8 45658->45665 45659 2e11f88 45659->45649 45662 2e11f5c 45661->45662 45664 2e124f8 InternetGetConnectedState 45662->45664 45663 2e11f88 45663->45649 45664->45663 45666 2e12502 45665->45666 45667 2e12554 45665->45667 45670 2e12648 45666->45670 45674 2e12658 45666->45674 45667->45659 45671 2e12658 45670->45671 45678 2e122f8 45671->45678 45675 2e1266f 45674->45675 45676 2e122f8 InternetGetConnectedState 45675->45676 45677 2e1268b 45676->45677 45677->45667 45679 2e126b0 InternetGetConnectedState 45678->45679 45681 2e1268b 45679->45681 45681->45667 45615 7cbbdd0 45616 7cbbf5b 45615->45616 45618 7cbbdf6 45615->45618 45618->45616 45619 7cb0e8c 45618->45619 45620 7cbc0a8 PostMessageW 45619->45620 45621 7cbc155 45620->45621 45621->45618

                                                                        Executed Functions

                                                                        Function 07CC4D7F Relevance: 5.7, Instructions: 5674COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 0 7cc4d7f-7cc4d88 1 7cc4d8a-7cc4fc7 0->1 2 7cc4d12-7cc4d63 0->2 35 7cc701c-7cc7302 1->35 36 7cc4fcd-7cc586b 1->36 111 7cc7308-7cc82b3 35->111 112 7cc82bb-7cc9336 35->112 296 7cc5873-7cc5d12 36->296 111->112 702 7cc933c-7cc9675 112->702 703 7cc967d-7cc9690 112->703 444 7cc5ffe-7cc7014 296->444 445 7cc5d18-7cc5ff6 296->445 444->35 445->444 702->703 707 7cc9d3d-7ccac16 call 7ccc871 703->707 708 7cc9696-7cc9d35 703->708 1090 7ccac1c-7ccac23 707->1090 708->707
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c982231332c5ce8e2e655bf371b7ff7d75f3f5196fa4d7461a0432c2ba9c9d12
                                                                        • Instruction ID: 06177012e98c0fd03d9b5e80b8af473516f9e6695d852170761fa0a69eeb8a4b
                                                                        • Opcode Fuzzy Hash: c982231332c5ce8e2e655bf371b7ff7d75f3f5196fa4d7461a0432c2ba9c9d12
                                                                        • Instruction Fuzzy Hash: C7C3D5B4A016188FCB58FF79DA9966DBBB2FB89300F0049E9D449A7354DB349E84CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC4D98 Relevance: 5.6, Instructions: 5633COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1092 7cc4d98-7cc4fc7 1120 7cc701c-7cc7302 1092->1120 1121 7cc4fcd-7cc586b 1092->1121 1196 7cc7308-7cc82b3 1120->1196 1197 7cc82bb-7cc9336 1120->1197 1381 7cc5873-7cc5d12 1121->1381 1196->1197 1787 7cc933c-7cc9675 1197->1787 1788 7cc967d-7cc9690 1197->1788 1529 7cc5ffe-7cc7014 1381->1529 1530 7cc5d18-7cc5ff6 1381->1530 1529->1120 1530->1529 1787->1788 1792 7cc9d3d-7ccac16 call 7ccc871 1788->1792 1793 7cc9696-7cc9d35 1788->1793 2175 7ccac1c-7ccac23 1792->2175 1793->1792
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4fd4d09a6ee17f57b8287d50497a78a401327e81fcc39d2339a253c31c924e33
                                                                        • Instruction ID: 9c4731fbc50d1b9a92911bea1d52e9fd88d5be028645e3dc81c6aefab32f604f
                                                                        • Opcode Fuzzy Hash: 4fd4d09a6ee17f57b8287d50497a78a401327e81fcc39d2339a253c31c924e33
                                                                        • Instruction Fuzzy Hash: 1EC3D5B4A016188FCB58FF79DA9966DBBB2FB89300F0049E9D449A7354DB349E84CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081757D8 Relevance: .6, Instructions: 596COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 33f4f83d6064ef2eebf4a07aed825a0a5e7ffe37d40f2975cdf792bca5c16d6d
                                                                        • Instruction ID: 0a07f4c54fb829f8d6a58e53906fcee8d814b16cbdc32c85bc43407d207a0893
                                                                        • Opcode Fuzzy Hash: 33f4f83d6064ef2eebf4a07aed825a0a5e7ffe37d40f2975cdf792bca5c16d6d
                                                                        • Instruction Fuzzy Hash: 65527D34A003498FDB14DF28C844B99B7F2FF85314F2586A9D4596F3A1DBB1A982CF81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081757B8 Relevance: .6, Instructions: 591COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 376c990f707f2d9ef781373b47ed7fb698094a2274db38267debce11a751e72f
                                                                        • Instruction ID: a9b9095e5d0d4552d2acab27184bdfe8e7194eb4015e6256f86147c3dbdadd1f
                                                                        • Opcode Fuzzy Hash: 376c990f707f2d9ef781373b47ed7fb698094a2274db38267debce11a751e72f
                                                                        • Instruction Fuzzy Hash: C6526E34A003498FDB14DF28C844B99B7F2BF85314F2586E9D4596F3A1DBB1A986CF81
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC21A8 Relevance: .3, Instructions: 277COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7dba9781bc56238ad64a835b8d846c69c7b63037c96c426ee56821a5fcb20c5a
                                                                        • Instruction ID: 08580c14127c84d521082a4e329de6f5b88c3de450c825136bb8b960992dda31
                                                                        • Opcode Fuzzy Hash: 7dba9781bc56238ad64a835b8d846c69c7b63037c96c426ee56821a5fcb20c5a
                                                                        • Instruction Fuzzy Hash: 5AB138B0E003099FDB14DFA9C494A9DBBF1BF89300F248569D815AB361DB709945CF95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC2408 Relevance: .1, Instructions: 102COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fa208164e98ea2f251767743c548dc2180731412e86d0b986d44f2d7e9768819
                                                                        • Instruction ID: 33797edfb89fc2303b489801460c797d4d427549734adfa498b77e7d649658ee
                                                                        • Opcode Fuzzy Hash: fa208164e98ea2f251767743c548dc2180731412e86d0b986d44f2d7e9768819
                                                                        • Instruction Fuzzy Hash: 754177B4D00308DFDB24CFAAD584A9EBBF5BB09300F20942AE919BB251D775A945CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCEF89 Relevance: 1.7, Strings: 1, Instructions: 428COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 5403 7ccef89-7ccefae 5404 7cceff0-7ccf012 5403->5404 5405 7ccefb0-7ccefcb 5403->5405 5408 7ccf05a-7ccf078 call 7ccc570 5404->5408 5406 7ccefcd-7ccefee 5405->5406 5407 7ccf036-7ccf051 5405->5407 5406->5404 5407->5408 5412 7ccf07e-7ccf092 5408->5412 5413 7ccf19f-7ccf260 5408->5413 5412->5413 5416 7ccf098-7ccf19a call 7cccfb0 5412->5416 5440 7ccf262-7ccf267 5413->5440 5416->5440 5441 7ccf4dd 5440->5441 5442 7ccf26d-7ccf3df 5440->5442 5487 7ccf4dd call 7cb1619 5441->5487 5488 7ccf4dd call 7cb1628 5441->5488 5468 7ccf3e1-7ccf3eb 5442->5468 5469 7ccf3f3-7ccf4a5 5442->5469 5444 7ccf4e3-7ccf4ea 5468->5469 5481 7ccf4ac-7ccf4af 5469->5481 5482 7ccf4a7-7ccf4aa 5469->5482 5483 7ccf4b2-7ccf4d5 5481->5483 5482->5483 5489 7ccf4d7 call 7cb0023 5483->5489 5490 7ccf4d7 call 7cb0040 5483->5490 5491 7ccf4d7 call 7cb0550 5483->5491 5487->5444 5488->5444 5489->5441 5490->5441 5491->5441
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: o
                                                                        • API String ID: 0-252678980
                                                                        • Opcode ID: e73d15603538ad9357a53851eae8f41fdba6ab5514ce5549901de01ee07c1adc
                                                                        • Instruction ID: 33e816eaa66a26d70c63bea3c9daba3a20c88d9b8028bdbca79cf02f453cd673
                                                                        • Opcode Fuzzy Hash: e73d15603538ad9357a53851eae8f41fdba6ab5514ce5549901de01ee07c1adc
                                                                        • Instruction Fuzzy Hash: 08E11171A042448FC706FF7CD96521D7FB6BF8A300F0545AAD485EB3A2DA389C09C7A6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CBC0A0 Relevance: 1.6, APIs: 1, Instructions: 89windowCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 5492 7cbc0a0-7cbc153 PostMessageW 5494 7cbc15c-7cbc18e 5492->5494 5495 7cbc155-7cbc15b 5492->5495 5495->5494
                                                                        APIs
                                                                        • PostMessageW.USER32(?,?,?,00000000), ref: 07CBC143
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467483089.0000000007CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CB0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cb0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID: MessagePost
                                                                        • String ID:
                                                                        • API String ID: 410705778-0
                                                                        • Opcode ID: 31b709d54fa02d2b92d19c5a48781b72d2cd00b11cc0244b216bd4570626b6d8
                                                                        • Instruction ID: 09fc3766fd0fb328fab9484dfdb461894bcee6eaad6c000c4b06552f2ddaa44f
                                                                        • Opcode Fuzzy Hash: 31b709d54fa02d2b92d19c5a48781b72d2cd00b11cc0244b216bd4570626b6d8
                                                                        • Instruction Fuzzy Hash: 333168B9D01258AFCB20CFA9D984ADEFBF4EB59310F14942AE818B7310D375A945CF64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CB0E8C Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 5498 7cb0e8c-7cbc153 PostMessageW 5500 7cbc15c-7cbc18e 5498->5500 5501 7cbc155-7cbc15b 5498->5501 5501->5500
                                                                        APIs
                                                                        • PostMessageW.USER32(?,?,?,00000000), ref: 07CBC143
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467483089.0000000007CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CB0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cb0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID: MessagePost
                                                                        • String ID:
                                                                        • API String ID: 410705778-0
                                                                        • Opcode ID: c67e738f0c82e7a61b80b1528dcf5c6a86c9b4c973ff74a9bf0b8f850f2e90f8
                                                                        • Instruction ID: 3d0d67a68763a849612bf3a8cb1d7bd8a85d256766a0aec06c3ab11f5d93cfb8
                                                                        • Opcode Fuzzy Hash: c67e738f0c82e7a61b80b1528dcf5c6a86c9b4c973ff74a9bf0b8f850f2e90f8
                                                                        • Instruction Fuzzy Hash: 573168B9D05258AFCB20CFA9D584ADEFBF4EB49310F14942AE818B7310D375A945CFA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02E122F8 Relevance: 1.6, APIs: 1, Instructions: 83networkCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 5504 2e122f8-2e12751 InternetGetConnectedState 5507 2e12753-2e12759 5504->5507 5508 2e1275a-2e12792 5504->5508 5507->5508
                                                                        APIs
                                                                        • InternetGetConnectedState.WININET(?,?), ref: 02E12741
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1459097785.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2e10000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID: ConnectedInternetState
                                                                        • String ID:
                                                                        • API String ID: 97057780-0
                                                                        • Opcode ID: 3e10ab55dba6cb4aea4555dfe965b74c11c503b053fed6b888d225b4276bd737
                                                                        • Instruction ID: c0497cffa37c2337b36011ca1907d81491b047c73a7671969f8bd77adde7898d
                                                                        • Opcode Fuzzy Hash: 3e10ab55dba6cb4aea4555dfe965b74c11c503b053fed6b888d225b4276bd737
                                                                        • Instruction Fuzzy Hash: E53199B9D052289FCB10CFAAD884ADEFBF4BB09310F10946AE914B7310D375A945CFA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07C8D2B8 Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467298847.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7c80000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID: DeleteFile
                                                                        • String ID:
                                                                        • API String ID: 4033686569-0
                                                                        • Opcode ID: ebe1b6e54357f869445455284500e668a0d426b3d7545c6801c1efbcb20ccfba
                                                                        • Instruction ID: b9e3fec55f5c6473d90fa23742c7669376fd03fb04a88a0cfeb6a9e6239803f2
                                                                        • Opcode Fuzzy Hash: ebe1b6e54357f869445455284500e668a0d426b3d7545c6801c1efbcb20ccfba
                                                                        • Instruction Fuzzy Hash: 4831BAB4D01219DFCB10CFAAD884AEEFBF5BB49314F14806AE419B7250D374AA45CF64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02E126A9 Relevance: 1.6, APIs: 1, Instructions: 82networkCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • InternetGetConnectedState.WININET(?,?), ref: 02E12741
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1459097785.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2e10000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID: ConnectedInternetState
                                                                        • String ID:
                                                                        • API String ID: 97057780-0
                                                                        • Opcode ID: 900e0337cb2303fc205707a32089e83ec927efba58d0c94b386eb738b69d96e9
                                                                        • Instruction ID: 1eff11ea03bc450a2b024d3f52dfcb2308c92714739a5df0081399aca0cb1788
                                                                        • Opcode Fuzzy Hash: 900e0337cb2303fc205707a32089e83ec927efba58d0c94b386eb738b69d96e9
                                                                        • Instruction Fuzzy Hash: ED31ABB9D012189FCB10CFA9D885ADEFBF4BB09310F14906AE914B7310D375A945CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC4A23 Relevance: 1.4, Strings: 1, Instructions: 131COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: D
                                                                        • API String ID: 0-2746444292
                                                                        • Opcode ID: d9329da1373508c7c57ab3c126b58575c431f71f9ef450ecf0a0ad03990e84e5
                                                                        • Instruction ID: dd76e471d979fb2357e129b930b87dbce5771d13fa484fb7a3ae02e700a32a61
                                                                        • Opcode Fuzzy Hash: d9329da1373508c7c57ab3c126b58575c431f71f9ef450ecf0a0ad03990e84e5
                                                                        • Instruction Fuzzy Hash: A241429254E3C25FC3038BB49CA52957FB09E03124B1E02EBC4C1CF6E3E6180A4AC7A7
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC3B3B Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: TJq
                                                                        • API String ID: 0-48878262
                                                                        • Opcode ID: 8c0170ed4513d1c553b0bbfcc13daa12cf3502b3a98a69e3a1387b6a39e852c6
                                                                        • Instruction ID: c7b1c5ad0b1bcc91fa28dfb4a4d3b4316af3669457a1d6ddb8eae175b2fab97b
                                                                        • Opcode Fuzzy Hash: 8c0170ed4513d1c553b0bbfcc13daa12cf3502b3a98a69e3a1387b6a39e852c6
                                                                        • Instruction Fuzzy Hash: C1319C707041549FC704BBBDE9A9A2E7BBABFC9310B00496AE445D7351DE349C088796
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC3B48 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: TJq
                                                                        • API String ID: 0-48878262
                                                                        • Opcode ID: 6ad4fce956fe20ed9614d4df0d9bbc06b7ae08d22bc49d251afb4682433f5d72
                                                                        • Instruction ID: 2da732311ad373807529ccd76cde069e20103e0a82e065bf0314b1ed88ef1226
                                                                        • Opcode Fuzzy Hash: 6ad4fce956fe20ed9614d4df0d9bbc06b7ae08d22bc49d251afb4682433f5d72
                                                                        • Instruction Fuzzy Hash: 7F21AD707041149FC704BBBDE9A9A2EBBFAFFC9310B004969E845D7350DE349C088796
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08173308 Relevance: .8, Instructions: 828COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d67cc0d2c8a5e91c95c2227c9df34f678eb6cb8e974334442926f2ccb82339a7
                                                                        • Instruction ID: 23bdcb56cc3e0d8b676a6565f806882bcf3d66244002ddf11381ce47eda9f98d
                                                                        • Opcode Fuzzy Hash: d67cc0d2c8a5e91c95c2227c9df34f678eb6cb8e974334442926f2ccb82339a7
                                                                        • Instruction Fuzzy Hash: E7721E70D01B518ADB349F7498887ADBAB1AF45701F71492EC1FECA780EB349889DF25
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081732F8 Relevance: .5, Instructions: 474COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 42aa34c919757ccb76d9ae0ada80f4d83379dc4657190b9a01975cc2de96a387
                                                                        • Instruction ID: d8194470678940be39d4c8a84225f186a6dbf4a7f2c81451b9e4e26f05c05c10
                                                                        • Opcode Fuzzy Hash: 42aa34c919757ccb76d9ae0ada80f4d83379dc4657190b9a01975cc2de96a387
                                                                        • Instruction Fuzzy Hash: 06226FB0905B928ADB749F6488C479DF6A0AF05701F70491FC0FECA395EB34948AEF55
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCCFC1 Relevance: .5, Instructions: 454COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 701f23d8f802f9fc5d41af2f4603ac3d1961ce44e5ee511009241e5139f6e542
                                                                        • Instruction ID: a3f7c5fa39f3be237c63b9edecba2da8293f05baf3d93f87e9d4e07acf9ef12b
                                                                        • Opcode Fuzzy Hash: 701f23d8f802f9fc5d41af2f4603ac3d1961ce44e5ee511009241e5139f6e542
                                                                        • Instruction Fuzzy Hash: 8AF14A70B106088FC748FFBDD6A565DBBB6BF88300F504969D88AE7354DA38AC05CB95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCE400 Relevance: .4, Instructions: 438COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2a191162f6d4dd24e6161efefaa207f7122749e57c01a224fe4c7a3d1750a51f
                                                                        • Instruction ID: d05920db8662362564db6e3f0b1f32529f639a7feb43e528765dc092df58c0f6
                                                                        • Opcode Fuzzy Hash: 2a191162f6d4dd24e6161efefaa207f7122749e57c01a224fe4c7a3d1750a51f
                                                                        • Instruction Fuzzy Hash: 37E18D71A101148FC704FFBDE99A66D7FB6FB89310F444869D889E3354DE389848C7A9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC27F8 Relevance: .4, Instructions: 423COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 89149c8f260e07ea276f8d3702f703f46a242b45cdcc6e991e2be85c5c78bafc
                                                                        • Instruction ID: f58cb00855ae9fc90ea62482aacfde36de03a46023dbed6f8d8d04129ecf35d5
                                                                        • Opcode Fuzzy Hash: 89149c8f260e07ea276f8d3702f703f46a242b45cdcc6e991e2be85c5c78bafc
                                                                        • Instruction Fuzzy Hash: 0AD1BE71A002148FDB09BBBCD9A566E7BB6FFC8340F404969D485E7395DE388C05C7AA
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817B9A3 Relevance: .4, Instructions: 410COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 20e4a83a09e9ac9ee0c060b14c573cd7a49b56caa7c073ee91cf0d3ece01a4cf
                                                                        • Instruction ID: a4b16fa45034582224a244193502cbbed3b0306f15e6064829d47401a2dfbc66
                                                                        • Opcode Fuzzy Hash: 20e4a83a09e9ac9ee0c060b14c573cd7a49b56caa7c073ee91cf0d3ece01a4cf
                                                                        • Instruction Fuzzy Hash: 8F02F534600208DFDB48DF68D498AAD77F2BF89715F5585A8E409DB362DB31EC86CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081709A0 Relevance: .4, Instructions: 384COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f36d3634e32f084e74ece6fb09c1c17db852e1e4c6e32e727219f7d87b44e665
                                                                        • Instruction ID: fbbb73e20a8463354b701ed133e1a6466ec456fe8253898a7ecaebe93888be28
                                                                        • Opcode Fuzzy Hash: f36d3634e32f084e74ece6fb09c1c17db852e1e4c6e32e727219f7d87b44e665
                                                                        • Instruction Fuzzy Hash: A7E17D31B006448FDB58EBB8C454AAEB7F6EF89311B14446DD406EB790DF35AC42CBA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCF018 Relevance: .4, Instructions: 375COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8a6fb1fcb6f152a0853d64284d3edb20087a76486ca29aa1cdd403f3fda82d4c
                                                                        • Instruction ID: 8c82d72ae31276213b1a153d02eb471bf65a573ae3e79540ef7d280643c34cc5
                                                                        • Opcode Fuzzy Hash: 8a6fb1fcb6f152a0853d64284d3edb20087a76486ca29aa1cdd403f3fda82d4c
                                                                        • Instruction Fuzzy Hash: 71D1F171A046488FC706FF78D96525D7FB6BF8A300F0544AAD485DB3A2DB389C09C7A5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCCA00 Relevance: .4, Instructions: 366COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 73b1f98b8364a7828d05428dc49ebceb32bbb6cebb3ba067a46539cb6ac69081
                                                                        • Instruction ID: 9c85a0dd26d6573cfa39464e3229c7bad473023ebbe6fdaff54067d9ca3e98bf
                                                                        • Opcode Fuzzy Hash: 73b1f98b8364a7828d05428dc49ebceb32bbb6cebb3ba067a46539cb6ac69081
                                                                        • Instruction Fuzzy Hash: 0FC18171A106198FC704BFBCE5AA22DBFB6FF88310F454469D889E3354DE389849C795
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC3E6C Relevance: .3, Instructions: 311COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9eace43aeec42d6551bc551492e87888c4eff7f75c072c1c49d0f6a837551181
                                                                        • Instruction ID: 3a19d7014ea522caad84a8237949bf19b5b9301cda20697adacc1f3c9d2ddd88
                                                                        • Opcode Fuzzy Hash: 9eace43aeec42d6551bc551492e87888c4eff7f75c072c1c49d0f6a837551181
                                                                        • Instruction Fuzzy Hash: E8C14770A50294CFC718EF39C5A4829BBF6BF8970076584AEE446DB761CB39EC00CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E220 Relevance: .3, Instructions: 301COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 18cb46f31365debee70590652d604ba18b76a3e932f86c1d4f9b6265981dff6a
                                                                        • Instruction ID: c48e9040bbf2ed559997b7b91f2f5babce51714577f9e586d5387ce51e232d86
                                                                        • Opcode Fuzzy Hash: 18cb46f31365debee70590652d604ba18b76a3e932f86c1d4f9b6265981dff6a
                                                                        • Instruction Fuzzy Hash: 09C1D434A00218CFDB14DF68D598A9DBBF2BF89711B1545ACE416EB3A1DB31EC81CB60
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCDD34 Relevance: .3, Instructions: 297COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a3d965a1de6de9c39a63a532bf22f8344841db712e1d7c8d921e063b1cbab0e6
                                                                        • Instruction ID: 836cd00a6ce31684eee530582388d8a4ec05ae101e5e426a40da9bb0c5550539
                                                                        • Opcode Fuzzy Hash: a3d965a1de6de9c39a63a532bf22f8344841db712e1d7c8d921e063b1cbab0e6
                                                                        • Instruction Fuzzy Hash: 14A1ED70A142588FCB04FFBCD9A966D7BB6FF89300F414869D884E3351DE389818C7A9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCC9F0 Relevance: .3, Instructions: 270COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7a8d71bab5def2793dc0d189ef08a7a20836ec441b15303abaee50978b12ade4
                                                                        • Instruction ID: ece4b041d7ed6cb94460b2813df78910b873eaa01e89b9075756f4bc2d50182b
                                                                        • Opcode Fuzzy Hash: 7a8d71bab5def2793dc0d189ef08a7a20836ec441b15303abaee50978b12ade4
                                                                        • Instruction Fuzzy Hash: 71919F71A10619CFC704BFBCE5A922DBFB6FF88310F444869D889A3354DE389849C795
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081710E0 Relevance: .2, Instructions: 219COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1dcf5f17dfb8495c711b564e914bb59c7282a9465d9be7f50902e75cb2192768
                                                                        • Instruction ID: 3743f261426926d9c823a2d8bd5e1615a2fb989daf0c023c41edf4bf365eda5f
                                                                        • Opcode Fuzzy Hash: 1dcf5f17dfb8495c711b564e914bb59c7282a9465d9be7f50902e75cb2192768
                                                                        • Instruction Fuzzy Hash: 10810438710604DFCB14EF68D498A697BFAFF89A05B2541A9E906CB375DB71EC01CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCD9EE Relevance: .2, Instructions: 173COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ebeb2c182f00e6b251de4718b97e4f5d062778ccc46547edc38ff8844e07b023
                                                                        • Instruction ID: ef9fbbe35425d37fc54f8c37c5352a82c02a73097030a292c6608a927526c681
                                                                        • Opcode Fuzzy Hash: ebeb2c182f00e6b251de4718b97e4f5d062778ccc46547edc38ff8844e07b023
                                                                        • Instruction Fuzzy Hash: E16111B4E042599FDB21CFA8C890B9DBBF1FF0A304F10916AE859E7251D734A986CF45
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08175658 Relevance: .2, Instructions: 170COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 434b6e3d1cb9166615d336ca06b4e3345eac1345dbeca33a7251a9e428c8de04
                                                                        • Instruction ID: c814f0f24b4c715c04190b17c79998a34494efa183772e2268853b146fd77862
                                                                        • Opcode Fuzzy Hash: 434b6e3d1cb9166615d336ca06b4e3345eac1345dbeca33a7251a9e428c8de04
                                                                        • Instruction Fuzzy Hash: B25133306046509FDB19EB24C454AAE7BB6EFC5301F1884AEE0099BB61CF31AC42CBE1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCDA18 Relevance: .2, Instructions: 161COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 44a73ce2de4029a136738d75537ff37deeb3fcdb1fc75cdbaa1d977deba64a6a
                                                                        • Instruction ID: beb374def1999e8499d9a3193aaa0955c9454d62b1a2e6c527b66f0e9bb4e5fd
                                                                        • Opcode Fuzzy Hash: 44a73ce2de4029a136738d75537ff37deeb3fcdb1fc75cdbaa1d977deba64a6a
                                                                        • Instruction Fuzzy Hash: 3951CFB4E04219DFDB20CFA9D985B9DBBF1FF09304F10912AE819A7250D774A982CF45
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC2E58 Relevance: .2, Instructions: 152COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 59485c6dd7005271e3112bba40c1317c95011858c32255600dfd335331024bb8
                                                                        • Instruction ID: 00abfacba53191c889e2b13489a240732c7cf885f53ce9d155c59b12d9ccf19d
                                                                        • Opcode Fuzzy Hash: 59485c6dd7005271e3112bba40c1317c95011858c32255600dfd335331024bb8
                                                                        • Instruction Fuzzy Hash: E4518AB5D012599FCB10CFA9D984A9EBBF4FB09310F10846AE818F7311D334AA45CF61
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCD6E9 Relevance: .1, Instructions: 145COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 54ac703708d00c0e5def305e6e84144b628559f67c5294844fb2b1139f5b009b
                                                                        • Instruction ID: 42211c0e873cafc3cd0dba4b5c4a1b604f913cf4b1ca27f8feaf159b07cb7a08
                                                                        • Opcode Fuzzy Hash: 54ac703708d00c0e5def305e6e84144b628559f67c5294844fb2b1139f5b009b
                                                                        • Instruction Fuzzy Hash: AF414D70B001499FC748BFBDE69662EBBB6FB84310F404879D586A3354DE385948C7D5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCD6F0 Relevance: .1, Instructions: 144COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8f39ba80d95f62d46afdfd4b0b2bdce20f30479e8980a76d43a76e3ac962a39a
                                                                        • Instruction ID: 92e51dceb84e02ce239c7652519b2d1fd2ae6f26738df696abd3ed2a4d913689
                                                                        • Opcode Fuzzy Hash: 8f39ba80d95f62d46afdfd4b0b2bdce20f30479e8980a76d43a76e3ac962a39a
                                                                        • Instruction Fuzzy Hash: E6416C70B001098FC708BFBDE69A62EBBB6FB84300F404879D586A7350DE385848C7D6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC1AE0 Relevance: .1, Instructions: 136COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a57f06c712314c23634724bbcb73856faf319c90212753959090102673f30bdd
                                                                        • Instruction ID: e5e69eb398edf7dc1d34398fe7a8892bc7f37ac9cbf3648e1670e1c56c63dffb
                                                                        • Opcode Fuzzy Hash: a57f06c712314c23634724bbcb73856faf319c90212753959090102673f30bdd
                                                                        • Instruction Fuzzy Hash: B55102B4E002199FCB10CFA9D984AEEBBF1BB49310F10842AE815B7351E734AA45CF94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E210 Relevance: .1, Instructions: 132COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 752caf149abdf2c5fc7f3f2b899d62d637564a2857c4d83729fda5ef4b9942e0
                                                                        • Instruction ID: eaa1c93b89a4f62b0bf7f5bb30493bc387cb106af75f886c33e3199a46581b42
                                                                        • Opcode Fuzzy Hash: 752caf149abdf2c5fc7f3f2b899d62d637564a2857c4d83729fda5ef4b9942e0
                                                                        • Instruction Fuzzy Hash: DE51D334A40614CFD714DF68C598A99B7F1AF4D716B1585ACE40AEB3A1DB31EC81CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08171A30 Relevance: .1, Instructions: 127COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fa5514c2930ac1f51c308eb5138c38601d80108b1b8029005cd13d2a01c69d98
                                                                        • Instruction ID: a04759fd75d6e5fc337ca335e2c53740379ee9559ae2cd8f3613a77daca94848
                                                                        • Opcode Fuzzy Hash: fa5514c2930ac1f51c308eb5138c38601d80108b1b8029005cd13d2a01c69d98
                                                                        • Instruction Fuzzy Hash: 34412834B142589FDB14DB69C894AADBBF6BF49601F1440ADE905EB3A1DB31D801CB60
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817AB7D Relevance: .1, Instructions: 126COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 437d60fe2d8e53bc4612feeef87b9d3da3f1397f3f1e928fab07cf61a6ae8021
                                                                        • Instruction ID: f328c82ace1a88a8e9758aa93a01a312dd312340df26e7fdecce20215e3911b2
                                                                        • Opcode Fuzzy Hash: 437d60fe2d8e53bc4612feeef87b9d3da3f1397f3f1e928fab07cf61a6ae8021
                                                                        • Instruction Fuzzy Hash: 20418134700605DFD729AB28C894B6EB7B6BF85302F14856DD146CB3A0CFB5A846CBE1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817CCD0 Relevance: .1, Instructions: 122COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 228a7c2cc4c32a632034dac3ed2ed2d747bac77e30f77f1510f8bac7771bfff7
                                                                        • Instruction ID: 7cf371d5297ebb2d5a6676f70015c8ea963c9ab569352be294ee3937add26439
                                                                        • Opcode Fuzzy Hash: 228a7c2cc4c32a632034dac3ed2ed2d747bac77e30f77f1510f8bac7771bfff7
                                                                        • Instruction Fuzzy Hash: 27417934300A01DFD728AB24C884BAEB7B6BF85712F10856DD506CB7A0CF75A846CBE0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817B7E0 Relevance: .1, Instructions: 122COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e5ea509650e2b9b02ad9fef430d4d20b6b941853f4a36b29ca6c5692b3dc352d
                                                                        • Instruction ID: a8b3b9a4cf6f2e5c0d20a7c95deed34cd117c3230b05a9f7c3c91487c108d067
                                                                        • Opcode Fuzzy Hash: e5ea509650e2b9b02ad9fef430d4d20b6b941853f4a36b29ca6c5692b3dc352d
                                                                        • Instruction Fuzzy Hash: 3231A0347006148FD729AF398850A2E77F3AFCA60572049ADD0069B3A1DF35EC06CBA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817AB9C Relevance: .1, Instructions: 121COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 76e3f83394b17c2ebe861b355da4b98707b3eae1d1dca67eb239e879262ca048
                                                                        • Instruction ID: c81c369eb702ea415b0a360ff432ec510d3c94279ad15dcbab17cb2e6f31bf5c
                                                                        • Opcode Fuzzy Hash: 76e3f83394b17c2ebe861b355da4b98707b3eae1d1dca67eb239e879262ca048
                                                                        • Instruction Fuzzy Hash: 6D413A35700A01DFD728AB28C894B6EB7B6BF85712F10856DD106CB3A0DF75A846CBE4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08170848 Relevance: .1, Instructions: 117COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6faf64bdf57d13d18b9eba25e2eadfb760a108938b747b2450be0d629597238e
                                                                        • Instruction ID: 5f279f1acb26116a0bcbb66a4f26770a0d58697a1ccc82fc54758ccf739394a3
                                                                        • Opcode Fuzzy Hash: 6faf64bdf57d13d18b9eba25e2eadfb760a108938b747b2450be0d629597238e
                                                                        • Instruction Fuzzy Hash: 84310931A047459FDB21CB69D840BAA7BF5EF85311F1481BEE405CB691DB35D902C7E0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC2197 Relevance: .1, Instructions: 113COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 92324135e6ca1ac526e70deeb512c453950db3f232c3e4b956fc06776dd3f3f2
                                                                        • Instruction ID: 9c899b78353ece258d942c0ffd212de6986678c0d77a601c5ad3acde3ff185ea
                                                                        • Opcode Fuzzy Hash: 92324135e6ca1ac526e70deeb512c453950db3f232c3e4b956fc06776dd3f3f2
                                                                        • Instruction Fuzzy Hash: B7411BB1900709DFDB14EFA9C89469DFBB1BF88310F15C65DE8497B264EB70A981CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817F438 Relevance: .1, Instructions: 111COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 009b037788bbdc7b76131ee48b12a574326aacbc51c88e21451a6c2569affdc0
                                                                        • Instruction ID: a4894ecc4794d55e5bc4465d330bdf7b869ad61c911e017dd112e7b30c753d1c
                                                                        • Opcode Fuzzy Hash: 009b037788bbdc7b76131ee48b12a574326aacbc51c88e21451a6c2569affdc0
                                                                        • Instruction Fuzzy Hash: 8731A974300A509FCB15EB78D458B2E7BF6AF89612B14866DE00ACB3A1DF34DC06CB95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817AE28 Relevance: .1, Instructions: 103COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 280c986efb8f8d2fa1b5334fc668a237a7fd4782489f288ceb961abccaff93c7
                                                                        • Instruction ID: 1f02e85378b99d0d52426a90b98e872ed5aec34edf9ec6ca6d88fe6ab3aa4f2e
                                                                        • Opcode Fuzzy Hash: 280c986efb8f8d2fa1b5334fc668a237a7fd4782489f288ceb961abccaff93c7
                                                                        • Instruction Fuzzy Hash: 2D313A353003108BD7299A648854B6E77F7BFC5652B24883DE50A87780DF75D882D7A5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817F448 Relevance: .1, Instructions: 102COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 674eae8e1cfa4579e315904f97b77add054431f1ac335a5d572c1ab5aa639a39
                                                                        • Instruction ID: 8235c221c307d4dbfd147646efb4bbc1b9ef3ca4126575d23c8602b9a647be02
                                                                        • Opcode Fuzzy Hash: 674eae8e1cfa4579e315904f97b77add054431f1ac335a5d572c1ab5aa639a39
                                                                        • Instruction Fuzzy Hash: 64317974300A108FCB19EB78D45872E7BF6AF88612B14866CE00AC73A0DF74D802CB95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC2773 Relevance: .1, Instructions: 101COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ea90bfccac55ce2cd8a6136c624d017b085a22096501f4e64bc14864e23c2e7f
                                                                        • Instruction ID: d42abe9a73f7dba7d5e5fb6914b46935b5762e9f15269e46d41f43e5ce27eefe
                                                                        • Opcode Fuzzy Hash: ea90bfccac55ce2cd8a6136c624d017b085a22096501f4e64bc14864e23c2e7f
                                                                        • Instruction Fuzzy Hash: D831A1B6600A119F8725DF69DCC086BBBE6FFC9620315856EE569CB760CB31EC019750
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817C9B4 Relevance: .1, Instructions: 101COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: deb1efc74b935f7d630a78a4eaaae1c0fae0849333764a71169ccaac33b12e99
                                                                        • Instruction ID: 17b4b3ad3f9351456c5c918cc3267a69fa0e5697cfa2b74eb8496e7514c44e53
                                                                        • Opcode Fuzzy Hash: deb1efc74b935f7d630a78a4eaaae1c0fae0849333764a71169ccaac33b12e99
                                                                        • Instruction Fuzzy Hash: 4E3118343006048FDB14DB29C894B6AB3F5BF89A55F1584ADE54ACB365DF31E842CBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCD8CE Relevance: .1, Instructions: 98COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d9d92fb05b9710b77d02c1112c553a0ce164ec49217d185dba4b65ae705d47a6
                                                                        • Instruction ID: 789a4d1296f8538fb65dc2b03bc26eef16271f6c455a451242ee2102e40cb26b
                                                                        • Opcode Fuzzy Hash: d9d92fb05b9710b77d02c1112c553a0ce164ec49217d185dba4b65ae705d47a6
                                                                        • Instruction Fuzzy Hash: F9315A70B092858FC301ABBD9D9925EBFB5FF86314F0546AAD4C5E7292DA384C05C7A2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817DF61 Relevance: .1, Instructions: 96COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c67cb68df470d550c24fb34411bea15f7672c27a76d89e15cd10a930e611bded
                                                                        • Instruction ID: 804db528365cc9edba730b196a27f35cf414ddc86a004912ee8d23134c987593
                                                                        • Opcode Fuzzy Hash: c67cb68df470d550c24fb34411bea15f7672c27a76d89e15cd10a930e611bded
                                                                        • Instruction Fuzzy Hash: C33139343006008FD714DB28C854F6A77F5AF89A15F1584ADE55ACB361DB31E842CBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC19D8 Relevance: .1, Instructions: 95COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e340eb202f7968e221f58a59aef516e30c7cdf55ffbc752e8cd76a6f0d0756f3
                                                                        • Instruction ID: 3be3ae8623b5aed15d0dab1457c0ca303c787aefbb28c6e8876d6f5d3591f925
                                                                        • Opcode Fuzzy Hash: e340eb202f7968e221f58a59aef516e30c7cdf55ffbc752e8cd76a6f0d0756f3
                                                                        • Instruction Fuzzy Hash: C331AF71E007498FDB00EFBAD8905EEBBB4EF89310F14816AD519F7212EB319A41CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081710B1 Relevance: .1, Instructions: 92COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b5bfb773a2142004e1fd7205a4951118709cbdb09f75724324750e311deca913
                                                                        • Instruction ID: a3144ec301044235c22deb0f88d56d49005c8f0a36064576c3a086bdbd1d96ff
                                                                        • Opcode Fuzzy Hash: b5bfb773a2142004e1fd7205a4951118709cbdb09f75724324750e311deca913
                                                                        • Instruction Fuzzy Hash: 38316D347106549FCB05DB38D898CAE7BB6AF8A600715419EE906CB372DB71DD01CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E100 Relevance: .1, Instructions: 86COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 60560461f7c99a8898a192da3afd31469ade79fd32cc398cf6d8e19b07d99afb
                                                                        • Instruction ID: a0f7ce29b43589dcd8fddf71c41359c83e1acd0c2e49f01935b492056c4cb018
                                                                        • Opcode Fuzzy Hash: 60560461f7c99a8898a192da3afd31469ade79fd32cc398cf6d8e19b07d99afb
                                                                        • Instruction Fuzzy Hash: 3A314D30200600CFD765DB28C888BA677F2FF89716F1585ADE09ECB261CF75A886CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E858 Relevance: .1, Instructions: 84COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1c11c53c390c24f27194603c484e54b5ddeecb9ae686c7240cdf3b16549d1f18
                                                                        • Instruction ID: d3b7a15d83fdabeb73d18d549a7040b878f33224046729d98816435c23e64641
                                                                        • Opcode Fuzzy Hash: 1c11c53c390c24f27194603c484e54b5ddeecb9ae686c7240cdf3b16549d1f18
                                                                        • Instruction Fuzzy Hash: 2721A1357002118FAB996B78882823F36E7AFC4D5231940ADD907CB3D0EF25CC4297AA
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817A928 Relevance: .1, Instructions: 83COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1255fb592dda752591c9b3047cbe09f9ee753cfa28197f6daf4ff2f3eb52f361
                                                                        • Instruction ID: 962b3ba7ffc025c6399fbe49f52f2f8d7600464fdbb8af7897230a17b5a0eaa1
                                                                        • Opcode Fuzzy Hash: 1255fb592dda752591c9b3047cbe09f9ee753cfa28197f6daf4ff2f3eb52f361
                                                                        • Instruction Fuzzy Hash: FA215E703002108FDB589A2988A972E77F6FF8966271290ADE506DB3A1EF31CC02C775
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E515 Relevance: .1, Instructions: 79COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 47bf263a02afb7949c5b41c159732f5821a12a92f26189f67a1fe525ffb67929
                                                                        • Instruction ID: f0d38f117bf16c8f6d95564d5415b99e57a23a73a202b4d7bfba67b7780d9fa1
                                                                        • Opcode Fuzzy Hash: 47bf263a02afb7949c5b41c159732f5821a12a92f26189f67a1fe525ffb67929
                                                                        • Instruction Fuzzy Hash: 94310C79B00248CFDB54DF64D994A9DB7F2AF88716F1540ACD802AB360EB71DC86CB64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081707B8 Relevance: .1, Instructions: 79COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5457af1d5ddf55db07a378f5314635d80bebf95be27bde19eaa7a8fcc3b64d94
                                                                        • Instruction ID: c504267d868eacd12cb5edba7929d0e890d298b5a8b9cb7ba054c6f73f44f919
                                                                        • Opcode Fuzzy Hash: 5457af1d5ddf55db07a378f5314635d80bebf95be27bde19eaa7a8fcc3b64d94
                                                                        • Instruction Fuzzy Hash: E621A434700744DFDB25EB69D85092AB3B6AFC9322714C86ED846DB251CB71DC46CFA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E848 Relevance: .1, Instructions: 78COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d9254505040975293306b2ea08850616cc61ec95736489c91cbf6d6f526955ec
                                                                        • Instruction ID: 229289ea1c28901bb85f9a06830d83c0b9664f9ab7b73b324a8971b007e3be88
                                                                        • Opcode Fuzzy Hash: d9254505040975293306b2ea08850616cc61ec95736489c91cbf6d6f526955ec
                                                                        • Instruction Fuzzy Hash: 3A21B1353042108F9B956BB5986963F3AF7AFC5A5231940ADD906C73C0DF25CC06D7B6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817A918 Relevance: .1, Instructions: 78COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 22bcdb928c1d229608048ed117a3242184b7a219387e3090937ae6e82359b807
                                                                        • Instruction ID: c726daa850142a2f3e5bbb7cf6253f0ac8d55b74d774b60904f5eb3311c8a2db
                                                                        • Opcode Fuzzy Hash: 22bcdb928c1d229608048ed117a3242184b7a219387e3090937ae6e82359b807
                                                                        • Instruction Fuzzy Hash: 1D216570304610CFDB189A35C85972D77FAFF8566271790ADE546CB2A1DF21C812C771
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08171080 Relevance: .1, Instructions: 75COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7023652eeca0eb60b028d7a8d758480a2ef13735e56f2a4cd2b4377d84041a01
                                                                        • Instruction ID: 19660e9da9214f0471582a073bf2b4e76dd0594c04e7dc30ef902cce84022417
                                                                        • Opcode Fuzzy Hash: 7023652eeca0eb60b028d7a8d758480a2ef13735e56f2a4cd2b4377d84041a01
                                                                        • Instruction Fuzzy Hash: ED21F3387106149FCB44EF68D988CAD7BF5EF8AA15315819AE516CB372DB71EC01CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC27E7 Relevance: .1, Instructions: 74COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0c5a996c63ea48e5851f7782a20e0b34ec2fc33c5d2cdf83ab52fd1a2fcd133c
                                                                        • Instruction ID: 05b80512ff14f28ffc847a3033aa9b4f32c7d98146cc7adb446e993b2a3c589b
                                                                        • Opcode Fuzzy Hash: 0c5a996c63ea48e5851f7782a20e0b34ec2fc33c5d2cdf83ab52fd1a2fcd133c
                                                                        • Instruction Fuzzy Hash: 8311B1B6600A128F8725EF69DC8096FB7F6FFC9220311862EE129CB760DB30DC029751
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817DB60 Relevance: .1, Instructions: 74COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: cb92d173ee43f628476fde9580ae5a173d7c0af7072d0e179099928d28dcfaef
                                                                        • Instruction ID: d8f1aa08968321588547fec59d54872866cc3855d7515d42c395804e0d1c2a20
                                                                        • Opcode Fuzzy Hash: cb92d173ee43f628476fde9580ae5a173d7c0af7072d0e179099928d28dcfaef
                                                                        • Instruction Fuzzy Hash: F2312A302106048FD7949B28C888BA677F2FF89715F5189ADE05ECB361CF71AC8ACB40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817B7D0 Relevance: .1, Instructions: 74COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 77f54d92fe96e2acc7b8e2cac5e1acbb6f578bb4c7ed46f399e6c5af9b0f4e91
                                                                        • Instruction ID: 1b14a5cb0d848a9ed26a9f7242b05623e277b0b709c7746961377b416800de1c
                                                                        • Opcode Fuzzy Hash: 77f54d92fe96e2acc7b8e2cac5e1acbb6f578bb4c7ed46f399e6c5af9b0f4e91
                                                                        • Instruction Fuzzy Hash: A2213D74B007108FC724EF39D990A2AB7F3AF89216B20457DD5168B3A5DB75EC05CB61
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817098F Relevance: .1, Instructions: 73COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ea39534a857458875b5e30a3a8b8b9714b245893d592afce7eefda0e7d8e009a
                                                                        • Instruction ID: 50a40ebc8424edf592b5f5985c6c65dbf00247507e4d78e69acd8ca29e9e5d77
                                                                        • Opcode Fuzzy Hash: ea39534a857458875b5e30a3a8b8b9714b245893d592afce7eefda0e7d8e009a
                                                                        • Instruction Fuzzy Hash: 70212931300B008BE764AF75886462A73BABFC9345B54496DD912DB794DF62EC42CB21
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08172440 Relevance: .1, Instructions: 73COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b4ee2dde1a76156e7135bf4a52f40c83b0127117ee4e5e6396857471a8a26d40
                                                                        • Instruction ID: 8cf85bcd08efb6196b4d32b8da0a7dac390a885708a4bcaa737f0c3042f8a2ec
                                                                        • Opcode Fuzzy Hash: b4ee2dde1a76156e7135bf4a52f40c83b0127117ee4e5e6396857471a8a26d40
                                                                        • Instruction Fuzzy Hash: 7421E4383006541FD704AB29C4507AB7AEBEFC6B04F14446EE546C7BDACEB5E801A7E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02C4D1D4 Relevance: .1, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1458778148.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2c4d000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 766bc26c15a3bdb1d2869fd877cf5b502bb43cc69682eba12dd96bd8e7048def
                                                                        • Instruction ID: 9ab306a9ec14b78341aecbab8a507bededa57952ea8b2e6e5e7aa18f2233a120
                                                                        • Opcode Fuzzy Hash: 766bc26c15a3bdb1d2869fd877cf5b502bb43cc69682eba12dd96bd8e7048def
                                                                        • Instruction Fuzzy Hash: E4210771604304EFDB15EF10D9C0B16BBA5FB84314F20C6ADED0A4B252C776D846CA61
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02C4D01C Relevance: .1, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1458778148.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2c4d000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5003644c8e2cd1cbe5e3a8d4495ed2920d4801c3a928da1d69c5e087c1eaffa3
                                                                        • Instruction ID: d8c776f35c9136c571e59f09ba9a5c52b2596b8524bc26b09f96258272422220
                                                                        • Opcode Fuzzy Hash: 5003644c8e2cd1cbe5e3a8d4495ed2920d4801c3a928da1d69c5e087c1eaffa3
                                                                        • Instruction Fuzzy Hash: A621F271604344DFDB14EF14D9C4B17BB65EB84314F20C5ADE80A4B286CB7AE847CAA2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081749F0 Relevance: .1, Instructions: 68COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a64ec50e867b45f68f261899d6fc2ed055496a39f68603ff74c4822dc51aedd1
                                                                        • Instruction ID: ad501704318591da5a651b02e89756780ed3278c0dd8ad443c7cf0285384a70a
                                                                        • Opcode Fuzzy Hash: a64ec50e867b45f68f261899d6fc2ed055496a39f68603ff74c4822dc51aedd1
                                                                        • Instruction Fuzzy Hash: 7821E4383043504FE705A724D41039B2BE69F86705F14849ED54ACF7D2CAB65C4697E6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817ABBC Relevance: .1, Instructions: 65COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f14ab0725b95ab6836a3d2a79e594d7b8d1b78b8dc3ad16bc47a196b3b813f8c
                                                                        • Instruction ID: c9d227cd3798b187651d23698071e0723219e0ba99bd22213bec87918d8a8c08
                                                                        • Opcode Fuzzy Hash: f14ab0725b95ab6836a3d2a79e594d7b8d1b78b8dc3ad16bc47a196b3b813f8c
                                                                        • Instruction Fuzzy Hash: 6D119D35704608CFC728EF38D59082AB7B5FF8621671549AEE106DB374DB31D885CB61
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817AE19 Relevance: .1, Instructions: 65COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1bbb14ae2c1f6f65414af078e8a4c661642ac5de9f85412e12411f44461027ef
                                                                        • Instruction ID: 6cb12a67f74ebeb67639550e998824fd554be76946c993561fb65865e0981da0
                                                                        • Opcode Fuzzy Hash: 1bbb14ae2c1f6f65414af078e8a4c661642ac5de9f85412e12411f44461027ef
                                                                        • Instruction Fuzzy Hash: 4A21AF35704350CFDB2A8B249804B6E7BB6FFC5262F25856EE44587680DF35C886C7A5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08172450 Relevance: .1, Instructions: 65COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6275960ebbd30af2f06e243fb5e45a4daf63025e8c66642bf776c2aeeb158356
                                                                        • Instruction ID: 10e5ea30219d939d26ec3429c37a41259046e0a2be5920caa8cf4435917381c4
                                                                        • Opcode Fuzzy Hash: 6275960ebbd30af2f06e243fb5e45a4daf63025e8c66642bf776c2aeeb158356
                                                                        • Instruction Fuzzy Hash: AC118F383001144FEB08AB6AD46076B76EBEFC9B04F10442EE906D7B99CEB5E84167E5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02C4D005 Relevance: .1, Instructions: 62COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1458778148.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2c4d000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: db2ee8eced3c2b8e93cfcc04f08f66d2157ac8ef4e4afc05eba626bc35fe87ee
                                                                        • Instruction ID: 1c0f0eeafefbae0e1522abcb27eb5c1d78e360ac7206129f50f4d26e9cb818b1
                                                                        • Opcode Fuzzy Hash: db2ee8eced3c2b8e93cfcc04f08f66d2157ac8ef4e4afc05eba626bc35fe87ee
                                                                        • Instruction Fuzzy Hash: A42195755093C08FCB06DF24D594715BF71EB46214F28C5DAD8498F2A7C33A980BCBA2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08176FDF Relevance: .1, Instructions: 60COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fa1f95bf1c9a751dbd72505ca66eebe7e95881606b34aa23c7059abe4c4a47f2
                                                                        • Instruction ID: ad1e1dd707b42e43c40d96fcb95f36d5c241e371a4cf3ea573c4ad552a06a11c
                                                                        • Opcode Fuzzy Hash: fa1f95bf1c9a751dbd72505ca66eebe7e95881606b34aa23c7059abe4c4a47f2
                                                                        • Instruction Fuzzy Hash: AF11C1307043408FE725DB64D890B66B3A3AFC6316F24887EE4059B2C0CBB5D8468B90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08176FF0 Relevance: .1, Instructions: 59COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c598b5a0cc9573bd4ec69214539d00415f166aba9257a101a3d145bc1b03acbe
                                                                        • Instruction ID: e6883f18fcec6da02047d02d6040b313ac4f338f94b123b41b12ded0761592ba
                                                                        • Opcode Fuzzy Hash: c598b5a0cc9573bd4ec69214539d00415f166aba9257a101a3d145bc1b03acbe
                                                                        • Instruction Fuzzy Hash: CF1182303003049BE729DA65D890B67B3A7EFC5715F24C87DE40A9B3C4CBB5E8428B90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817306F Relevance: .1, Instructions: 59COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 324ec05035181a542609f23d42a90579a6e24b35403e5fa5b07b94e851f74f78
                                                                        • Instruction ID: 41a3265e39aebe6e26d3214bccba6f3f759774f6f036113b25236131442ccf48
                                                                        • Opcode Fuzzy Hash: 324ec05035181a542609f23d42a90579a6e24b35403e5fa5b07b94e851f74f78
                                                                        • Instruction Fuzzy Hash: DB119A306002499FCB12DFA8D844AAEBBF8BF88600F04842EF925D7321D731CA10DBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC2E4B Relevance: .1, Instructions: 55COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a334589b782aee21bb929f76c88153f36565c2d8cb85c401854decda5e68aa2d
                                                                        • Instruction ID: 2d25700582153782b55bd4a9c1948205f3dcf6a87ce50c184b4d0b4b60388efd
                                                                        • Opcode Fuzzy Hash: a334589b782aee21bb929f76c88153f36565c2d8cb85c401854decda5e68aa2d
                                                                        • Instruction Fuzzy Hash: 9B1103B5E00219AFCB41DFA8D8409EE7BF4FF49210F10815BF958E7211E7309A91DBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02C4D1CF Relevance: .1, Instructions: 53COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1458778148.0000000002C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C4D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2c4d000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: af0032d31c21eee98164703ed9ecbad4511e5bcd2f12e312fdd1ff5dc5c24f5f
                                                                        • Instruction ID: 4e01c8428b1811b9aec51fe913f777542b5e003a907087d0dac73640dfd42c0a
                                                                        • Opcode Fuzzy Hash: af0032d31c21eee98164703ed9ecbad4511e5bcd2f12e312fdd1ff5dc5c24f5f
                                                                        • Instruction Fuzzy Hash: CB11BB75904280DFCB15DF10C5C4B16BBA1FB84214F24C6A9DC4A4B296C33AD84ACB61
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08173080 Relevance: .0, Instructions: 50COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4a72a4a7838e421ba3490c3b04276ff2252316cb68bb2bf4e48c217e0b2bb994
                                                                        • Instruction ID: cb37bb36d74d919df6b7f9e23d2b0d11c8fbb9e217d41d07c78479c98cfbfb8c
                                                                        • Opcode Fuzzy Hash: 4a72a4a7838e421ba3490c3b04276ff2252316cb68bb2bf4e48c217e0b2bb994
                                                                        • Instruction Fuzzy Hash: 6A1161756102199FCB55DF69C884AAE7BF5FF48610F10842DE924D7310DB31DA10DBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817C488 Relevance: .0, Instructions: 49COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: de9d601638fa2036887979043d0d671d50b2b6e7a561c3fff95fde5f04fb3a4d
                                                                        • Instruction ID: 8a424460512c332feda2567bf74003288afdbeefbe30a0f99e3398ae02416a34
                                                                        • Opcode Fuzzy Hash: de9d601638fa2036887979043d0d671d50b2b6e7a561c3fff95fde5f04fb3a4d
                                                                        • Instruction Fuzzy Hash: E7012B213141618BD32096386C449B277B5EBC6A6334582AFE946C7262C321C806C7E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08170731 Relevance: .0, Instructions: 49COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 18cfc50ab3b6c94d670f8af505389c43d0d704b814ed32b7ad55648317ceb572
                                                                        • Instruction ID: 8801a027840cf4f8811f10c39de386d679e741bd96ee859c5dd689e04ca7494e
                                                                        • Opcode Fuzzy Hash: 18cfc50ab3b6c94d670f8af505389c43d0d704b814ed32b7ad55648317ceb572
                                                                        • Instruction Fuzzy Hash: F1015E34200750DFC7159A69D854E2AB7BAEFC9721715C5AEE446CB261CB71DC06CFA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC4ACE Relevance: .0, Instructions: 48COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 303b99aac46c9ad599c4e2859b79f633f9830c046ea7c84b84e7821a6fdbe711
                                                                        • Instruction ID: d43d73857d9e2f6002ac3864ffeb3e01ff45c65815b4695ef3afa14a6e4b6e29
                                                                        • Opcode Fuzzy Hash: 303b99aac46c9ad599c4e2859b79f633f9830c046ea7c84b84e7821a6fdbe711
                                                                        • Instruction Fuzzy Hash: 560192A150E3C59FD303E7709D612987F709F03144B0945DBC589DF1A3D5690E09C7A2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC1A40 Relevance: .0, Instructions: 48COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 170b0568ce3d698a0a9646c257ccf91f50e9d8908551f8bb28462e2d5a8161dc
                                                                        • Instruction ID: 22d501a8dbf54b87ca6c49b456b98e63648111ad595b00474b03900a3b7883db
                                                                        • Opcode Fuzzy Hash: 170b0568ce3d698a0a9646c257ccf91f50e9d8908551f8bb28462e2d5a8161dc
                                                                        • Instruction Fuzzy Hash: 2E11B671D0070A8ECB10EFAAC4805DEFBF4EF49310B15966AD559B7211E731EA81CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817A051 Relevance: .0, Instructions: 48COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9e18b0f55853dc4943c51cf26106ad9316267a33dc190fc0cc178636df1dadb7
                                                                        • Instruction ID: ebf41a63f84f6a51d647088949d0e94614de25c08eb9391a3c8b2d25c346cf80
                                                                        • Opcode Fuzzy Hash: 9e18b0f55853dc4943c51cf26106ad9316267a33dc190fc0cc178636df1dadb7
                                                                        • Instruction Fuzzy Hash: 2311A030200B408FD725DF29E45430B7BF6EB88720F11CB59E0968B6A0DBB0A8068FD6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02C3D7D9 Relevance: .0, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1458679902.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2c3d000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6ac32d2e2f4e83185b2c6dda026d888b3e06215bd45f6aff43bc1fe2aba5d815
                                                                        • Instruction ID: bf0bfc10c8c65cbf20a874f46675efa00d4a58660d10ff0cf7862e7a549a1341
                                                                        • Opcode Fuzzy Hash: 6ac32d2e2f4e83185b2c6dda026d888b3e06215bd45f6aff43bc1fe2aba5d815
                                                                        • Instruction Fuzzy Hash: 0601DB714043449EF7215A16DC84767FB98DF81A24F18C91AED0A5E286C379A881CAF3
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08174752 Relevance: .0, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 755ad96ab13fa2fb1b5aab0a0be8c4b759837a55d8d7a898ec45ca81c2e57226
                                                                        • Instruction ID: 73d4a132409fdb66aa7032d7ef9f870efbf148139ce2b34708d1a404021e3b98
                                                                        • Opcode Fuzzy Hash: 755ad96ab13fa2fb1b5aab0a0be8c4b759837a55d8d7a898ec45ca81c2e57226
                                                                        • Instruction Fuzzy Hash: BC01F4343166518FC7189B79C884D7A3BBA9FC6A16306009EE552CB2A1CB24CC41C7B4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081707C8 Relevance: .0, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3ea79ae57df8ba7706bd7b2965d6a58cc5375d231759e74f2ed8f26ff358e037
                                                                        • Instruction ID: 77c10d39766a73161392d133bfaf57d3f80d370e43cbc9c8695772521d391f79
                                                                        • Opcode Fuzzy Hash: 3ea79ae57df8ba7706bd7b2965d6a58cc5375d231759e74f2ed8f26ff358e037
                                                                        • Instruction Fuzzy Hash: A4018B307007188BE714A629D450A2B73E6AFC9721714C46DD807D7351DF75DC42CBE5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081720E4 Relevance: .0, Instructions: 44COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c3a8c636e0a8e7adc833c316335000fac2a055dfaddb67e0b937dce13d86b27f
                                                                        • Instruction ID: 153315077f92b14e819c0c43ad6af6feeece734a8a6d68e4b1da38c46c774c81
                                                                        • Opcode Fuzzy Hash: c3a8c636e0a8e7adc833c316335000fac2a055dfaddb67e0b937dce13d86b27f
                                                                        • Instruction Fuzzy Hash: 3EF090343511218B9718DA7ED894E3E37FA9FC6A22306446DE916C7360DF21DC82D6A9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08171A20 Relevance: .0, Instructions: 43COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e01ce883276e17f09cccbe66b88b2c8812ea8acddb563fda6b7702d19a655840
                                                                        • Instruction ID: c33a654e71e1c002ad24d66d264a3acd3d94fcc9eadd70da70b5dbae26ff6918
                                                                        • Opcode Fuzzy Hash: e01ce883276e17f09cccbe66b88b2c8812ea8acddb563fda6b7702d19a655840
                                                                        • Instruction Fuzzy Hash: 53018F74E58299EFCB24DBA5D981EEEBBF5AF09212F04409AF945F7391D73098008B50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817A060 Relevance: .0, Instructions: 43COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 70849d6da77bef6c842ba49d6c284e95b00fd41170a8ecefe2718f9b43b8596e
                                                                        • Instruction ID: f97b934d9071ce121cd9252d365fc42a12e9cbd9a1f7628efb55d4b08cb34da3
                                                                        • Opcode Fuzzy Hash: 70849d6da77bef6c842ba49d6c284e95b00fd41170a8ecefe2718f9b43b8596e
                                                                        • Instruction Fuzzy Hash: 75015E70200B048FD724EF69E45470B7BF6EB88721F11DB2CE156876A4DBB0A8068FD5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817DAB7 Relevance: .0, Instructions: 42COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b9eb45425a84c6b452db236ecb7285cc848c6a5e472bc1d57dd558f85721176e
                                                                        • Instruction ID: e37ce6f7d08062d27ed399962b21b28bb6cfb1e91501caa57d92c0acdd482cb2
                                                                        • Opcode Fuzzy Hash: b9eb45425a84c6b452db236ecb7285cc848c6a5e472bc1d57dd558f85721176e
                                                                        • Instruction Fuzzy Hash: 82016D76304614CFC729DF39E540869B7B5BF8621671949AEE105CB365DB32D881CB21
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081744D2 Relevance: .0, Instructions: 41COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bbb20d2fd2d0a45d00fece51768decd072b2e7124f07138fba550b4df40ff7b3
                                                                        • Instruction ID: 40bfd344d247624547f64a9aa1da3ac86df1932dbe01f7da3466ec1ae91b6af0
                                                                        • Opcode Fuzzy Hash: bbb20d2fd2d0a45d00fece51768decd072b2e7124f07138fba550b4df40ff7b3
                                                                        • Instruction Fuzzy Hash: 85F096253055909FDB2AA774A42557D3B779FC6A13708006DE107CB2A1CF148942C3EA
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08170740 Relevance: .0, Instructions: 41COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fc418f38094612925f67a60df57c4bcb2cee313d1b34526106866bc72aedc5e0
                                                                        • Instruction ID: be2765ad4fc67e79887877e137b9ad93878f031c8152741154e3e09430bd3a07
                                                                        • Opcode Fuzzy Hash: fc418f38094612925f67a60df57c4bcb2cee313d1b34526106866bc72aedc5e0
                                                                        • Instruction Fuzzy Hash: CA014B30210704CFC714EA69D450A16B3FAAF89322B54C56ED44AC7261CB71EC02CFA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08172F5F Relevance: .0, Instructions: 40COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3f831ac18bfe17a4103ae9165d58991cba30794ac5aabcfddb9f48901457937a
                                                                        • Instruction ID: 800aa60c37522fbd6f4d56a7205d5f7372dbc70673beb8ff32553f67ba1fb26d
                                                                        • Opcode Fuzzy Hash: 3f831ac18bfe17a4103ae9165d58991cba30794ac5aabcfddb9f48901457937a
                                                                        • Instruction Fuzzy Hash: CFF0F6393047509FC705EB39D460EAA77B9EF86612715059EF482C7766C760DC4AC770
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817DB80 Relevance: .0, Instructions: 39COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: dc8f0f578860d9cc91f89c4b47e5a3916be3e47c004456e941f7181342e75771
                                                                        • Instruction ID: 63febaee5df7cd7aea3ca4ddfbb2a81045e873bd674fba42cbb0570479f2c691
                                                                        • Opcode Fuzzy Hash: dc8f0f578860d9cc91f89c4b47e5a3916be3e47c004456e941f7181342e75771
                                                                        • Instruction Fuzzy Hash: B8F090347002158BE7249629889472F33E6AFC5E52F5548ADD206DB360EFB0AC8193A9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E7D0 Relevance: .0, Instructions: 39COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3f2e87e2b8367d43e25c5ccddedaade001353a4eb2033f0634725318a45d2aae
                                                                        • Instruction ID: e93b9cee77521044daf82fb77b676a064afad96a40de928382a68cfbab155f9e
                                                                        • Opcode Fuzzy Hash: 3f2e87e2b8367d43e25c5ccddedaade001353a4eb2033f0634725318a45d2aae
                                                                        • Instruction Fuzzy Hash: 06F0F0343053418FE721D628C814BAB3BF6AFC2A52F4A00EEE149CB260DB719C46D7A5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CCC871 Relevance: .0, Instructions: 38COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: aecb20fb9d634784d433c146fb35d00727d94c5591ddec2e67006add9ac04a66
                                                                        • Instruction ID: 26d8f8b9279375d8ce10d07b7cbf0e80e822d913ca551dfb79b3d6f4be7e9422
                                                                        • Opcode Fuzzy Hash: aecb20fb9d634784d433c146fb35d00727d94c5591ddec2e67006add9ac04a66
                                                                        • Instruction Fuzzy Hash: E0F0A9B4129389CFE326BF70DC2852A7F74EF82701B4890AAE405CA192CE3A9445CF61
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08171FA4 Relevance: .0, Instructions: 37COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 883788039fa29489d71fcd65e7c610eb6e8efe75a143b9c11bbb7b68188f5b60
                                                                        • Instruction ID: 31a4331e5a9394a0944ce38ed477404a50a408cde99e010cccb85e5201b5fbf8
                                                                        • Opcode Fuzzy Hash: 883788039fa29489d71fcd65e7c610eb6e8efe75a143b9c11bbb7b68188f5b60
                                                                        • Instruction Fuzzy Hash: EFF0B4353046149FC704EA29C850E6AB3F9FFC5612711445EF402C7768CBB1EC86C760
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 02C3D7D8 Relevance: .0, Instructions: 36COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1458679902.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_2c3d000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 16f11b5249b3f9cefffb5e0e30c517bc24533fbd9ec65b0add6c5f388cf471f9
                                                                        • Instruction ID: 01a1eebb30b2df9030da9ca5d8c5ba26a738a8f7a5474a43310f51c2f9f2f1ba
                                                                        • Opcode Fuzzy Hash: 16f11b5249b3f9cefffb5e0e30c517bc24533fbd9ec65b0add6c5f388cf471f9
                                                                        • Instruction Fuzzy Hash: 1AF062724053449EE7218A16DC84B62FFA8EF81624F18C55AED095A286C379A845CEB1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817E3F9 Relevance: .0, Instructions: 33COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0f03403b61a365922693e999ecafde1bd17a7a8f9b99c6a34886273a0c795cdf
                                                                        • Instruction ID: 107858bcc25afbeddf042be98b92b2b2f7be1a9325dd3b486ac772bef1ab433f
                                                                        • Opcode Fuzzy Hash: 0f03403b61a365922693e999ecafde1bd17a7a8f9b99c6a34886273a0c795cdf
                                                                        • Instruction Fuzzy Hash: 7B01A479600104CFCB14DF68D48499CBBF1EF48726F2541A9E916AB3A1C732DD81CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08170858 Relevance: .0, Instructions: 31COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7ef466020ffec7c8e3906ed55fea567128d5982f66d329a11044e65cc8350ea3
                                                                        • Instruction ID: 67b989b3e3c065e91c76c212110c1eb9a68cc34aedc970fa1a951a725d473c13
                                                                        • Opcode Fuzzy Hash: 7ef466020ffec7c8e3906ed55fea567128d5982f66d329a11044e65cc8350ea3
                                                                        • Instruction Fuzzy Hash: 2BF03A72D102098FDB90DFA8C8467BCBBF0EB04301F0485BAE418D7651EA389A458B80
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08170480 Relevance: .0, Instructions: 30COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5d75d1e1727b0ed0adaa0d258562db8355732240791c568045792201bde636de
                                                                        • Instruction ID: b3e26201bfb0e95834fce5f8bc492691ebc7b17d073da5f041dfa90c05277a83
                                                                        • Opcode Fuzzy Hash: 5d75d1e1727b0ed0adaa0d258562db8355732240791c568045792201bde636de
                                                                        • Instruction Fuzzy Hash: FAF0A73644D3C46FC7035B619C10C9A7F38EF53314B1640DFE1448E4A3E2278906CBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC4B48 Relevance: .0, Instructions: 27COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 37324262ea4d348daca744c6ab6295841ff79e5fedf33357532ae0c09dfa0a3f
                                                                        • Instruction ID: e252498c631271401ba36c2f06c594c3824773e910b4843a1667049ec9b06bcd
                                                                        • Opcode Fuzzy Hash: 37324262ea4d348daca744c6ab6295841ff79e5fedf33357532ae0c09dfa0a3f
                                                                        • Instruction Fuzzy Hash: 93E0DF383102585FE3086A76A851B2E7E67ABD1761F04C829E8078B340DEB5CC025BD1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC19C8 Relevance: .0, Instructions: 27COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b822de12b97e54290dc3ebca3718ed919e4cdcbd2b0d41eb55b9123cdd55a709
                                                                        • Instruction ID: e9e024b0187b8a94a0e670522fc5f552c74e8ee43ebb98bbecb72e32cfe49bc4
                                                                        • Opcode Fuzzy Hash: b822de12b97e54290dc3ebca3718ed919e4cdcbd2b0d41eb55b9123cdd55a709
                                                                        • Instruction Fuzzy Hash: C6E086B37451146FD2149656A992FBB7B4E8BD9662F09402FE606C6581C855480242E5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081732B0 Relevance: .0, Instructions: 27COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f39e13dae97df490926a826ed15202cab375bbdb7a0995c70e344a7871ba1407
                                                                        • Instruction ID: b46414038d90baa6940f23a8b52b16d4ca520c0b10bfa0e4041358cda2bdfc45
                                                                        • Opcode Fuzzy Hash: f39e13dae97df490926a826ed15202cab375bbdb7a0995c70e344a7871ba1407
                                                                        • Instruction Fuzzy Hash: 1BE06D37650528878700DB88F4824BABBB9E74866A318815AF91C8A710E723D842CBE0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC2E00 Relevance: .0, Instructions: 24COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2e61c8738b471f89e06995d351e78755fda543f4fcbc201bb940407b18c44c8c
                                                                        • Instruction ID: bbb527332cbc179879d57c8fe02b7d0daafb26da1705cf58f8c33b7b830b174b
                                                                        • Opcode Fuzzy Hash: 2e61c8738b471f89e06995d351e78755fda543f4fcbc201bb940407b18c44c8c
                                                                        • Instruction Fuzzy Hash: 73E0D832B00608668701BAADD44089AB7A9DFCA210B00C21FF50C97221EE30988193D1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08179EC8 Relevance: .0, Instructions: 23COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 34178cac4672bbf292d3a96dd3434ce71e61ba591d797c8429968a026c335c69
                                                                        • Instruction ID: ca9e2cf6527259362e934acaf93e770e7683ee8175e808d866df55d4e4d45a34
                                                                        • Opcode Fuzzy Hash: 34178cac4672bbf292d3a96dd3434ce71e61ba591d797c8429968a026c335c69
                                                                        • Instruction Fuzzy Hash: 9FE086353093904BD74613B8A52977F7FE79BC6312B0A00AFE44AC7292CD690D0697EE
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08175674 Relevance: .0, Instructions: 23COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3f568e392f04df84c1a3ae6631884e5c75fe18b32e6f8422e654e349a7500947
                                                                        • Instruction ID: 7d667f6623f513e9b9ecd2a0697bdeadb4f574c6bd50e2c058ca3d1142928b16
                                                                        • Opcode Fuzzy Hash: 3f568e392f04df84c1a3ae6631884e5c75fe18b32e6f8422e654e349a7500947
                                                                        • Instruction Fuzzy Hash: 16E02631200104CFC700EA18C898BD833B8EF8B305F0989BBF909EB314C336B8828B80
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08178E58 Relevance: .0, Instructions: 20COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 129560eb3772e23536afa020a250991abc2c8bdc0eb76b8122da384f69842751
                                                                        • Instruction ID: ed73e0829d019e4ab008397b40bcae4f1503e8fde0d67d8d6528475fcc15e1c0
                                                                        • Opcode Fuzzy Hash: 129560eb3772e23536afa020a250991abc2c8bdc0eb76b8122da384f69842751
                                                                        • Instruction Fuzzy Hash: C3D05E323601248FC3109BB8F84CE927BECDF48A65B1544BAF20CCB221DB62D81087D0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08179ED8 Relevance: .0, Instructions: 20COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e1557a6d37f793d4528f61471311982a241f69a17a15fdf5da8f15e0c888a971
                                                                        • Instruction ID: 508815b7ee2eee7af1a58319199ef8793f663c4f1998a7714977d9aec1bc1903
                                                                        • Opcode Fuzzy Hash: e1557a6d37f793d4528f61471311982a241f69a17a15fdf5da8f15e0c888a971
                                                                        • Instruction Fuzzy Hash: BAD0A73530022447C644239EB42977FBADFEBD9721B06402AF50BC3380DEA54C0252EE
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08174A00 Relevance: .0, Instructions: 18COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e0f58eb6bc906ada030fac7657c7a52861ab7efa92d50b952fc7abf026672baf
                                                                        • Instruction ID: cbade734c76bd4e2e4bf02cd3e99dfed3fccf05504b0d355b52f0833eb5fc82a
                                                                        • Opcode Fuzzy Hash: e0f58eb6bc906ada030fac7657c7a52861ab7efa92d50b952fc7abf026672baf
                                                                        • Instruction Fuzzy Hash: 32D05E393442140BC7096649941079B76EA8FC9651F04806EE50E8B790CAB19C0143D5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC4B10 Relevance: .0, Instructions: 17COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f261cf45e32187ff5308537b16c9f5c8c61f95ae9028eb932cb136d2ab4377d9
                                                                        • Instruction ID: 61d64324e251e9bd3459ce6a3d6c7ff422e1df5cec8f5eb4765d2283fc8eb9bb
                                                                        • Opcode Fuzzy Hash: f261cf45e32187ff5308537b16c9f5c8c61f95ae9028eb932cb136d2ab4377d9
                                                                        • Instruction Fuzzy Hash: 5ED05BB0A1420CEFCB04FFF4E99155DBFBADB46244B1085A9D809D7310DA311F059F91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081744E0 Relevance: .0, Instructions: 17COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1ac52e60b498d53010b1f174b5c74a44f14cb88ed19f89aa50f9a3b136165c7e
                                                                        • Instruction ID: 5b2180fd01875f386da5a138bb7474c9092d5d368adf439f7be6b7ca7a36d55b
                                                                        • Opcode Fuzzy Hash: 1ac52e60b498d53010b1f174b5c74a44f14cb88ed19f89aa50f9a3b136165c7e
                                                                        • Instruction Fuzzy Hash: E1D0122A715974138D2E3268743627C756E5F85912748007EE10B8B390DF995D5383EE
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08170D1E Relevance: .0, Instructions: 15COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: da724fb74f73d4d21daa5848e75fd47e795d96e7a692b5eadf8baafd13c2ae0e
                                                                        • Instruction ID: d33b47505fa475d28c03a7e6e510ad0bc91459028f94f2bd3062ee68ebc1c3ab
                                                                        • Opcode Fuzzy Hash: da724fb74f73d4d21daa5848e75fd47e795d96e7a692b5eadf8baafd13c2ae0e
                                                                        • Instruction Fuzzy Hash: B6E0BD7464070ACFD708DF64C598AADB7B1AF48305F2644A8E802AB261CB76A981DB60
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0817CF6B Relevance: .0, Instructions: 15COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4b177ff72cdad9d5f21309ed20a3112b310cc8d105c4b20149cf61e0ceb1d633
                                                                        • Instruction ID: d5f3a45a1f8af967f072dd08e0ca0a8d2fd138696bc21c131fc9fbffad9536ca
                                                                        • Opcode Fuzzy Hash: 4b177ff72cdad9d5f21309ed20a3112b310cc8d105c4b20149cf61e0ceb1d633
                                                                        • Instruction Fuzzy Hash: 1CE0127990020B8FDB14DF98C9917EEB771AF48315F200919C001BA2D0CF7848418BE4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 081704B0 Relevance: .0, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0456d1c2b97c1c3010fe19af50d70e0c5ffa3809d7545eff06416e2729e67187
                                                                        • Instruction ID: 0b71045e231297dc5c33dff4e7b9d1db013af59865ec48beb7eb15030a9c68c4
                                                                        • Opcode Fuzzy Hash: 0456d1c2b97c1c3010fe19af50d70e0c5ffa3809d7545eff06416e2729e67187
                                                                        • Instruction Fuzzy Hash: D9C08C32000208BBCB82BE80CC40E0EBF2ABB44390F108004F7140D021E373D523EBD0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07CC4283 Relevance: .0, Instructions: 9COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1467574184.0000000007CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CC0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_7cc0000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c1ba902d1d5824214097a7021971c8021057a1b4e24cab97ede99f203aad02f0
                                                                        • Instruction ID: 9b269b7579fd121f8f737d87ed6f845f4f42aa730fd471086bf6967a0aa6d0cb
                                                                        • Opcode Fuzzy Hash: c1ba902d1d5824214097a7021971c8021057a1b4e24cab97ede99f203aad02f0
                                                                        • Instruction Fuzzy Hash: E5B092363401048FC6452A78A108068B7A2EAC427631480BAE50DCA610C93688428700
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 08170D46 Relevance: .0, Instructions: 8COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 0000000A.00000002.1468184766.0000000008170000.00000040.00000800.00020000.00000000.sdmp, Offset: 08170000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_10_2_8170000_ghedgegehe.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5cf48c25f71693af44a8ff1c5a1eb3779913366f0844b24cb1ecffdc819f2cb9
                                                                        • Instruction ID: 3b71094c42ccdc394ece918e7c370f49376aea55ff70fd81d70eb081cc356f6e
                                                                        • Opcode Fuzzy Hash: 5cf48c25f71693af44a8ff1c5a1eb3779913366f0844b24cb1ecffdc819f2cb9
                                                                        • Instruction Fuzzy Hash: C7B09234A04214CFC708DB34C86485873A2BF8D2913698CA8C402DB224CA759881EB20
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Execution Graph

                                                                        Execution Coverage:17.9%
                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                        Signature Coverage:2.1%
                                                                        Total number of Nodes:140
                                                                        Total number of Limit Nodes:9
                                                                        execution_graph 55705 7950f10 55706 795109b 55705->55706 55707 7950f36 55705->55707 55707->55706 55710 79511e2 PostMessageW 55707->55710 55712 79511e8 PostMessageW 55707->55712 55711 7951295 55710->55711 55711->55707 55713 7951295 55712->55713 55713->55707 55849 753fbb8 55850 753fbfc VirtualAllocEx 55849->55850 55852 753fc74 55850->55852 55853 79534f8 FindCloseChangeNotification 55854 795357d 55853->55854 55855 797fa78 55856 797fac1 Wow64GetThreadContext 55855->55856 55858 797fb39 55856->55858 55714 753cb40 55715 753cb54 55714->55715 55725 753cb90 55715->55725 55726 7974537 55715->55726 55730 79744a8 55715->55730 55734 7974caa 55715->55734 55738 7974dca 55715->55738 55745 79743db 55715->55745 55749 797507b 55715->55749 55753 79754fc 55715->55753 55758 7974e0d 55715->55758 55763 7974464 55715->55763 55769 7976990 55726->55769 55772 7976998 55726->55772 55727 797454b 55731 7974465 55730->55731 55731->55730 55732 7976990 VirtualProtect 55731->55732 55733 7976998 VirtualProtect 55731->55733 55732->55731 55733->55731 55736 7976990 VirtualProtect 55734->55736 55737 7976998 VirtualProtect 55734->55737 55735 7974cbb 55736->55735 55737->55735 55739 7974dcb 55738->55739 55741 7976990 VirtualProtect 55738->55741 55742 7976998 VirtualProtect 55738->55742 55740 7974e11 55739->55740 55743 7976990 VirtualProtect 55739->55743 55744 7976998 VirtualProtect 55739->55744 55741->55739 55742->55739 55743->55739 55744->55739 55747 7976990 VirtualProtect 55745->55747 55748 7976998 VirtualProtect 55745->55748 55746 797433f 55746->55715 55747->55746 55748->55746 55751 7976990 VirtualProtect 55749->55751 55752 7976998 VirtualProtect 55749->55752 55750 797508e 55751->55750 55752->55750 55754 7975505 55753->55754 55756 7976990 VirtualProtect 55754->55756 55757 7976998 VirtualProtect 55754->55757 55755 7975517 55756->55755 55757->55755 55759 7974dcb 55758->55759 55760 7974e11 55758->55760 55759->55758 55761 7976990 VirtualProtect 55759->55761 55762 7976998 VirtualProtect 55759->55762 55761->55759 55762->55759 55764 7974465 55763->55764 55767 7976990 VirtualProtect 55763->55767 55768 7976998 VirtualProtect 55763->55768 55765 7976990 VirtualProtect 55764->55765 55766 7976998 VirtualProtect 55764->55766 55765->55764 55766->55764 55767->55764 55768->55764 55770 79769e5 VirtualProtect 55769->55770 55771 7976a51 55770->55771 55771->55727 55773 79769e5 VirtualProtect 55772->55773 55774 7976a51 55773->55774 55774->55727 55775 7950040 55776 795008c WriteProcessMemory 55775->55776 55778 7950125 55776->55778 55859 79505a0 55860 79505e9 VirtualProtectEx 55859->55860 55862 7950661 55860->55862 55863 7950b60 55864 7950ba4 ResumeThread 55863->55864 55866 7950bf0 55864->55866 55867 7978660 55869 7978687 55867->55869 55868 79787f6 55869->55868 55871 79791fa 55869->55871 55872 797923b 55871->55872 55873 797966c 55872->55873 55875 797bbe0 55872->55875 55873->55869 55877 797bc07 55875->55877 55876 797bccb 55876->55872 55877->55876 55879 797dec0 55877->55879 55880 797df41 CreateProcessAsUserW 55879->55880 55882 797e0c2 55880->55882 55779 cb0cd0 55780 cb0cf2 55779->55780 55783 cb1915 55780->55783 55781 cb0e7b 55784 cb18e9 55783->55784 55786 cb1927 55783->55786 55784->55781 55785 cb1ac4 55785->55781 55789 cb1f38 55786->55789 55793 cb1f27 55786->55793 55790 cb1f5c 55789->55790 55797 cb24f8 55790->55797 55791 cb1f88 55791->55785 55794 cb1f5c 55793->55794 55796 cb24f8 InternetGetConnectedState 55794->55796 55795 cb1f88 55795->55785 55796->55795 55798 cb2502 55797->55798 55799 cb2554 55797->55799 55802 cb2658 55798->55802 55806 cb2657 55798->55806 55799->55791 55803 cb266f 55802->55803 55810 cb22f8 55803->55810 55807 cb266f 55806->55807 55808 cb22f8 InternetGetConnectedState 55807->55808 55809 cb268b 55808->55809 55809->55799 55811 cb26b0 InternetGetConnectedState 55810->55811 55813 cb268b 55811->55813 55813->55799 55883 753db28 55884 753db75 VirtualProtect 55883->55884 55885 753dbe1 55884->55885 55814 7950888 55815 79508d1 Wow64SetThreadContext 55814->55815 55817 7950949 55815->55817 55818 7a659b8 55819 7a659ea 55818->55819 55824 7a6c7f0 55819->55824 55828 7a6c789 55819->55828 55833 7a6c7df 55819->55833 55820 7a6b089 55825 7a6c821 55824->55825 55837 7a6ca78 55825->55837 55827 7a6c8d9 55827->55820 55829 7a6c7a0 55828->55829 55830 7a6c80a 55828->55830 55829->55820 55832 7a6ca78 DeleteFileW 55830->55832 55831 7a6c8d9 55831->55820 55832->55831 55834 7a6c7f0 55833->55834 55836 7a6ca78 DeleteFileW 55834->55836 55835 7a6c8d9 55835->55820 55836->55835 55838 7a6ca8c 55837->55838 55841 7a6ce18 55838->55841 55842 7a6ce3b 55841->55842 55845 7a6d2b8 55842->55845 55847 7a6d302 DeleteFileW 55845->55847 55848 7a6cd82 55847->55848 55848->55827

                                                                        Executed Functions

                                                                        Function 07AA4D98 Relevance: 5.6, Instructions: 5633COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 1094 7aa4d98-7aa4fc7 1122 7aa701c-7aa7302 1094->1122 1123 7aa4fcd-7aa586b 1094->1123 1198 7aa82bb-7aa9336 1122->1198 1199 7aa7308-7aa82b3 1122->1199 1383 7aa5873-7aa5d12 1123->1383 1789 7aa933c-7aa9675 1198->1789 1790 7aa967d-7aa9690 1198->1790 1199->1198 1533 7aa5d18-7aa5ff6 1383->1533 1534 7aa5ffe-7aa7014 1383->1534 1533->1534 1534->1122 1789->1790 1794 7aa9d3d-7aaac16 1790->1794 1795 7aa9696-7aa9d35 1790->1795 2178 7aaac16 call 7aac880 1794->2178 2179 7aaac16 call 7aac871 1794->2179 1795->1794 2177 7aaac1c-7aaac23 2178->2177 2179->2177
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2540674420.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7aa0000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0346ce7ab41d7571a87ce4b4dfc91da0180a1b41feb43c28ab374e4ec96f7c5c
                                                                        • Instruction ID: 16dd488a971ff536e9a118a6f1284c720f8cfc0196fcb9d213c8afe6cbc75bd4
                                                                        • Opcode Fuzzy Hash: 0346ce7ab41d7571a87ce4b4dfc91da0180a1b41feb43c28ab374e4ec96f7c5c
                                                                        • Instruction Fuzzy Hash: A6C3EAB0A02218CFCB58FF78D99966DBBB2BB89300F4085E9D449A7354DB349E85CF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0797DEC0 Relevance: 1.7, APIs: 1, Instructions: 247processCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 4407 797dec0-797df5b 4409 797df72-797df7d 4407->4409 4410 797df5d-797df6f 4407->4410 4411 797df91-797dfcd 4409->4411 4412 797df7f-797df8e 4409->4412 4410->4409 4413 797dfe1-797e0c0 CreateProcessAsUserW 4411->4413 4414 797dfcf-797dfde 4411->4414 4412->4411 4418 797e0c2-797e0c8 4413->4418 4419 797e0c9-797e195 4413->4419 4414->4413 4418->4419 4428 797e197-797e1c0 4419->4428 4429 797e1cb-797e1d6 4419->4429 4428->4429
                                                                        APIs
                                                                        • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0797E0AD
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2539795551.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7970000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID: CreateProcessUser
                                                                        • String ID:
                                                                        • API String ID: 2217836671-0
                                                                        • Opcode ID: 6297d8dc00660d1e60248651a96afb0fe26be2e7ef66ab4d936d55a44309dac9
                                                                        • Instruction ID: aad20d5e08af0695572c6cab89842760686ecbd35105a0e3a741ae5d249c1a8c
                                                                        • Opcode Fuzzy Hash: 6297d8dc00660d1e60248651a96afb0fe26be2e7ef66ab4d936d55a44309dac9
                                                                        • Instruction Fuzzy Hash: 2491C0B4D0022D9FDB25CFA4C884BDEBBF5AF49304F1490AAE548B7220DB749A85CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07AA21A8 Relevance: .3, Instructions: 278COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2540674420.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7aa0000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3fcbdc14fc8546941f33d274439c952c1f81adab2a9f7d8d0e76822fa579d9ab
                                                                        • Instruction ID: e85993eb0335d9a68d0c956b345424dbcef36bab9f4688b67fa477980cd572e9
                                                                        • Opcode Fuzzy Hash: 3fcbdc14fc8546941f33d274439c952c1f81adab2a9f7d8d0e76822fa579d9ab
                                                                        • Instruction Fuzzy Hash: 25B138B0E003099FDB14DFA9C89469DBBF1FF89300F24856AE815BB3A1DB31A945CB55
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07976990 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • VirtualProtect.KERNEL32(?,?,?,?), ref: 07976A3F
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2539795551.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7970000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID: ProtectVirtual
                                                                        • String ID:
                                                                        • API String ID: 544645111-0
                                                                        • Opcode ID: 55957d5f3d63a9f590928b5fdab7eac2071e8d2473a1c8b0956f0066b57665dd
                                                                        • Instruction ID: 6103b668e5b271f2edb0fee32f5fdad6836a488b338820fdc5d8a33d36977813
                                                                        • Opcode Fuzzy Hash: 55957d5f3d63a9f590928b5fdab7eac2071e8d2473a1c8b0956f0066b57665dd
                                                                        • Instruction Fuzzy Hash: A73189B9D01258DFCB14CFA9E484ADEFBF0AF09310F24A02AE814B7210D375A945CF64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07976998 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • VirtualProtect.KERNEL32(?,?,?,?), ref: 07976A3F
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2539795551.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7970000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID: ProtectVirtual
                                                                        • String ID:
                                                                        • API String ID: 544645111-0
                                                                        • Opcode ID: 0197f7017e91d4506714adfe54c19c0ebb2af2fb7ec45f6bc593df99dda029df
                                                                        • Instruction ID: 9596db04637dfe82b4f8067130c9a5d795296f01c4463a881d9a408385aaf37c
                                                                        • Opcode Fuzzy Hash: 0197f7017e91d4506714adfe54c19c0ebb2af2fb7ec45f6bc593df99dda029df
                                                                        • Instruction Fuzzy Hash: 343199B9D01258DFCB14CFA9D884ADEFBF4BB09310F24A02AE814B7210D775A945CF64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0797FA78 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • Wow64GetThreadContext.KERNEL32(?,?), ref: 0797FB27
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2539795551.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7970000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID: ContextThreadWow64
                                                                        • String ID:
                                                                        • API String ID: 983334009-0
                                                                        • Opcode ID: 91d103fad2cc69cbfb27399751838d57b0ecad3712008a1a207b2382c23624f8
                                                                        • Instruction ID: c7b7e9eedffc4d4ed41db1ba7c2f712e2489d3c609c85e09be82ca315aa076f2
                                                                        • Opcode Fuzzy Hash: 91d103fad2cc69cbfb27399751838d57b0ecad3712008a1a207b2382c23624f8
                                                                        • Instruction Fuzzy Hash: DA31DBB4D01258DFDB10CFAAD884AEEFBF1BB49310F24802AE418B7240D778A946CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07A6D2B8 Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2540418285.0000000007A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A60000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7a60000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID: DeleteFile
                                                                        • String ID:
                                                                        • API String ID: 4033686569-0
                                                                        • Opcode ID: 08692f4bf414d87992e1239f48b16a60bd7e802cf1297f5b6200a3f913ad7fd0
                                                                        • Instruction ID: a79242f7015a4763afeff8f5f77b08b70a0e77c253d709c5e5ffd52dbe7bede9
                                                                        • Opcode Fuzzy Hash: 08692f4bf414d87992e1239f48b16a60bd7e802cf1297f5b6200a3f913ad7fd0
                                                                        • Instruction Fuzzy Hash: 2731BCB4E01259DFCB14CFA9D984AEEFBF5BB49310F14906AE414B7210D374A945CB54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00CB22F8 Relevance: 1.6, APIs: 1, Instructions: 83networkCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • InternetGetConnectedState.WININET(?,?), ref: 00CB2741
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2514516147.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_cb0000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID: ConnectedInternetState
                                                                        • String ID:
                                                                        • API String ID: 97057780-0
                                                                        • Opcode ID: 837f384e19ee939487770a31421f91d84e895676970601da7f8ecbfb4235f6ac
                                                                        • Instruction ID: ae66ff4f38c0b68b9c21f0bbf4a9297dad5b2e2843e4d0ef2dd2fc9115951c84
                                                                        • Opcode Fuzzy Hash: 837f384e19ee939487770a31421f91d84e895676970601da7f8ecbfb4235f6ac
                                                                        • Instruction Fuzzy Hash: 643178B9D052189FCB10CFAAD884ADEFBB5BB09310F14906AE814B7310D775A945CBA8
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00CB26A8 Relevance: 1.6, APIs: 1, Instructions: 82networkCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • InternetGetConnectedState.WININET(?,?), ref: 00CB2741
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2514516147.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_cb0000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID: ConnectedInternetState
                                                                        • String ID:
                                                                        • API String ID: 97057780-0
                                                                        • Opcode ID: 23ddaf7ac5f80989f0e7a971fa7b41ea549986af330bb7420bb0cf932d43e70f
                                                                        • Instruction ID: e3528b4b5b459b7ffc9e2da5a0feed10feba3d3ac44e7e22a3b5ccb44e7a293d
                                                                        • Opcode Fuzzy Hash: 23ddaf7ac5f80989f0e7a971fa7b41ea549986af330bb7420bb0cf932d43e70f
                                                                        • Instruction Fuzzy Hash: CB319AB9D05258DFCB10CFA9D884ADEFBF0BB49310F24902AE454B7350C375A945CB64
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07AAE980 Relevance: .4, Instructions: 427COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2540674420.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7aa0000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e3817b525925900c12b7d68306cad500d1e6efbd9f58bb5d63d5f3d50e3a082e
                                                                        • Instruction ID: f7ac2a905517412b59ae98c3f6824023221557f5a9692fe299071cc5ba7561f0
                                                                        • Opcode Fuzzy Hash: e3817b525925900c12b7d68306cad500d1e6efbd9f58bb5d63d5f3d50e3a082e
                                                                        • Instruction Fuzzy Hash: 0EF15EB4E14218DFCB18AFB8E6592ACBBB2FF88710F404569D849E7354DB788C45CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07AAC9B7 Relevance: .3, Instructions: 293COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2540674420.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7aa0000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 69f499649d7f9e775dd84cb73ff1ae0f5a1ba4ed2cecd26dad57f01b2c45efe6
                                                                        • Instruction ID: df5fbf45f9838a2113627141f4554ccf94ac476ac35466f7e05b0431dc561157
                                                                        • Opcode Fuzzy Hash: 69f499649d7f9e775dd84cb73ff1ae0f5a1ba4ed2cecd26dad57f01b2c45efe6
                                                                        • Instruction Fuzzy Hash: 38A1DF71A00215CFD705BFBCE5A922DBBB2FB89220F448969D885D7395DF389C09C791
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 07AA4B98 Relevance: .1, Instructions: 105COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2540674420.0000000007AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AA0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_7aa0000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e91449f23c294dc1dbd34d87a28e3cb27fbeb9a7c08a03f972b4c4674b6c1ddb
                                                                        • Instruction ID: e5e4f5928a559a13afaa423144d4b439be9e1b9aec53fce1d31ff5e2b2a756c8
                                                                        • Opcode Fuzzy Hash: e91449f23c294dc1dbd34d87a28e3cb27fbeb9a7c08a03f972b4c4674b6c1ddb
                                                                        • Instruction Fuzzy Hash: D9314E30705284AFC305BBBDE8A566E7FAAFBCA310F40846AE489D7341CE785C05C369
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00C0D7D9 Relevance: .0, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2513880347.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_c0d000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: eb12755559d1ab1c64ce39bc801f25e67776b8d028a03e01c8fb8b90f8e71950
                                                                        • Instruction ID: d8b2302ded8c43695cd731c0c1c598b0c0667604a94308498fd1e66b7280d37e
                                                                        • Opcode Fuzzy Hash: eb12755559d1ab1c64ce39bc801f25e67776b8d028a03e01c8fb8b90f8e71950
                                                                        • Instruction Fuzzy Hash: 8701D671408344DFF7205AA6DC84B67BB98EF41724F18C61AED1A5E2C6C6799880CAF6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00C0D7D8 Relevance: .0, Instructions: 36COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000010.00000002.2513880347.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_16_2_c0d000_purches order.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: df0d0d6d3166c62326b15c4578c76745a351efa72839c8435807c3dc730b6da2
                                                                        • Instruction ID: 6ea78f19ad26fb60440045fedb51123c822312819e38395c5624af075db9b331
                                                                        • Opcode Fuzzy Hash: df0d0d6d3166c62326b15c4578c76745a351efa72839c8435807c3dc730b6da2
                                                                        • Instruction Fuzzy Hash: A2F06D72409344AEE7208A16DD88B63FFA8EF91724F18C55AED195A2C6C2799C44CAB1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%