Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
548IrCt4hj

Overview

General Information

Sample Name:548IrCt4hj (renamed file extension from none to dll)
Analysis ID:672062
MD5:7301880b88f87cd3a593f7106d5743cc
SHA1:c8a2b0ae061b612f4d4a4cfc4ee3e1f7079b4240
SHA256:c409ad4f64a1ad925ffbfdb88f57dd9177123364a1875caf6cbb6f5ba3970cc3
Tags:exeOpenCTIBRSandboxed
Infos:

Detection

Emotet
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Program does not show much activity (idle)
IP address seen in connection with other malware
PE file contains an invalid checksum
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Connects to several IPs in different countries
Registers a DLL
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 6432 cmdline: loaddll64.exe "C:\Users\user\Desktop\548IrCt4hj.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)
    • cmd.exe (PID: 6488 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 6516 cmdline: rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • regsvr32.exe (PID: 6504 cmdline: regsvr32.exe /s C:\Users\user\Desktop\548IrCt4hj.dll MD5: D78B75FC68247E8A63ACBA846182740E)
      • regsvr32.exe (PID: 6692 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZPLPsNKH\eFntQ.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
    • rundll32.exe (PID: 6536 cmdline: rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllCanUnloadNow MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6704 cmdline: rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllGetClassObject MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6776 cmdline: rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)
  • svchost.exe (PID: 7076 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5072 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3972 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6700 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6636 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6092 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["139.59.80.108:8080", "83.229.80.93:8080", "190.107.19.179:443", "202.134.4.210:7080", "165.232.185.110:8080", "104.244.79.94:443", "198.199.70.22:8080", "37.44.244.177:8080", "195.77.239.39:8080", "103.85.95.4:8080", "85.214.67.203:8080", "103.41.204.169:8080", "78.47.204.80:443", "190.145.8.4:443", "139.196.72.155:8080", "87.106.97.83:7080", "202.29.239.162:443", "202.28.34.99:8080", "54.37.106.167:8080", "103.224.241.74:8080", "103.254.12.236:7080", "188.165.79.151:443", "43.129.209.178:443", "37.187.114.15:8080", "5.253.30.17:7080", "54.37.228.122:443", "157.230.99.206:8080", "103.56.149.105:8080", "157.245.111.0:8080", "128.199.242.164:8080", "104.248.225.227:8080", "88.217.172.165:8080", "175.126.176.79:8080", "85.25.120.45:8080", "178.62.112.199:8080", "178.238.225.252:8080", "93.104.209.107:8080", "210.57.209.142:8080", "128.199.217.206:443", "103.71.99.57:8080", "64.227.55.231:8080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0EZiWsQAQAIg=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW45gAsQAmAIg="]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.424123479.000001E034440000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
    0000000A.00000002.940693332.0000000000C20000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000005.00000002.427012616.0000000001120000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        00000006.00000002.422757747.000001F33EB00000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          0000000A.00000002.940812969.00000000024B1000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            7.2.rundll32.exe.1e034440000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              6.2.rundll32.exe.1f33eb00000.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                5.2.regsvr32.exe.1120000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  7.2.rundll32.exe.1e034440000.0.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    10.2.regsvr32.exe.c20000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      Click to see the 3 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      Timestamp:192.168.2.5174.138.33.494976870802404316 07/23/22-04:56:42.473067
                      SID:2404316
                      Source Port:49768
                      Destination Port:7080
                      Protocol:TCP
                      Classtype:A Network Trojan was detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Multi AV Scanner detection for submitted file
                      Source: 548IrCt4hj.dllVirustotal: Detection: 70%Perma Link
                      Source: 548IrCt4hj.dllMetadefender: Detection: 45%Perma Link
                      Source: 548IrCt4hj.dllReversingLabs: Detection: 88%
                      Antivirus detection for URL or domain
                      Source: https://174.138.33.49/ZAvira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/FAvira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/OnlyAvira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/rAvira URL Cloud: Label: malware
                      Source: https://174.138.33.49:7080/pAvira URL Cloud: Label: malware
                      Source: 0000000A.00000002.940180760.0000000000AEB000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Emotet {"C2 list": ["139.59.80.108:8080", "83.229.80.93:8080", "190.107.19.179:443", "202.134.4.210:7080", "165.232.185.110:8080", "104.244.79.94:443", "198.199.70.22:8080", "37.44.244.177:8080", "195.77.239.39:8080", "103.85.95.4:8080", "85.214.67.203:8080", "103.41.204.169:8080", "78.47.204.80:443", "190.145.8.4:443", "139.196.72.155:8080", "87.106.97.83:7080", "202.29.239.162:443", "202.28.34.99:8080", "54.37.106.167:8080", "103.224.241.74:8080", "103.254.12.236:7080", "188.165.79.151:443", "43.129.209.178:443", "37.187.114.15:8080", "5.253.30.17:7080", "54.37.228.122:443", "157.230.99.206:8080", "103.56.149.105:8080", "157.245.111.0:8080", "128.199.242.164:8080", "104.248.225.227:8080", "88.217.172.165:8080", "175.126.176.79:8080", "85.25.120.45:8080", "178.62.112.199:8080", "178.238.225.252:8080", "93.104.209.107:8080", "210.57.209.142:8080", "128.199.217.206:443", "103.71.99.57:8080", "64.227.55.231:8080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0EZiWsQAQAIg=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW45gAsQAmAIg="]}
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018006680C FindFirstFileExW,FindNextFileW,FindClose,FindClose,5_2_000000018006680C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800671B0 FindFirstFileExW,5_2_00000001800671B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800677BC FindFirstFileExW,FindNextFileW,FindClose,FindClose,5_2_00000001800677BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CC9F0 FindFirstFileW,FindNextFileW,10_2_024CC9F0

                      Networking

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 174.138.33.49 7080Jump to behavior
                      Snort IDS alert for network traffic
                      Source: TrafficSnort IDS: 2404316 ET CNC Feodo Tracker Reported CnC Server TCP group 9 192.168.2.5:49768 -> 174.138.33.49:7080
                      C2 URLs / IPs found in malware configuration
                      Source: Malware configuration extractorIPs: 139.59.80.108:8080
                      Source: Malware configuration extractorIPs: 83.229.80.93:8080
                      Source: Malware configuration extractorIPs: 190.107.19.179:443
                      Source: Malware configuration extractorIPs: 202.134.4.210:7080
                      Source: Malware configuration extractorIPs: 165.232.185.110:8080
                      Source: Malware configuration extractorIPs: 104.244.79.94:443
                      Source: Malware configuration extractorIPs: 198.199.70.22:8080
                      Source: Malware configuration extractorIPs: 37.44.244.177:8080
                      Source: Malware configuration extractorIPs: 195.77.239.39:8080
                      Source: Malware configuration extractorIPs: 103.85.95.4:8080
                      Source: Malware configuration extractorIPs: 85.214.67.203:8080
                      Source: Malware configuration extractorIPs: 103.41.204.169:8080
                      Source: Malware configuration extractorIPs: 78.47.204.80:443
                      Source: Malware configuration extractorIPs: 190.145.8.4:443
                      Source: Malware configuration extractorIPs: 139.196.72.155:8080
                      Source: Malware configuration extractorIPs: 87.106.97.83:7080
                      Source: Malware configuration extractorIPs: 202.29.239.162:443
                      Source: Malware configuration extractorIPs: 202.28.34.99:8080
                      Source: Malware configuration extractorIPs: 54.37.106.167:8080
                      Source: Malware configuration extractorIPs: 103.224.241.74:8080
                      Source: Malware configuration extractorIPs: 103.254.12.236:7080
                      Source: Malware configuration extractorIPs: 188.165.79.151:443
                      Source: Malware configuration extractorIPs: 43.129.209.178:443
                      Source: Malware configuration extractorIPs: 37.187.114.15:8080
                      Source: Malware configuration extractorIPs: 5.253.30.17:7080
                      Source: Malware configuration extractorIPs: 54.37.228.122:443
                      Source: Malware configuration extractorIPs: 157.230.99.206:8080
                      Source: Malware configuration extractorIPs: 103.56.149.105:8080
                      Source: Malware configuration extractorIPs: 157.245.111.0:8080
                      Source: Malware configuration extractorIPs: 128.199.242.164:8080
                      Source: Malware configuration extractorIPs: 104.248.225.227:8080
                      Source: Malware configuration extractorIPs: 88.217.172.165:8080
                      Source: Malware configuration extractorIPs: 175.126.176.79:8080
                      Source: Malware configuration extractorIPs: 85.25.120.45:8080
                      Source: Malware configuration extractorIPs: 178.62.112.199:8080
                      Source: Malware configuration extractorIPs: 178.238.225.252:8080
                      Source: Malware configuration extractorIPs: 93.104.209.107:8080
                      Source: Malware configuration extractorIPs: 210.57.209.142:8080
                      Source: Malware configuration extractorIPs: 128.199.217.206:443
                      Source: Malware configuration extractorIPs: 103.71.99.57:8080
                      Source: Malware configuration extractorIPs: 64.227.55.231:8080
                      Source: Joe Sandbox ViewASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
                      Source: Joe Sandbox ViewASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
                      Source: Joe Sandbox ViewIP Address: 157.230.99.206 157.230.99.206
                      Source: Joe Sandbox ViewIP Address: 157.245.111.0 157.245.111.0
                      Source: global trafficTCP traffic: 192.168.2.5:49768 -> 174.138.33.49:7080
                      Source: unknownNetwork traffic detected: IP country count 17
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: unknownTCP traffic detected without corresponding DNS query: 174.138.33.49
                      Source: svchost.exe, 00000019.00000003.551262839.0000015F2D570000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
                      Source: svchost.exe, 00000019.00000003.551262839.0000015F2D570000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
                      Source: svchost.exe, 00000019.00000003.551262839.0000015F2D570000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.550189528.0000015F2D582000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z||.||b7e2ac48-308b-4ab0-ad70-c01dd95863e0||1152921505695074449||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                      Source: svchost.exe, 00000019.00000003.551262839.0000015F2D570000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.550189528.0000015F2D582000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-22T07:55:01.8237416Z||.||b7e2ac48-308b-4ab0-ad70-c01dd95863e0||1152921505695074449||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
                      Source: regsvr32.exe, 0000000A.00000002.940537855.0000000000B80000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480115635.0000000000B80000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.836628963.0000018894A9D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.595043128.0000015F2CCE9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: svchost.exe, 00000013.00000002.836139820.00000188934BB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.835512145.00000188934BB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.595043128.0000015F2CCE9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                      Source: regsvr32.exe, 0000000A.00000003.480159823.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.940603447.0000000000BA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabV&V
                      Source: regsvr32.exe, 0000000A.00000003.480288771.0000000000B4B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.940449077.0000000000B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enf
                      Source: svchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://help.disneyplus.com.
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49/
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49/Z
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/F
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/Only
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/p
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://174.138.33.49:7080/r
                      Source: svchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://disneyplus.com/legal.
                      Source: svchost.exe, 00000019.00000003.563618298.0000015F2D599000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563853374.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563634572.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563884423.0000015F2DA19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563734310.0000015F2D587000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563691195.0000015F2DA03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563660153.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.hotspotshield.com/
                      Source: svchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
                      Source: svchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
                      Source: svchost.exe, 00000019.00000003.563618298.0000015F2D599000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563853374.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563634572.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563884423.0000015F2DA19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563734310.0000015F2D587000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563691195.0000015F2DA03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563660153.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.hotspotshield.com/terms/
                      Source: svchost.exe, 00000019.00000003.563618298.0000015F2D599000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563853374.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563634572.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563884423.0000015F2DA19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563734310.0000015F2D587000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563691195.0000015F2DA03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563660153.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.pango.co/privacy
                      Source: svchost.exe, 00000019.00000003.572982528.0000015F2D59A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.572906706.0000015F2D5B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.572968023.0000015F2D589000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.573008527.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.572949834.0000015F2D5B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/legal/report/feedback

                      E-Banking Fraud

                      barindex
                      Source: Yara matchFile source: 0000000A.00000002.940180760.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Yara detected Emotet
                      Source: Yara matchFile source: 7.2.rundll32.exe.1e034440000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.1f33eb00000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.regsvr32.exe.1120000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.rundll32.exe.1e034440000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 10.2.regsvr32.exe.c20000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 10.2.regsvr32.exe.c20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.1f33eb00000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.regsvr32.exe.1120000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000007.00000002.424123479.000001E034440000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.940693332.0000000000C20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.427012616.0000000001120000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.422757747.000001F33EB00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.940812969.00000000024B1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.422895400.000001F33EC51000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.424307117.000001E034471000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: C:\Windows\System32\regsvr32.exeFile deleted: C:\Windows\System32\ZPLPsNKH\eFntQ.dll:Zone.IdentifierJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeFile created: C:\Windows\system32\ZPLPsNKH\Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800030265_2_0000000180003026
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180001D575_2_0000000180001D57
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800640D05_2_00000001800640D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800341745_2_0000000180034174
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800019B55_2_00000001800019B5
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800013F75_2_00000001800013F7
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800011D65_2_00000001800011D6
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800018B65_2_00000001800018B6
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003442C5_2_000000018003442C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800345745_2_0000000180034574
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018000427D5_2_000000018000427D
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800346BC5_2_00000001800346BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003C6D45_2_000000018003C6D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800013F75_2_00000001800013F7
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800013F75_2_00000001800013F7
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800348085_2_0000000180034808
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800039EA5_2_00000001800039EA
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002C615_2_0000000180002C61
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800349B45_2_00000001800349B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180060A885_2_0000000180060A88
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018004CAEC5_2_000000018004CAEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180034AFC5_2_0000000180034AFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180060A885_2_0000000180060A88
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002F5E5_2_0000000180002F5E
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800010415_2_0000000180001041
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800026CB5_2_00000001800026CB
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180034D8C5_2_0000000180034D8C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800034EF5_2_00000001800034EF
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180060F1C5_2_0000000180060F1C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180034F345_2_0000000180034F34
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002C115_2_0000000180002C11
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002FCC5_2_0000000180002FCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800011DB5_2_00000001800011DB
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180003C835_2_0000000180003C83
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003507C5_2_000000018003507C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003D0B05_2_000000018003D0B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018000285B5_2_000000018000285B
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180003C335_2_0000000180003C33
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800351C45_2_00000001800351C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002F725_2_0000000180002F72
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003530C5_2_000000018003530C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800019E25_2_00000001800019E2
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800021C65_2_00000001800021C6
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180001DE35_2_0000000180001DE3
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800394B05_2_00000001800394B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800354B45_2_00000001800354B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800021035_2_0000000180002103
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018004D5885_2_000000018004D588
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800715845_2_0000000180071584
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003D5C45_2_000000018003D5C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800029E15_2_00000001800029E1
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800029005_2_0000000180002900
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800397105_2_0000000180039710
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800016AE5_2_00000001800016AE
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800029AA5_2_00000001800029AA
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002BE45_2_0000000180002BE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018000321A5_2_000000018000321A
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180001AC35_2_0000000180001AC3
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018000322E5_2_000000018000322E
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800013025_2_0000000180001302
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180045B0C5_2_0000000180045B0C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800017215_2_0000000180001721
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800019D85_2_00000001800019D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002E005_2_0000000180002E00
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003DD485_2_000000018003DD48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180035D6C5_2_0000000180035D6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800017215_2_0000000180001721
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180003D8C5_2_0000000180003D8C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800020955_2_0000000180002095
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180035EFC5_2_0000000180035EFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002AA95_2_0000000180002AA9
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800025BD5_2_00000001800025BD
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180001F875_2_0000000180001F87
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018005E0685_2_000000018005E068
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800360745_2_0000000180036074
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003A1485_2_000000018003A148
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800361BC5_2_00000001800361BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003E2185_2_000000018003E218
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800363045_2_0000000180036304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003A3B05_2_000000018003A3B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800034F95_2_00000001800034F9
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800036345_2_0000000180003634
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800464AC5_2_00000001800464AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800034595_2_0000000180003459
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018006A5B05_2_000000018006A5B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800365F45_2_00000001800365F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003A6185_2_000000018003A618
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800042AF5_2_00000001800042AF
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018006680C5_2_000000018006680C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002CDE5_2_0000000180002CDE
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800017215_2_0000000180001721
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002F7C5_2_0000000180002F7C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800469205_2_0000000180046920
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018004E9245_2_000000018004E924
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002D1F5_2_0000000180002D1F
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180003CB05_2_0000000180003CB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180036B845_2_0000000180036B84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180036CCC5_2_0000000180036CCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800032065_2_0000000180003206
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180036E145_2_0000000180036E14
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180046E305_2_0000000180046E30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800032975_2_0000000180003297
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180036F5C5_2_0000000180036F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002DE25_2_0000000180002DE2
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800041425_2_0000000180004142
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800330BC5_2_00000001800330BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800371045_2_0000000180037104
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800731605_2_0000000180073160
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800671B05_2_00000001800671B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800631C45_2_00000001800631C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800332045_2_0000000180033204
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003724C5_2_000000018003724C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800010235_2_0000000180001023
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003334C5_2_000000018003334C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800373945_2_0000000180037394
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800334985_2_0000000180033498
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800374DC5_2_00000001800374DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003B5105_2_000000018003B510
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800034775_2_0000000180003477
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800336545_2_0000000180033654
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800376845_2_0000000180037684
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800028295_2_0000000180002829
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018003379C5_2_000000018003379C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800637A45_2_00000001800637A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180001D2F5_2_0000000180001D2F
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002C935_2_0000000180002C93
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800338E45_2_00000001800338E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800379145_2_0000000180037914
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800042005_2_0000000180004200
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800043DB5_2_00000001800043DB
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800012805_2_0000000180001280
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800012DF5_2_00000001800012DF
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018000269E5_2_000000018000269E
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180033BDC5_2_0000000180033BDC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800019A65_2_00000001800019A6
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180033D245_2_0000000180033D24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180033E6C5_2_0000000180033E6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800013F75_2_00000001800013F7
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800025865_2_0000000180002586
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180033FB85_2_0000000180033FB8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00E600005_2_00E60000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116A8045_2_0116A804
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116C8C05_2_0116C8C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116EB085_2_0116EB08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01168B3C5_2_01168B3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115CCC85_2_0115CCC8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011674145_2_01167414
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117B6BC5_2_0117B6BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01155B185_2_01155B18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01161B885_2_01161B88
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116BD645_2_0116BD64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01177E285_2_01177E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011661105_2_01166110
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116A1305_2_0116A130
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011541A85_2_011541A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011740205_2_01174020
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011540785_2_01154078
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116406C5_2_0116406C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117A0885_2_0117A088
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117A3045_2_0117A304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011743305_2_01174330
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117632C5_2_0117632C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011643685_2_01164368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115E2545_2_0115E254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011765205_2_01176520
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011605785_2_01160578
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011645945_2_01164594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011665945_2_01166594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116C5AC5_2_0116C5AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011525D85_2_011525D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011664185_2_01166418
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116A4085_2_0116A408
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115C4585_2_0115C458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116E4A85_2_0116E4A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011784DC5_2_011784DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011624E45_2_011624E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011527085_2_01152708
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116C7205_2_0116C720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116E7A45_2_0116E7A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011627A45_2_011627A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011707D05_2_011707D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011726385_2_01172638
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011566985_2_01156698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011606805_2_01160680
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011646B45_2_011646B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011749185_2_01174918
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117093C5_2_0117093C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011549485_2_01154948
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011669785_2_01166978
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011789905_2_01178990
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011629BC5_2_011629BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116C9F05_2_0116C9F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011528205_2_01152820
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116484C5_2_0116484C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011548485_2_01154848
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01178B285_2_01178B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01176B405_2_01176B40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01160B605_2_01160B60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115CB6C5_2_0115CB6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116ABD85_2_0116ABD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01170AC45_2_01170AC4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01172AFC5_2_01172AFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01152AE45_2_01152AE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115ED845_2_0115ED84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01170DBC5_2_01170DBC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01152DC05_2_01152DC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01172C485_2_01172C48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01154C645_2_01154C64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01160C685_2_01160C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01170C685_2_01170C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01158CE05_2_01158CE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116ACEC5_2_0116ACEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01172F3C5_2_01172F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01176F3C5_2_01176F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01158F5C5_2_01158F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01162F945_2_01162F94
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116EFAC5_2_0116EFAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115EFCC5_2_0115EFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115AFE45_2_0115AFE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01172E045_2_01172E04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116EE5C5_2_0116EE5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01174EF45_2_01174EF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01178EE85_2_01178EE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011671445_2_01167144
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011551985_2_01155198
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115B1A85_2_0115B1A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011531F05_2_011531F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011510145_2_01151014
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116B0285_2_0116B028
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011530BC5_2_011530BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011590D45_2_011590D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115B0F85_2_0115B0F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117B0EC5_2_0117B0EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011733045_2_01173304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115D3005_2_0115D300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011513685_2_01151368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011593AC5_2_011593AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011713FC5_2_011713FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115B3E45_2_0115B3E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011693E05_2_011693E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011632105_2_01163210
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116F2385_2_0116F238
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116D2545_2_0116D254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115F2905_2_0115F290
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115B2BC5_2_0115B2BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011712FC5_2_011712FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011572E05_2_011572E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117155C5_2_0117155C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116B5585_2_0116B558
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117B5705_2_0117B570
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115F5805_2_0115F580
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117344C5_2_0117344C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011554845_2_01155484
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011614A05_2_011614A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116D4D05_2_0116D4D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011637245_2_01163724
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011697205_2_01169720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116F7645_2_0116F764
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011636105_2_01163610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116F61C5_2_0116F61C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116D6205_2_0116D620
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116762C5_2_0116762C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117369C5_2_0117369C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115B6985_2_0115B698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011776A45_2_011776A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011716A85_2_011716A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011536E05_2_011536E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115D92C5_2_0115D92C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117796C5_2_0117796C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116D9C45_2_0116D9C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011699F45_2_011699F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115F8505_2_0115F850
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011738945_2_01173894
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_011678C45_2_011678C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01167B245_2_01167B24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115DB745_2_0115DB74
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01157BB45_2_01157BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01163BB45_2_01163BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01179A405_2_01179A40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01153A9C5_2_01153A9C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115FAD05_2_0115FAD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01171AE05_2_01171AE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01163D1C5_2_01163D1C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115BD245_2_0115BD24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117BD205_2_0117BD20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01171D2C5_2_01171D2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01169D5C5_2_01169D5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01167DB05_2_01167DB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01179DA85_2_01179DA8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01173DD45_2_01173DD4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115BC085_2_0115BC08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01167C305_2_01167C30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01165C505_2_01165C50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116FC705_2_0116FC70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01157CAC5_2_01157CAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01153CE85_2_01153CE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01153F405_2_01153F40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115DFCC5_2_0115DFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01163E185_2_01163E18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01175E305_2_01175E30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0115FE585_2_0115FE58
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0117BE905_2_0117BE90
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01169EC05_2_01169EC0
                      Source: C:\Windows\System32\rundll32.exeCode function: 6_2_000001F33EAF00006_2_000001F33EAF0000
                      Source: C:\Windows\System32\rundll32.exeCode function: 7_2_000001E0344300007_2_000001E034430000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_00C1000010_2_00C10000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CA80410_2_024CA804
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D7E2810_2_024D7E28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CC8C010_2_024CC8C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D389410_2_024D3894
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B7CAC10_2_024B7CAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024DB6BC10_2_024DB6BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B136810_2_024B1368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C436810_2_024C4368
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CBD6410_2_024CBD64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024DA30410_2_024DA304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B5B1810_2_024B5B18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C8B3C10_2_024C8B3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D2F3C10_2_024D2F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C7FEC10_2_024C7FEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CC9F010_2_024CC9F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B41A810_2_024B41A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C484C10_2_024C484C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D344C10_2_024D344C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B484810_2_024B4848
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D2C4810_2_024D2C48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D9A4010_2_024D9A40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CEE5C10_2_024CEE5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BFE5810_2_024BFE58
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BC45810_2_024BC458
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CD25410_2_024CD254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BF85010_2_024BF850
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C5C5010_2_024C5C50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BE25410_2_024BE254
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C406C10_2_024C406C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C0C6810_2_024C0C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D0C6810_2_024D0C68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B4C6410_2_024B4C64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B407810_2_024B4078
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CFC7010_2_024CFC70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BBC0810_2_024BBC08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CA40810_2_024CA408
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D2E0410_2_024D2E04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CF61C10_2_024CF61C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C641810_2_024C6418
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C3E1810_2_024C3E18
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C741410_2_024C7414
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C321010_2_024C3210
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C361010_2_024C3610
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B101410_2_024B1014
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C762C10_2_024C762C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CB02810_2_024CB028
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B282010_2_024B2820
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CD62010_2_024CD620
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D402010_2_024D4020
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CF23810_2_024CF238
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D263810_2_024D2638
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C7C3010_2_024C7C30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D5E3010_2_024D5E30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BCCC810_2_024BCCC8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C78C410_2_024C78C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D0AC410_2_024D0AC4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C9EC010_2_024C9EC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D84DC10_2_024D84DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BFAD010_2_024BFAD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CD4D010_2_024CD4D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B90D410_2_024B90D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CACEC10_2_024CACEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024DB0EC10_2_024DB0EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B3CE810_2_024B3CE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D8EE810_2_024D8EE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C24E410_2_024C24E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B36E010_2_024B36E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B72E010_2_024B72E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B8CE010_2_024B8CE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D1AE010_2_024D1AE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B2AE410_2_024B2AE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D12FC10_2_024D12FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D2AFC10_2_024D2AFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BB0F810_2_024BB0F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D4EF410_2_024D4EF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024DA08810_2_024DA088
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C068010_2_024C0680
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B548410_2_024B5484
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D369C10_2_024D369C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B669810_2_024B6698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BB69810_2_024BB698
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B3A9C10_2_024B3A9C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BF29010_2_024BF290
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024DBE9010_2_024DBE90
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CE4A810_2_024CE4A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D16A810_2_024D16A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D76A410_2_024D76A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C14A010_2_024C14A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B30BC10_2_024B30BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BB2BC10_2_024BB2BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C46B410_2_024C46B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B494810_2_024B4948
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C714410_2_024C7144
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B3F4010_2_024B3F40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D6B4010_2_024D6B40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C9D5C10_2_024C9D5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D155C10_2_024D155C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CB55810_2_024CB558
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B8F5C10_2_024B8F5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D796C10_2_024D796C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BCB6C10_2_024BCB6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CF76410_2_024CF764
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C0B6010_2_024C0B60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C697810_2_024C6978
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C057810_2_024C0578
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024DB57010_2_024DB570
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BDB7410_2_024BDB74
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B270810_2_024B2708
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CEB0810_2_024CEB08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D330410_2_024D3304
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BD30010_2_024BD300
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C3D1C10_2_024C3D1C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D491810_2_024D4918
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C611010_2_024C6110
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D1D2C10_2_024D1D2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D632C10_2_024D632C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D8B2810_2_024D8B28
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BD92C10_2_024BD92C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C372410_2_024C3724
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C7B2410_2_024C7B24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CC72010_2_024CC720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C972010_2_024C9720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024DBD2010_2_024DBD20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D652010_2_024D6520
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BBD2410_2_024BBD24
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D093C10_2_024D093C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D6F3C10_2_024D6F3C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CA13010_2_024CA130
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D433010_2_024D4330
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BDFCC10_2_024BDFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BEFCC10_2_024BEFCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CD9C410_2_024CD9C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B2DC010_2_024B2DC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B25D810_2_024B25D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CABD810_2_024CABD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D3DD410_2_024D3DD4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D07D010_2_024D07D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C93E010_2_024C93E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BAFE410_2_024BAFE4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BB3E410_2_024BB3E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D13FC10_2_024D13FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C99F410_2_024C99F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B31F010_2_024B31F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C1B8810_2_024C1B88
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BF58010_2_024BF580
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BED8410_2_024BED84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B519810_2_024B5198
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C2F9410_2_024C2F94
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C459410_2_024C4594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C659410_2_024C6594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D899010_2_024D8990
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CC5AC10_2_024CC5AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CEFAC10_2_024CEFAC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024BB1A810_2_024BB1A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D9DA810_2_024D9DA8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B93AC10_2_024B93AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CE7A410_2_024CE7A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C27A410_2_024C27A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C29BC10_2_024C29BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024D0DBC10_2_024D0DBC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C3BB410_2_024C3BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024C7DB010_2_024C7DB0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024B7BB410_2_024B7BB4
                      Source: C:\Windows\System32\regsvr32.exeCode function: String function: 000000018006BC48 appears 58 times
                      Source: C:\Windows\System32\regsvr32.exeCode function: String function: 00000001800019CE appears 79 times
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: 548IrCt4hj.dllVirustotal: Detection: 70%
                      Source: 548IrCt4hj.dllMetadefender: Detection: 45%
                      Source: 548IrCt4hj.dllReversingLabs: Detection: 88%
                      Source: 548IrCt4hj.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\548IrCt4hj.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\548IrCt4hj.dll
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllCanUnloadNow
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZPLPsNKH\eFntQ.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllGetClassObject
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllRegisterServer
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                      Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1Jump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\548IrCt4hj.dllJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllCanUnloadNowJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllGetClassObjectJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllRegisterServerJump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZPLPsNKH\eFntQ.dll"Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32Jump to behavior
                      Source: classification engineClassification label: mal96.troj.evad.winDLL@21/5@0/44
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800013F7 GetModuleFileNameW,CharNextW,LoadTypeLib,LoadTypeLib,SysAllocString,CoCreateInstance,StringFromGUID2,RegOpenKeyExW,RegQueryInfoKeyW,RegCloseKey,RegDeleteKeyW,RegOpenKeyExW,RegCloseKey,RegQueryInfoKeyW,RegCloseKey,RegDeleteKeyW,RegCloseKey,RegCloseKey,GetModuleHandleW,GetProcAddress,UnRegisterTypeLib,UnRegisterTypeLib,SysFreeString,5_2_00000001800013F7
                      Source: C:\Windows\System32\regsvr32.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0116A804 Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,FindCloseChangeNotification,5_2_0116A804
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180001721 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,lstrcmpiW,lstrcmpiW,CharNextW,lstrcmpiW,lstrcmpiW,lstrcmpiW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,CharNextW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegCreateKeyExW,RegCloseKey,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegQueryInfoKeyW,lstrcmpiW,RegQueryInfoKeyW,RegCloseKey,RegDeleteKeyW,RegCloseKey,RegSetValueExW,5_2_0000000180001721
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\rundll32.exeAutomated click: OK
                      Source: C:\Windows\System32\rundll32.exeAutomated click: OK
                      Source: 548IrCt4hj.dllStatic PE information: Image base 0x180000000 > 0x60000000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_01158C72 push ebp; ret 5_2_01158C7D
                      Source: 548IrCt4hj.dllStatic PE information: section name: .00cfg
                      Source: 548IrCt4hj.dllStatic PE information: section name: _RDATA
                      Source: 548IrCt4hj.dllStatic PE information: real checksum: 0xf69e3 should be: 0xf8045
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\548IrCt4hj.dll
                      Source: C:\Windows\System32\regsvr32.exePE file moved: C:\Windows\System32\ZPLPsNKH\eFntQ.dllJump to behavior

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)
                      Source: C:\Windows\System32\regsvr32.exeFile opened: C:\Windows\system32\ZPLPsNKH\eFntQ.dll:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\svchost.exe TID: 5220Thread sleep time: -30000s >= -30000sJump to behavior
                      Source: C:\Windows\System32\svchost.exe TID: 6620Thread sleep time: -30000s >= -30000sJump to behavior
                      Source: C:\Windows\System32\svchost.exe TID: 6012Thread sleep time: -90000s >= -30000sJump to behavior
                      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                      Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeAPI coverage: 2.9 %
                      Source: C:\Windows\System32\regsvr32.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018006680C FindFirstFileExW,FindNextFileW,FindClose,FindClose,5_2_000000018006680C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800671B0 FindFirstFileExW,5_2_00000001800671B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800677BC FindFirstFileExW,FindNextFileW,FindClose,FindClose,5_2_00000001800677BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 10_2_024CC9F0 FindFirstFileW,FindNextFileW,10_2_024CC9F0
                      Source: C:\Windows\System32\regsvr32.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                      Source: svchost.exe, 00000013.00000002.836485099.0000018894A65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.595056654.0000015F2CCF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @Hyper-V RAW
                      Source: regsvr32.exe, 0000000A.00000003.480288771.0000000000B4B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.940449077.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.835848057.000001889342A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.836463528.0000018894A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.595043128.0000015F2CCE9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: svchost.exe, 00000015.00000002.940237565.000001D31EA02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
                      Source: regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.594594939.0000015F2CC71000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                      Source: svchost.exe, 00000015.00000002.940346278.000001D31EA28000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800041E7 GetLastError,IsDebuggerPresent,OutputDebugStringW,5_2_00000001800041E7
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800041E7 GetLastError,IsDebuggerPresent,OutputDebugStringW,5_2_00000001800041E7
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180002CD9 GetProcessHeap,5_2_0000000180002CD9
                      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                      Source: C:\Windows\System32\loaddll64.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_000000018002BAEC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_000000018002BAEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_0000000180003841 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_0000000180003841

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 174.138.33.49 7080Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,5_2_0000000180002B08
                      Source: C:\Windows\System32\regsvr32.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,5_2_0000000180071D18
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesW,5_2_0000000180072138
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesW,5_2_00000001800721DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesW,5_2_00000001800722DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,5_2_00000001800723C8
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,5_2_00000001800726A4
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,5_2_0000000180072854
                      Source: C:\Windows\System32\regsvr32.exeCode function: GetLocaleInfoW,5_2_0000000180072960
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,5_2_0000000180072AD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesW,5_2_000000018006B3D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesW,5_2_000000018006B534
                      Source: C:\Windows\System32\regsvr32.exeCode function: EnumSystemLocalesW,5_2_000000018006B5DC
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 5_2_00000001800031CA __security_init_cookie,GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,5_2_00000001800031CA

                      Stealing of Sensitive Information

                      barindex
                      Source: Yara matchFile source: 0000000A.00000002.940180760.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Yara detected Emotet
                      Source: Yara matchFile source: 7.2.rundll32.exe.1e034440000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.1f33eb00000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.regsvr32.exe.1120000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 7.2.rundll32.exe.1e034440000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 10.2.regsvr32.exe.c20000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 10.2.regsvr32.exe.c20000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 6.2.rundll32.exe.1f33eb00000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.regsvr32.exe.1120000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000007.00000002.424123479.000001E034440000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.940693332.0000000000C20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.427012616.0000000001120000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.422757747.000001F33EB00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0000000A.00000002.940812969.00000000024B1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000006.00000002.422895400.000001F33EC51000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000007.00000002.424307117.000001E034471000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation1
                      DLL Side-Loading                      		111
                      Process Injection                      		2
                      Masquerading                      		OS Credential Dumping1
                      System Time Discovery                      		Remote Services1
                      Archive Collected Data                      		Exfiltration Over Other Network Medium1
                      Encrypted Channel                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                      DLL Side-Loading                      		3
                      Virtualization/Sandbox Evasion                      		LSASS Memory51
                      Security Software Discovery                      		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
                      Non-Standard Port                      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)111
                      Process Injection                      		Security Account Manager3
                      Virtualization/Sandbox Evasion                      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
                      Application Layer Protocol                      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
                      Deobfuscate/Decode Files or Information                      		NTDS2
                      Process Discovery                      		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      Hidden Files and Directories                      		LSA Secrets1
                      Remote System Discovery                      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common2
                      Obfuscated Files or Information                      		Cached Domain Credentials2
                      File and Directory Discovery                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
                      Regsvr32                      		DCSync34
                      System Information Discovery                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                      Rundll32                      		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                      DLL Side-Loading                      		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
                      File Deletion                      		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 672062 Sample: 548IrCt4hj Startdate: 23/07/2022 Architecture: WINDOWS Score: 96 32 103.224.241.74 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 2->32 34 202.29.239.162 UNINET-AS-APUNINET-TH Thailand 2->34 36 39 other IPs or domains 2->36 46 Snort IDS alert for network traffic 2->46 48 Antivirus detection for URL or domain 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 3 other signatures 2->52 8 loaddll64.exe 1 2->8         started        10 svchost.exe 9 1 2->10         started        13 svchost.exe 2->13         started        15 4 other processes 2->15 signatures3 process4 dnsIp5 17 regsvr32.exe 5 8->17         started        20 cmd.exe 1 8->20         started        22 rundll32.exe 8->22         started        24 2 other processes 8->24 38 127.0.0.1 unknown unknown 10->38 40 192.168.2.1 unknown unknown 13->40 process6 signatures7 44 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->44 26 regsvr32.exe 17->26         started        30 rundll32.exe 20->30         started        process8 dnsIp9 42 174.138.33.49, 49768, 7080 DIGITALOCEAN-ASNUS United States 26->42 54 System process connects to network (likely due to code injection or exploit) 26->54 signatures10

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      548IrCt4hj.dll70%VirustotalBrowse
                      548IrCt4hj.dll46%MetadefenderBrowse
                      548IrCt4hj.dll88%ReversingLabsWin64.Trojan.Emotet

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      5.2.regsvr32.exe.1120000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      10.2.regsvr32.exe.c20000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      6.2.rundll32.exe.1f33eb00000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      7.2.rundll32.exe.1e034440000.0.unpack100%AviraHEUR/AGEN.1215461Download File

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      https://www.disneyplus.com/legal/your-california-privacy-rights0%URL Reputationsafe
                      https://www.disneyplus.com/legal/privacy-policy0%URL Reputationsafe
                      https://174.138.33.49/Z100%Avira URL Cloudmalware
                      https://174.138.33.49:7080/F100%Avira URL Cloudmalware
                      https://174.138.33.49:7080/0%URL Reputationsafe
                      https://174.138.33.49:7080/Only100%Avira URL Cloudmalware
                      https://www.pango.co/privacy0%URL Reputationsafe
                      https://disneyplus.com/legal.0%URL Reputationsafe
                      https://174.138.33.49:7080/r100%Avira URL Cloudmalware
                      http://crl.ver)0%Avira URL Cloudsafe
                      https://174.138.33.49:7080/p100%Avira URL Cloudmalware
                      https://www.tiktok.com/legal/report/feedback0%URL Reputationsafe
                      http://help.disneyplus.com.0%URL Reputationsafe
                      https://174.138.33.49/0%URL Reputationsafe

                      Domains and IPs

                      Contacted Domains

                      ⊘No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://www.disneyplus.com/legal/your-california-privacy-rightssvchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://www.disneyplus.com/legal/privacy-policysvchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://174.138.33.49/Zregsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: malware
                      		unknown
                      https://174.138.33.49:7080/Fregsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: malware
                      		unknown
                      https://174.138.33.49:7080/regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://www.hotspotshield.com/terms/svchost.exe, 00000019.00000003.563618298.0000015F2D599000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563853374.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563634572.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563884423.0000015F2DA19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563734310.0000015F2D587000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563691195.0000015F2DA03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563660153.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://174.138.33.49:7080/Onlyregsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        https://www.pango.co/privacysvchost.exe, 00000019.00000003.563618298.0000015F2D599000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563853374.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563634572.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563884423.0000015F2DA19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563734310.0000015F2D587000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563691195.0000015F2DA03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563660153.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://disneyplus.com/legal.svchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://174.138.33.49:7080/rregsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://crl.ver)svchost.exe, 00000013.00000002.836139820.00000188934BB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.835512145.00000188934BB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.595043128.0000015F2CCE9000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		low
                        https://174.138.33.49:7080/pregsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        https://www.tiktok.com/legal/report/feedbacksvchost.exe, 00000019.00000003.572982528.0000015F2D59A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.572906706.0000015F2D5B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.572968023.0000015F2D589000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.573008527.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.572949834.0000015F2D5B0000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://help.disneyplus.com.svchost.exe, 00000019.00000003.568619378.0000015F2D586000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.568197795.0000015F2D598000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://support.hotspotshield.com/svchost.exe, 00000019.00000003.563618298.0000015F2D599000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563853374.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563634572.0000015F2D5A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563884423.0000015F2DA19000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563734310.0000015F2D587000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563691195.0000015F2DA03000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000003.563660153.0000015F2DA02000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://174.138.33.49/regsvr32.exe, 0000000A.00000002.940330437.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000003.480216789.0000000000B21000.00000004.00000020.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown

                          World Map of Contacted IPs

                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs

                          Public IPs

                          IPDomainCountryFlagASNASN NameMalicious
                          157.230.99.206
                          		unknownUnited States
                          		14061DIGITALOCEAN-ASNUStrue
                          157.245.111.0
                          		unknownUnited States
                          		14061DIGITALOCEAN-ASNUStrue
                          54.37.106.167
                          		unknownFrance
                          		16276OVHFRtrue
                          188.165.79.151
                          		unknownFrance
                          		16276OVHFRtrue
                          202.29.239.162
                          		unknownThailand
                          		4621UNINET-AS-APUNINET-THtrue
                          174.138.33.49
                          		unknownUnited States
                          		14061DIGITALOCEAN-ASNUStrue
                          43.129.209.178
                          		unknownJapan4249LILLY-ASUStrue
                          103.41.204.169
                          		unknownIndonesia
                          		58397INFINYS-AS-IDPTInfinysSystemIndonesiaIDtrue
                          5.253.30.17
                          		unknownLatvia
                          		18978ENZUINC-UStrue
                          85.214.67.203
                          		unknownGermany
                          		6724STRATOSTRATOAGDEtrue
                          103.56.149.105
                          		unknownIndonesia
                          		55688BEON-AS-IDPTBeonIntermediaIDtrue
                          83.229.80.93
                          		unknownUnited Kingdom
                          		8513SKYVISIONGBtrue
                          85.25.120.45
                          		unknownGermany
                          		8972GD-EMEA-DC-SXB1DEtrue
                          198.199.70.22
                          		unknownUnited States
                          		14061DIGITALOCEAN-ASNUStrue
                          37.187.114.15
                          		unknownFrance
                          		16276OVHFRtrue
                          93.104.209.107
                          		unknownGermany
                          		8767MNET-ASGermanyDEtrue
                          175.126.176.79
                          		unknownKorea Republic of
                          		9523MOKWON-AS-KRMokwonUniversityKRtrue
                          139.196.72.155
                          		unknownChina
                          		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdtrue
                          128.199.242.164
                          		unknownUnited Kingdom
                          		14061DIGITALOCEAN-ASNUStrue
                          165.232.185.110
                          		unknownUnited States
                          		22255ALLEGHENYHEALTHNETWORKUStrue
                          104.248.225.227
                          		unknownUnited States
                          		14061DIGITALOCEAN-ASNUStrue
                          178.238.225.252
                          		unknownGermany
                          		51167CONTABODEtrue
                          128.199.217.206
                          		unknownUnited Kingdom
                          		14061DIGITALOCEAN-ASNUStrue
                          190.145.8.4
                          		unknownColombia
                          		14080TelmexColombiaSACOtrue
                          103.224.241.74
                          		unknownIndia
                          		133296WEBWERKS-AS-INWebWerksIndiaPvtLtdINtrue
                          103.71.99.57
                          		unknownIndia
                          		135682AWDHPL-AS-INAdvikaWebDevelopmentsHostingPvtLtdINtrue
                          190.107.19.179
                          		unknownColombia
                          		27951MediaCommercePartnersSACOtrue
                          210.57.209.142
                          		unknownIndonesia
                          		38142UNAIR-AS-IDUniversitasAirlanggaIDtrue
                          202.28.34.99
                          		unknownThailand
                          		9562MSU-TH-APMahasarakhamUniversityTHtrue
                          87.106.97.83
                          		unknownGermany
                          		8560ONEANDONE-ASBrauerstrasse48DEtrue
                          103.254.12.236
                          		unknownViet Nam
                          		56151DIGISTAR-VNDigiStarCompanyLimitedVNtrue
                          103.85.95.4
                          		unknownIndonesia
                          		136077IDNIC-UNSRAT-AS-IDUniversitasIslamNegeriMataramIDtrue
                          54.37.228.122
                          		unknownFrance
                          		16276OVHFRtrue
                          202.134.4.210
                          		unknownIndonesia
                          		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDtrue
                          88.217.172.165
                          		unknownGermany
                          		8767MNET-ASGermanyDEtrue
                          195.77.239.39
                          		unknownSpain
                          		60493FICOSA-ASEStrue
                          78.47.204.80
                          		unknownGermany
                          		24940HETZNER-ASDEtrue
                          139.59.80.108
                          		unknownSingapore
                          		14061DIGITALOCEAN-ASNUStrue
                          104.244.79.94
                          		unknownUnited States
                          		53667PONYNETUStrue
                          37.44.244.177
                          		unknownGermany
                          		47583AS-HOSTINGERLTtrue
                          178.62.112.199
                          		unknownEuropean Union
                          		14061DIGITALOCEAN-ASNUStrue
                          64.227.55.231
                          		unknownUnited States
                          		14061DIGITALOCEAN-ASNUStrue

                          Private

                          IP
                          192.168.2.1
                          127.0.0.1

                          General Information

                          Joe Sandbox Version:35.0.0 Citrine
                          Analysis ID:672062
                          Start date and time: 23/07/202204:55:072022-07-23 04:55:07 +02:00
                          Joe Sandbox Product:CloudBasic
                          Overall analysis duration:0h 9m 55s
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Sample file name:548IrCt4hj (renamed file extension from none to dll)
                          Cookbook file name:default.jbs
                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                          Number of analysed new started processes analysed:31
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • HCA enabled
                          • EGA enabled
                          • HDC enabled
                          • AMSI enabled
                          Analysis Mode:default
                          Analysis stop reason:Timeout
                          Detection:MAL
                          Classification:mal96.troj.evad.winDLL@21/5@0/44
                          EGA Information:
                          • Successful, ratio: 100%
                          HDC Information:Failed
                          HCA Information:
                          • Successful, ratio: 98%
                          • Number of executed functions: 16
                          • Number of non-executed functions: 351
                          Cookbook Comments:
                          • Adjust boot time
                          • Enable AMSI
                          • Override analysis time to 240s for rundll32

                          Warnings

                          • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, UsoClient.exe, wuapihost.exe
                          • Excluded IPs from analysis (whitelisted): 23.211.4.86, 20.223.24.244
                          • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, licensing.mp.microsoft.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, go.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                          • Not all processes where analyzed, report is missing behavior information
                          • Report size exceeded maximum capacity and may have missing behavior information.
                          • Report size exceeded maximum capacity and may have missing disassembly code.
                          • Report size getting too big, too many NtOpenKeyEx calls found.
                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                          • Report size getting too big, too many NtQueryValueKey calls found.

                          Simulations

                          Behavior and APIs

                          TimeTypeDescription
                          04:56:49API Interceptor11x Sleep call for process: svchost.exe modified

                          Joe Sandbox View / Context

                          IPs

                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                          157.230.99.2065CUFfVMSaQ.dllGet hashmaliciousBrowse
                            Bericht 6581.xlsGet hashmaliciousBrowse
                              PYCkUgesWB.dllGet hashmaliciousBrowse
                                nz032vqLOi.dllGet hashmaliciousBrowse
                                  nz032vqLOi.dllGet hashmaliciousBrowse
                                    azKC4bycQq.dllGet hashmaliciousBrowse
                                      HUrHMu39FU.dllGet hashmaliciousBrowse
                                        HUrHMu39FU.dllGet hashmaliciousBrowse
                                          5Fa665mRHe.dllGet hashmaliciousBrowse
                                            5Fa665mRHe.dllGet hashmaliciousBrowse
                                              8QfaZFMbEb.dllGet hashmaliciousBrowse
                                                P22l0y2mfd.dllGet hashmaliciousBrowse
                                                  xWvN5HkNDU.dllGet hashmaliciousBrowse
                                                    P22l0y2mfd.dllGet hashmaliciousBrowse
                                                      ik1z1nXXuU.dllGet hashmaliciousBrowse
                                                        td722u34As.dllGet hashmaliciousBrowse
                                                          MZ5g6cEEr6.dllGet hashmaliciousBrowse
                                                            2vMjDd8z34.dllGet hashmaliciousBrowse
                                                              R78g1mgKDg.dllGet hashmaliciousBrowse
                                                                MZ5g6cEEr6.dllGet hashmaliciousBrowse
                                                                  157.245.111.05CUFfVMSaQ.dllGet hashmaliciousBrowse
                                                                    Bericht 6581.xlsGet hashmaliciousBrowse
                                                                      PYCkUgesWB.dllGet hashmaliciousBrowse
                                                                        azKC4bycQq.dllGet hashmaliciousBrowse
                                                                          HUrHMu39FU.dllGet hashmaliciousBrowse
                                                                            HUrHMu39FU.dllGet hashmaliciousBrowse
                                                                              5Fa665mRHe.dllGet hashmaliciousBrowse
                                                                                8QfaZFMbEb.dllGet hashmaliciousBrowse
                                                                                  ik1z1nXXuU.dllGet hashmaliciousBrowse
                                                                                    xWvN5HkNDU.dllGet hashmaliciousBrowse
                                                                                      bOc8U9QEOx.dllGet hashmaliciousBrowse
                                                                                        P22l0y2mfd.dllGet hashmaliciousBrowse
                                                                                          ik1z1nXXuU.dllGet hashmaliciousBrowse
                                                                                            xWvN5HkNDU.dllGet hashmaliciousBrowse
                                                                                              td722u34As.dllGet hashmaliciousBrowse
                                                                                                MZ5g6cEEr6.dllGet hashmaliciousBrowse
                                                                                                  MZ5g6cEEr6.dllGet hashmaliciousBrowse
                                                                                                    JdRnXj2wcy.dllGet hashmaliciousBrowse
                                                                                                      2vMjDd8z34.dllGet hashmaliciousBrowse
                                                                                                        qwXRj48V2H.dllGet hashmaliciousBrowse

                                                                                                          Domains

                                                                                                          ⊘No context

                                                                                                          ASNs

                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                          DIGITALOCEAN-ASNUSMIpuuSiSZ4.dllGet hashmaliciousBrowse
                                                                                                          • 174.138.33.49
                                                                                                          MIpuuSiSZ4.dllGet hashmaliciousBrowse
                                                                                                          • 174.138.33.49
                                                                                                          5CUFfVMSaQ.dllGet hashmaliciousBrowse
                                                                                                          • 64.227.55.231
                                                                                                          U3qoYxBsNEGet hashmaliciousBrowse
                                                                                                          • 139.59.86.248
                                                                                                          http://nqbd51.blunteleven.link/235256643562325363523763622Get hashmaliciousBrowse
                                                                                                          • 198.211.98.91
                                                                                                          home.x86_64Get hashmaliciousBrowse
                                                                                                          • 178.62.131.179
                                                                                                          https://blognewstv.hs-sites-eu1.com/#0.67Get hashmaliciousBrowse
                                                                                                          • 138.197.158.95
                                                                                                          a4lomar.dllGet hashmaliciousBrowse
                                                                                                          • 165.22.201.70
                                                                                                          ak3pn.dllGet hashmaliciousBrowse
                                                                                                          • 165.22.201.70
                                                                                                          http://www.clearwaterfinancial.netGet hashmaliciousBrowse
                                                                                                          • 103.253.144.208
                                                                                                          https://www.goodnewsnetwork.org/renaissance-masterpiece-london-bedroom-dawsons/Get hashmaliciousBrowse
                                                                                                          • 159.89.246.130
                                                                                                          https://info.trib247.com/link.php?AGENCY=PMI&M=21052615&N=152605&L=83670&F=H&drurl=aHR0cHM6Ly9kYWk4Njk4LmNvLmpwLzEvb3cvP2U9aGlsbGllLm1leWVyQG1taWhvbGRpbmdzLmNvLnphGet hashmaliciousBrowse
                                                                                                          • 159.89.244.186
                                                                                                          http://clotizen.dothome.co.kr/members/lZTkIb3OkjcVGet hashmaliciousBrowse
                                                                                                          • 45.55.191.130
                                                                                                          sAeOYTx3B8.dllGet hashmaliciousBrowse
                                                                                                          • 134.209.46.175
                                                                                                          z2nfZVxMwA.dllGet hashmaliciousBrowse
                                                                                                          • 167.71.84.130
                                                                                                          qeI8ZyQCLt.dllGet hashmaliciousBrowse
                                                                                                          • 159.65.205.231
                                                                                                          9Cu6BA2WZZ.dllGet hashmaliciousBrowse
                                                                                                          • 104.236.16.253
                                                                                                          ZP8D67pACl.dllGet hashmaliciousBrowse
                                                                                                          • 206.189.204.63
                                                                                                          uXEN34vOBD.dllGet hashmaliciousBrowse
                                                                                                          • 159.203.7.216
                                                                                                          nB7LTrJ1JN.dllGet hashmaliciousBrowse
                                                                                                          • 46.101.216.212
                                                                                                          DIGITALOCEAN-ASNUSMIpuuSiSZ4.dllGet hashmaliciousBrowse
                                                                                                          • 174.138.33.49
                                                                                                          MIpuuSiSZ4.dllGet hashmaliciousBrowse
                                                                                                          • 174.138.33.49
                                                                                                          5CUFfVMSaQ.dllGet hashmaliciousBrowse
                                                                                                          • 64.227.55.231
                                                                                                          U3qoYxBsNEGet hashmaliciousBrowse
                                                                                                          • 139.59.86.248
                                                                                                          http://nqbd51.blunteleven.link/235256643562325363523763622Get hashmaliciousBrowse
                                                                                                          • 198.211.98.91
                                                                                                          home.x86_64Get hashmaliciousBrowse
                                                                                                          • 178.62.131.179
                                                                                                          https://blognewstv.hs-sites-eu1.com/#0.67Get hashmaliciousBrowse
                                                                                                          • 138.197.158.95
                                                                                                          a4lomar.dllGet hashmaliciousBrowse
                                                                                                          • 165.22.201.70
                                                                                                          ak3pn.dllGet hashmaliciousBrowse
                                                                                                          • 165.22.201.70
                                                                                                          http://www.clearwaterfinancial.netGet hashmaliciousBrowse
                                                                                                          • 103.253.144.208
                                                                                                          https://www.goodnewsnetwork.org/renaissance-masterpiece-london-bedroom-dawsons/Get hashmaliciousBrowse
                                                                                                          • 159.89.246.130
                                                                                                          https://info.trib247.com/link.php?AGENCY=PMI&M=21052615&N=152605&L=83670&F=H&drurl=aHR0cHM6Ly9kYWk4Njk4LmNvLmpwLzEvb3cvP2U9aGlsbGllLm1leWVyQG1taWhvbGRpbmdzLmNvLnphGet hashmaliciousBrowse
                                                                                                          • 159.89.244.186
                                                                                                          http://clotizen.dothome.co.kr/members/lZTkIb3OkjcVGet hashmaliciousBrowse
                                                                                                          • 45.55.191.130
                                                                                                          sAeOYTx3B8.dllGet hashmaliciousBrowse
                                                                                                          • 134.209.46.175
                                                                                                          z2nfZVxMwA.dllGet hashmaliciousBrowse
                                                                                                          • 167.71.84.130
                                                                                                          qeI8ZyQCLt.dllGet hashmaliciousBrowse
                                                                                                          • 159.65.205.231
                                                                                                          9Cu6BA2WZZ.dllGet hashmaliciousBrowse
                                                                                                          • 104.236.16.253
                                                                                                          ZP8D67pACl.dllGet hashmaliciousBrowse
                                                                                                          • 206.189.204.63
                                                                                                          uXEN34vOBD.dllGet hashmaliciousBrowse
                                                                                                          • 159.203.7.216
                                                                                                          nB7LTrJ1JN.dllGet hashmaliciousBrowse
                                                                                                          • 46.101.216.212

                                                                                                          JA3 Fingerprints

                                                                                                          ⊘No context

                                                                                                          Dropped Files

                                                                                                          ⊘No context

                                                                                                          Created / dropped Files

                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                                          Download File
                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):8192
                                                                                                          Entropy (8bit):0.3593198815979092
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                                                                                                          MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                                                                                                          SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                                                                                                          SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                                                                                                          SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                                                                                                          Malicious:false
                                                                                                          Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                          Download File
                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                          File Type:MPEG-4 LOAS
                                                                                                          Category:dropped
                                                                                                          Size (bytes):1310720
                                                                                                          Entropy (8bit):0.24948615150342127
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4X:BJiRdwfu2SRU4X
                                                                                                          MD5:8302100D8C0781AFFA569599554A747D
                                                                                                          SHA1:2AD4A77D9A42C5905F5B8FBAAACCFAB60CA60CD3
                                                                                                          SHA-256:8F307CAB2013948ADA4DFE98A26132AC3BDF98B917EB84BBA843DE5977A18C05
                                                                                                          SHA-512:66FECADDA311CE2AF81A7F4875E4F775581373BD23C1F2AA5C2136A174B6814EAB09A98DA9A98CA6834B1123A1740D2FF1524C5A643A6D16B6A4945BCE9DA0F2
                                                                                                          Malicious:false
                                                                                                          Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                          Download File
                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0x9292e26a, page size 16384, Windows version 10.0
                                                                                                          Category:dropped
                                                                                                          Size (bytes):786432
                                                                                                          Entropy (8bit):0.2507291590936865
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:384:L7U+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:L7rSB2nSB2RSjlK/+mLesOj1J2
                                                                                                          MD5:C50F19CC34E36AE9D8945ECDF6CABAD5
                                                                                                          SHA1:15A5137868B1A5D0B8BC5E506A12052CE5CB0AA1
                                                                                                          SHA-256:C9A0DFC6BC8086E76E08B4237104495011053AFF5F8DC0D99735BD3A55563327
                                                                                                          SHA-512:E660C4EE50CD6F3DE9CF6C3F790B464CC5EE03173DF58DFF1F1D7C11D454DA880F6B85BCB5C54FCA4032D8AE62420E175CDFB8E80112EA32388DFD1DECE1202E
                                                                                                          Malicious:false
                                                                                                          Preview:...j... ................e.f.3...w........................).....:;...z..18...z..h.(.....:;...z....)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................E...:;...z....................\:;...z..........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                          Download File
                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                          File Type:data
                                                                                                          Category:dropped
                                                                                                          Size (bytes):16384
                                                                                                          Entropy (8bit):0.07701426796525257
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:3:kmtR7vUduyi0f2l/of7CnEe9irtlNyfeuZCl/ill3Vkttlmlnl:vtRrUDf2lwf2ntI6Ole3
                                                                                                          MD5:3356637935306EB31EC34EF8F4F51FDE
                                                                                                          SHA1:C1F3106EFAB78E6B7AD03FEBEDBA313849D71462
                                                                                                          SHA-256:01E4C7BAED15BB1CBCB4358951970B0080D9F3CE5652A3076424C5C6F767903B
                                                                                                          SHA-512:F639059B00AB53B6F6473F054E9CF1540FC52EA55940320A2E960583B5E2409C89F4739AB75B03C26085FC114EC99AB35137FE0690B8E3F3A2EEB9B818102EBA
                                                                                                          Malicious:false
                                                                                                          Preview:..4......................................3...w..18...z..:;...z..........:;...z..:;...z.....:;...z.g..................\:;...z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                          C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                          Download File
                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                          Category:dropped
                                                                                                          Size (bytes):55
                                                                                                          Entropy (8bit):4.306461250274409
                                                                                                          Encrypted:false
                                                                                                          SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                          MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                          SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                          SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                          SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                          Malicious:false
                                                                                                          Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                          Static File Info

                                                                                                          General

                                                                                                          File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                          Entropy (8bit):6.301831913358297
                                                                                                          TrID:
                                                                                                          • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
                                                                                                          • Win64 Executable (generic) (12005/4) 10.17%
                                                                                                          • Generic Win/DOS Executable (2004/3) 1.70%
                                                                                                          • DOS Executable Generic (2002/1) 1.70%
                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
                                                                                                          File name:548IrCt4hj.dll
                                                                                                          File size:962048
                                                                                                          MD5:7301880b88f87cd3a593f7106d5743cc
                                                                                                          SHA1:c8a2b0ae061b612f4d4a4cfc4ee3e1f7079b4240
                                                                                                          SHA256:c409ad4f64a1ad925ffbfdb88f57dd9177123364a1875caf6cbb6f5ba3970cc3
                                                                                                          SHA512:3abf4d6b0725cae5fd05edccdac75e5061ebcc033e24fbd73482fabe53bd1f914490f3bfda638bd623e642200e8499539b0541bb95d5c7040410d2ff209a640a
                                                                                                          SSDEEP:12288:kvyPTUfrN+lSDLV9dRCYFdVlv6jVBv4w8N6zTlvdEywUshhxmIssuqvY/J9ujv7X:k6Ufgl15qhxm1qvY2leXA
                                                                                                          TLSH:0515BF6677E81291D0B7D13F8AA78B49EAF2BC041734A7CB0184525D2F23BD85A3F725
                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........71x.V_+.V_+.V_+p$\*.V_+p$Z*&V_+.#[*.V_+.#\*.V_+.#Z*.V_+p$[*.V_+p$^*.V_+.V^+ V_+b#Z*.V_+b#_*.V_+b#.+.V_+.V.+.V_+b#]*.V_+Rich.V_

                                                                                                          File Icon

                                                                                                          Icon Hash:74f0e4ecccdce0e4

                                                                                                          Static PE Info

                                                                                                          General

                                                                                                          Entrypoint:0x18000110e
                                                                                                          Entrypoint Section:.text
                                                                                                          Digitally signed:false
                                                                                                          Imagebase:0x180000000
                                                                                                          Subsystem:windows gui
                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
                                                                                                          DLL Characteristics:HIGH_ENTROPY_VA, NX_COMPAT
                                                                                                          Time Stamp:0x62C329A8 [Mon Jul 4 17:55:52 2022 UTC]
                                                                                                          TLS Callbacks:
                                                                                                          CLR (.Net) Version:
                                                                                                          OS Version Major:6
                                                                                                          OS Version Minor:0
                                                                                                          File Version Major:6
                                                                                                          File Version Minor:0
                                                                                                          Subsystem Version Major:6
                                                                                                          Subsystem Version Minor:0
                                                                                                          Import Hash:c8e804de36681c3fb89b2f7688123f2b

                                                                                                          Entrypoint Preview

                                                                                                          Instruction
                                                                                                          jmp 00007F2F1CD86BDEh
                                                                                                          jmp 00007F2F1CDDD9C5h
                                                                                                          jmp 00007F2F1CD9B3ECh
                                                                                                          jmp 00007F2F1CDC6AABh
                                                                                                          jmp 00007F2F1CDBA522h
                                                                                                          jmp 00007F2F1CD9E8E1h
                                                                                                          jmp 00007F2F1CD85270h
                                                                                                          jmp 00007F2F1CD99933h
                                                                                                          jmp 00007F2F1CD79DEAh
                                                                                                          jmp 00007F2F1CDA7131h
                                                                                                          jmp 00007F2F1CDA4F6Ch
                                                                                                          jmp 00007F2F1CDA720Bh
                                                                                                          jmp 00007F2F1CDC9686h
                                                                                                          jmp 00007F2F1CD7F4E1h
                                                                                                          jmp 00007F2F1CD87294h
                                                                                                          jmp 00007F2F1CD99937h
                                                                                                          jmp 00007F2F1CDE83DEh
                                                                                                          jmp 00007F2F1CDA0781h
                                                                                                          jmp 00007F2F1CDC4B98h
                                                                                                          jmp 00007F2F1CDB7D13h
                                                                                                          jmp 00007F2F1CDD8B16h
                                                                                                          jmp 00007F2F1CDD23B5h
                                                                                                          jmp 00007F2F1CDB1E44h
                                                                                                          jmp 00007F2F1CDC3DC3h
                                                                                                          jmp 00007F2F1CDC41A6h
                                                                                                          jmp 00007F2F1CDE8485h
                                                                                                          jmp 00007F2F1CDD1DE0h
                                                                                                          jmp 00007F2F1CD8A2FFh
                                                                                                          jmp 00007F2F1CD88E16h
                                                                                                          jmp 00007F2F1CDC5A9Dh
                                                                                                          jmp 00007F2F1CD8A7A4h
                                                                                                          jmp 00007F2F1CDCF6C3h
                                                                                                          jmp 00007F2F1CDCDBE6h
                                                                                                          jmp 00007F2F1CD9A6FDh
                                                                                                          jmp 00007F2F1CD8EE28h
                                                                                                          jmp 00007F2F1CDC7E33h
                                                                                                          jmp 00007F2F1CD9A902h
                                                                                                          jmp 00007F2F1CDDB649h
                                                                                                          jmp 00007F2F1CDB7C9Ch
                                                                                                          jmp 00007F2F1CD99A3Fh

                                                                                                          Data Directories

                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0xb07c00x1c9.rdata
                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xbb6e80x8c.idata
                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xbf0000x30ebd.rsrc
                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0xb50000x4ea8.pdata
                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xf00000xd78.reloc
                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa63200x138.rdata
                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0xbb0000x6e8.idata
                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                          Sections

                                                                                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                          .text0x10000x8a5ca0x8a600False0.3069634993224932data5.641927945052085IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                          .rdata0x8c0000x249890x24a00False0.2668981975255973data4.201809080615527IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          .data0xb10000x39600x1800False0.13834635416666666data2.2672137141142894IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                          .pdata0xb50000x57a80x5800False0.5007990056818182data5.516669615542349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          .idata0xbb0000x18d10x1a00False0.2459435096153846data3.49134963905175IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          .00cfg0xbd0000x1510x200False0.05859375data0.3458273094223054IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          _RDATA0xbe0000x2220x400False0.16796875data1.4491445801684228IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          .rsrc0xbf0000x30ebd0x31000False0.8592952806122449data7.7601261539979545IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                          .reloc0xf00000x194d0x1a00False0.21875data3.637638102515201IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                          Resources

                                                                                                          NameRVASizeTypeLanguageCountry
                                                                                                          REGISTRY0xbf19c0x1d4ASCII textEnglishUnited States
                                                                                                          TYPELIB0xbf3700x3398dataEnglishUnited States
                                                                                                          RT_STRING0xc27080x36dataEnglishUnited States
                                                                                                          RT_HTML0xc27400x2d600dataEnglishUnited States
                                                                                                          RT_MANIFEST0xefd400x17dXML 1.0 document textEnglishUnited States

                                                                                                          Imports

                                                                                                          DLLImport
                                                                                                          ODBC32.dll
                                                                                                          KERNEL32.dllFlushFileBuffers, SetStdHandle, SetFilePointerEx, EncodePointer, DecodePointer, RaiseException, GetLastError, QueryPerformanceFrequency, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, VirtualAlloc, DisableThreadLibraryCalls, WriteFile, GetModuleFileNameW, GetModuleHandleW, GetProcAddress, LoadLibraryExW, LoadResource, SizeofResource, FindResourceW, lstrcmpiW, MultiByteToWideChar, GetFileSizeEx, GetStringTypeW, SetConsoleCtrlHandler, GetProcessHeap, EnumSystemLocalesW, GetUserDefaultLCID, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, CloseHandle, CreateFileW, WriteConsoleW, FreeLibrary, SetUnhandledExceptionFilter, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, IsDebuggerPresent, OutputDebugStringW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, RtlUnwind, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, InterlockedPushEntrySList, InterlockedFlushSList, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, GetCurrentThread, HeapFree, HeapAlloc, HeapSize, HeapReAlloc, GetStdHandle, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW
                                                                                                          USER32.dllShowWindow, CharNextW, UnregisterClassW, MessageBoxA
                                                                                                          ADVAPI32.dllRegQueryInfoKeyW, RegOpenKeyExW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, RegSetValueExW
                                                                                                          ole32.dllCoCreateInstance, CoCreateFreeThreadedMarshaler, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, CoInitialize, StringFromGUID2
                                                                                                          OLEAUT32.dllLoadTypeLib, UnRegisterTypeLib, VarUI4FromStr, SysFreeString, SysAllocString

                                                                                                          Exports

                                                                                                          NameOrdinalAddress
                                                                                                          DllCanUnloadNow10x180003102
                                                                                                          DllGetClassObject20x180003be3
                                                                                                          DllRegisterServer30x1800013fc
                                                                                                          DllUnregisterServer40x180003521

                                                                                                          Possible Origin

                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                          EnglishUnited States

                                                                                                          Network Behavior

                                                                                                          Snort IDS Alerts

                                                                                                          TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                          192.168.2.5174.138.33.494976870802404316 07/23/22-04:56:42.473067TCP2404316ET CNC Feodo Tracker Reported CnC Server TCP group 9497687080192.168.2.5174.138.33.49

                                                                                                          Network Port Distribution

                                                                                                          TCP Packets

                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                          Jul 23, 2022 04:56:42.473067045 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:42.574515104 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:42.574670076 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:42.607347012 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:42.713720083 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:42.744929075 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:42.744982958 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:42.745028019 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:42.745078087 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:43.195605040 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:43.300020933 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:43.300179005 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:43.303195000 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:43.444097042 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:43.895623922 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:43.896034956 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:46.909363031 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:46.909475088 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:56:46.909478903 CEST708049768174.138.33.49192.168.2.5
                                                                                                          Jul 23, 2022 04:56:46.909584045 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:58:32.400583029 CEST497687080192.168.2.5174.138.33.49
                                                                                                          Jul 23, 2022 04:58:32.400631905 CEST497687080192.168.2.5174.138.33.49

                                                                                                          Statistics

                                                                                                          CPU Usage

                                                                                                          Click to jump to process

                                                                                                          Memory Usage

                                                                                                          Click to jump to process

                                                                                                          High Level Behavior Distribution

                                                                                                          Click to dive into process behavior distribution

                                                                                                          Behavior

                                                                                                          Click to jump to process

                                                                                                          System Behavior

                                                                                                          General

                                                                                                          Target ID:3
                                                                                                          Start time:04:56:13
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\loaddll64.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:loaddll64.exe "C:\Users\user\Desktop\548IrCt4hj.dll"
                                                                                                          Imagebase:0x7ff6044c0000
                                                                                                          File size:140288 bytes
                                                                                                          MD5 hash:4E8A40CAD6CCC047914E3A7830A2D8AA
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:4
                                                                                                          Start time:04:56:14
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1
                                                                                                          Imagebase:0x7ff602050000
                                                                                                          File size:273920 bytes
                                                                                                          MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:5
                                                                                                          Start time:04:56:14
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\regsvr32.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:regsvr32.exe /s C:\Users\user\Desktop\548IrCt4hj.dll
                                                                                                          Imagebase:0x7ff776530000
                                                                                                          File size:24064 bytes
                                                                                                          MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Yara matches:
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.427012616.0000000001120000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:6
                                                                                                          Start time:04:56:14
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\rundll32.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:rundll32.exe "C:\Users\user\Desktop\548IrCt4hj.dll",#1
                                                                                                          Imagebase:0x7ff79d320000
                                                                                                          File size:69632 bytes
                                                                                                          MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Yara matches:
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.422757747.000001F33EB00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.422895400.000001F33EC51000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:7
                                                                                                          Start time:04:56:14
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\rundll32.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllCanUnloadNow
                                                                                                          Imagebase:0x7ff79d320000
                                                                                                          File size:69632 bytes
                                                                                                          MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Yara matches:
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.424123479.000001E034440000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.424307117.000001E034471000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:10
                                                                                                          Start time:04:56:17
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\regsvr32.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZPLPsNKH\eFntQ.dll"
                                                                                                          Imagebase:0x7ff776530000
                                                                                                          File size:24064 bytes
                                                                                                          MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Yara matches:
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.940693332.0000000000C20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.940812969.00000000024B1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          • Rule: JoeSecurity_Emotet_3, Description: , Source: 0000000A.00000002.940180760.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:11
                                                                                                          Start time:04:56:18
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\rundll32.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllGetClassObject
                                                                                                          Imagebase:0x7ff79d320000
                                                                                                          File size:69632 bytes
                                                                                                          MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:12
                                                                                                          Start time:04:56:21
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\rundll32.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:rundll32.exe C:\Users\user\Desktop\548IrCt4hj.dll,DllRegisterServer
                                                                                                          Imagebase:0x7ff79d320000
                                                                                                          File size:69632 bytes
                                                                                                          MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:16
                                                                                                          Start time:04:56:35
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                          Imagebase:0x7ff78ca80000
                                                                                                          File size:51288 bytes
                                                                                                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language
                                                                                                          Reputation:high

                                                                                                          General

                                                                                                          Target ID:18
                                                                                                          Start time:04:56:42
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                          Imagebase:0x7ff78ca80000
                                                                                                          File size:51288 bytes
                                                                                                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language

                                                                                                          General

                                                                                                          Target ID:19
                                                                                                          Start time:04:56:49
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                          Imagebase:0x7ff78ca80000
                                                                                                          File size:51288 bytes
                                                                                                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language

                                                                                                          General

                                                                                                          Target ID:20
                                                                                                          Start time:04:56:58
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                          Imagebase:0x7ff78ca80000
                                                                                                          File size:51288 bytes
                                                                                                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language

                                                                                                          General

                                                                                                          Target ID:21
                                                                                                          Start time:04:56:59
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                                                          Imagebase:0x7ff78ca80000
                                                                                                          File size:51288 bytes
                                                                                                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language

                                                                                                          General

                                                                                                          Target ID:25
                                                                                                          Start time:04:57:11
                                                                                                          Start date:23/07/2022
                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                          Wow64 process (32bit):false
                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                          Imagebase:0x7ff78ca80000
                                                                                                          File size:51288 bytes
                                                                                                          MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                          Has elevated privileges:true
                                                                                                          Has administrator privileges:true
                                                                                                          Programmed in:C, C++ or other language

                                                                                                          Disassembly

                                                                                                          Reset < >

                                                                                                            Execution Graph

                                                                                                            Execution Coverage:3.4%
                                                                                                            Dynamic/Decrypted Code Coverage:48.5%
                                                                                                            Signature Coverage:45.6%
                                                                                                            Total number of Nodes:68
                                                                                                            Total number of Limit Nodes:12
                                                                                                            execution_graph 41735 1800040a7 41736 18006d5e8 41735->41736 41737 18006d62a 41736->41737 41739 1800696ec 41736->41739 41740 18006973e 41739->41740 41741 1800696f9 41739->41741 41740->41736 41745 1800028ba 41741->41745 41743 180069728 41751 1800692f4 41743->41751 41745->41743 41749 18005fb04 41745->41749 41746 18005fba5 GetLastError 41750 18005fbf4 _invalid_parameter_noinfo 41746->41750 41747 18005fb28 _invalid_parameter_noinfo 41747->41743 41748 18005fc7d SetLastError 41748->41743 41749->41746 41749->41747 41750->41748 41752 180069329 41751->41752 41759 180068f28 41752->41759 41756 180069357 41758 180069346 41756->41758 41769 180003d69 7 API calls 41756->41769 41758->41740 41760 180068f3c 41759->41760 41761 180068f48 GetOEMCP 41760->41761 41762 180068f5a 41760->41762 41763 180068f6f 41761->41763 41762->41763 41764 180068f5f GetACP 41762->41764 41763->41758 41765 18000103c 41763->41765 41764->41763 41765->41756 41768 180062abc 41765->41768 41766 180062aee HeapAlloc 41767 180062b05 41766->41767 41766->41768 41767->41756 41768->41766 41768->41767 41769->41758 41770 e60000 41771 e60183 41770->41771 41772 e6043e VirtualAlloc 41771->41772 41776 e60462 41772->41776 41773 e60531 GetNativeSystemInfo 41774 e6056d VirtualAlloc 41773->41774 41780 e60a7b 41773->41780 41775 e6058b VirtualAlloc 41774->41775 41777 e605a0 41774->41777 41775->41777 41776->41773 41776->41780 41778 e60a00 41777->41778 41781 e609d9 VirtualProtect 41777->41781 41779 e60a56 RtlAddFunctionTable 41778->41779 41778->41780 41779->41780 41781->41777 41782 11618e0 41785 116a804 41782->41785 41784 11619fe 41786 116a848 41785->41786 41787 116ab3a 41786->41787 41788 116ab06 Process32NextW 41786->41788 41787->41784 41788->41786 41789 11593ac 41796 11593f7 41789->41796 41790 115aeb4 41802 116f764 CreateProcessW 41790->41802 41792 115ae75 41796->41790 41796->41792 41798 1163e18 Process32NextW 41796->41798 41799 116762c Process32NextW 41796->41799 41800 11693e0 Process32NextW 41796->41800 41801 1176b40 CreateProcessW 41796->41801 41798->41796 41799->41796 41800->41796 41801->41796 41802->41792 41803 180066360 41806 180066371 41803->41806 41804 1800663a6 HeapAlloc 41805 1800663c0 41804->41805 41804->41806 41806->41804 41806->41805 41807 1800013fc 41808 18000f9f4 41807->41808 41809 18000fa13 ExitProcess 41808->41809 41810 116e4a8 41811 116e4e8 41810->41811 41814 1167414 41811->41814 41813 116e6b6 41816 11674b5 41814->41816 41815 11675e6 CreateProcessW 41815->41813 41816->41815

                                                                                                            Executed Functions

                                                                                                            Function 00E60000 Relevance: 78.1, APIs: 6, Strings: 38, Instructions: 1094memoryCOMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 0 e60000-e60460 call e60aa8 * 2 VirtualAlloc 22 e60462-e60466 0->22 23 e6048a-e60494 0->23 24 e60468-e60488 22->24 26 e60a91-e60aa6 23->26 27 e6049a-e6049e 23->27 24->23 24->24 27->26 28 e604a4-e604a8 27->28 28->26 29 e604ae-e604b2 28->29 29->26 30 e604b8-e604bf 29->30 30->26 31 e604c5-e604d2 30->31 31->26 32 e604d8-e604e1 31->32 32->26 33 e604e7-e604f4 32->33 33->26 34 e604fa-e60507 33->34 35 e60531-e60567 GetNativeSystemInfo 34->35 36 e60509-e60511 34->36 35->26 37 e6056d-e60589 VirtualAlloc 35->37 38 e60513-e60518 36->38 39 e605a0-e605ac 37->39 40 e6058b-e6059e VirtualAlloc 37->40 41 e60521 38->41 42 e6051a-e6051f 38->42 43 e605af-e605b2 39->43 40->39 44 e60523-e6052f 41->44 42->44 45 e605b4-e605bf 43->45 46 e605c1-e605db 43->46 44->35 44->38 45->43 47 e605dd-e605e2 46->47 48 e6061b-e60622 46->48 49 e605e4-e605ea 47->49 50 e606db-e606e2 48->50 51 e60628-e6062f 48->51 52 e605ec-e60609 49->52 53 e6060b-e60619 49->53 55 e60864-e6086b 50->55 56 e606e8-e606f9 50->56 51->50 54 e60635-e60642 51->54 52->52 52->53 53->48 53->49 54->50 59 e60648-e6064f 54->59 57 e60917-e60929 55->57 58 e60871-e6087f 55->58 60 e60702-e60705 56->60 63 e60a07-e60a1a 57->63 64 e6092f-e60937 57->64 65 e6090e-e60911 58->65 66 e60654-e60658 59->66 61 e60707-e6070a 60->61 62 e606fb-e606ff 60->62 67 e6070c-e6071d 61->67 68 e60788-e6078e 61->68 62->60 83 e60a40-e60a4a 63->83 84 e60a1c-e60a27 63->84 70 e6093b-e6093f 64->70 65->57 69 e60884-e608a9 65->69 71 e606c0-e606ca 66->71 72 e60794-e607a2 67->72 73 e6071f-e60720 67->73 68->72 101 e60907-e6090c 69->101 102 e608ab-e608b1 69->102 77 e60945-e6095a 70->77 78 e609ec-e609fa 70->78 75 e606cc-e606d2 71->75 76 e6065a-e60669 71->76 85 e6085d-e6085e 72->85 86 e607a8 72->86 82 e60722-e60784 73->82 75->66 87 e606d4-e606d5 75->87 79 e6067a-e6067e 76->79 80 e6066b-e60678 76->80 89 e6095c-e6095e 77->89 90 e6097b-e6097d 77->90 78->70 81 e60a00-e60a01 78->81 92 e60680-e6068a 79->92 93 e6068c-e60690 79->93 91 e606bd-e606be 80->91 81->63 82->82 96 e60786 82->96 99 e60a4c-e60a54 83->99 100 e60a7b-e60a8e 83->100 97 e60a38-e60a3e 84->97 85->55 98 e607ae-e607d4 86->98 87->50 103 e60960-e6096c 89->103 104 e6096e-e60979 89->104 94 e609a2-e609a4 90->94 95 e6097f-e60981 90->95 91->71 106 e606b6-e606ba 92->106 109 e606a5-e606a9 93->109 110 e60692-e606a3 93->110 111 e609a6-e609aa 94->111 112 e609ac-e609bb 94->112 107 e60983-e60987 95->107 108 e60989-e6098b 95->108 96->72 97->83 115 e60a29-e60a35 97->115 130 e607d6-e607d9 98->130 131 e60835-e60839 98->131 99->100 116 e60a56-e60a79 RtlAddFunctionTable 99->116 100->26 101->65 113 e608b3-e608b9 102->113 114 e608bb-e608c8 102->114 105 e609be-e609bf 103->105 104->105 119 e609c5-e609cb 105->119 106->91 107->105 108->94 117 e6098d-e6098f 108->117 109->91 118 e606ab-e606b3 109->118 110->106 111->105 112->105 120 e608ea-e608fe 113->120 121 e608d3-e608e5 114->121 122 e608ca-e608d1 114->122 115->97 116->100 125 e60991-e60997 117->125 126 e60999-e609a0 117->126 118->106 127 e609cd-e609d3 119->127 128 e609d9-e609e9 VirtualProtect 119->128 120->101 138 e60900-e60905 120->138 121->120 122->121 122->122 125->105 126->119 127->128 128->78 135 e607e3-e607f0 130->135 136 e607db-e607e1 130->136 132 e60844-e60850 131->132 133 e6083b 131->133 132->98 137 e60856-e60857 132->137 133->132 140 e607f2-e607f9 135->140 141 e607fb-e6080d 135->141 139 e60812-e6082c 136->139 137->85 138->102 139->131 143 e6082e-e60833 139->143 140->140 140->141 141->139 143->130
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.426446620.0000000000E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_e60000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                                                            • String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
                                                                                                            • API String ID: 394283112-2517549848
                                                                                                            • Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                                                            • Instruction ID: ad915f7416366a0cbd7d693a4f0054d8cba45c58389ab9ea38b59f73066146bf
                                                                                                            • Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
                                                                                                            • Instruction Fuzzy Hash: BB72E630658B488FCB29DF18D8856BAB7E1FB98345F10562DE8CBD7211DB34E942CB85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002829 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 154memorythreadwindowCOMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AllocTask$CallsDisableFreeInitializeLibraryMessageShowThreadVirtualWindow
                                                                                                            • String ID: 667363522$8192$9!88(K49IpmK#gbYNM9Xc1oA#mGdTiMDp70uq80d^#n8r(@ZTdU8
                                                                                                            • API String ID: 98061949-2151394374
                                                                                                            • Opcode ID: c8280d6728965f4859096c21966f882edc6b1d2bb1c7841a32d3bcabe5ff4bc7
                                                                                                            • Instruction ID: bda7fdddac5deb2c5f0d0f0805fdd9651d33e20ce5ea18f1b74971ed2ae2eb7d
                                                                                                            • Opcode Fuzzy Hash: c8280d6728965f4859096c21966f882edc6b1d2bb1c7841a32d3bcabe5ff4bc7
                                                                                                            • Instruction Fuzzy Hash: 0A717931210A4C8AEBA6DF24E8687E933A0F74C7D6F85C526E909876A4DF7CC74D8700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01155B18 Relevance: 5.7, Strings: 4, Instructions: 709COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: !$iv$uu$uu
                                                                                                            • API String ID: 0-314779803
                                                                                                            • Opcode ID: 79a95fb5371fe96ee0f92000361a908545c9eb830f7d8d6e45959be12755bb26
                                                                                                            • Instruction ID: d0e41ad285ab1014d5d897b24c38148ac2aa12b4896b09247d0f1bc691c51737
                                                                                                            • Opcode Fuzzy Hash: 79a95fb5371fe96ee0f92000361a908545c9eb830f7d8d6e45959be12755bb26
                                                                                                            • Instruction Fuzzy Hash: 9A72D97150064ECFDB48DF28C89A4DE3FA1FB68398F214219FC4A962A0D778D5A5CBC4
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115CCC8 Relevance: 5.3, Strings: 4, Instructions: 291COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: %V"$;<8$>A%3$_
                                                                                                            • API String ID: 0-3295070022
                                                                                                            • Opcode ID: c03509b85431d9cd247ae3855a418badeaf1e36b81dfd63c0d88c72341702a4b
                                                                                                            • Instruction ID: c021ad1aba35eaa8c1b4b0afd879258b27203d26e8f0f0159f1626fab5d52da6
                                                                                                            • Opcode Fuzzy Hash: c03509b85431d9cd247ae3855a418badeaf1e36b81dfd63c0d88c72341702a4b
                                                                                                            • Instruction Fuzzy Hash: 88D1E07151A781ABD388DF28C5DA81BBBF1FBD4758F806A1DF8C6862A0D774D805CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01168B3C Relevance: 4.1, Strings: 3, Instructions: 372COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 275 1168b3c-1168b7c 276 1168b7e 275->276 277 1168b80-1168b86 276->277 278 11693c0 277->278 279 1168b8c-1168b92 277->279 280 11693c5-11693cb 278->280 281 1168fd6-1168fe0 279->281 282 1168b98-1168b9e 279->282 280->277 283 11693d1-11693de 280->283 284 1168fe2-1169011 281->284 285 1169013-1169043 281->285 282->280 286 1168ba4-1168dab call 1153be8 call 116a728 282->286 287 116904d-11693a0 call 1178648 call 116a728 call 116264c 284->287 285->287 296 1168db2-1168fcb call 116a728 call 116264c 286->296 297 1168dad 286->297 301 11693a5-11693af 287->301 296->283 305 1168fd1 296->305 297->296 301->283 302 11693b1-11693bb 301->302 302->277 305->276
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: [f$\$1
                                                                                                            • API String ID: 0-3516292800
                                                                                                            • Opcode ID: fff8eda2a2f97c74ebe90de9de009a0ff03563e687b00f5f7246eec12eb55319
                                                                                                            • Instruction ID: 6c7e84f3255e937ab608de3387e72dfb28c5c2b1ea9877e1e806f97afc3cc2b5
                                                                                                            • Opcode Fuzzy Hash: fff8eda2a2f97c74ebe90de9de009a0ff03563e687b00f5f7246eec12eb55319
                                                                                                            • Instruction Fuzzy Hash: 7B22E6715057C8CBEBBECFA4D889ACD7BA8FB44B44F10561EE84AEA250DBB45744CB01
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116EB08 Relevance: 3.9, Strings: 3, Instructions: 143COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 0g$`/$eU
                                                                                                            • API String ID: 0-1869587935
                                                                                                            • Opcode ID: e42517781b4c5a6e2395bcec890ae724bc5a418ada587a66dde62167571468c0
                                                                                                            • Instruction ID: 06ddf4244108e81e83e940b95c03fc1e4d6cfb56e4e192f9b203ca5e1a7c55f8
                                                                                                            • Opcode Fuzzy Hash: e42517781b4c5a6e2395bcec890ae724bc5a418ada587a66dde62167571468c0
                                                                                                            • Instruction Fuzzy Hash: 2F61CA705187808FD3A8DF29C58951BBBF1FBD6748F004A1DE68A862A4D7B6D809CF47
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01167414 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130processCOMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 317 1167414-11674df call 1151000 320 11675e6-116762a CreateProcessW 317->320 321 11674e5-11675e0 call 117412c 317->321 321->320
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID: CreateProcess
                                                                                                            • String ID: L[
                                                                                                            • API String ID: 963392458-3786185354
                                                                                                            • Opcode ID: 806773b70e7ab706d630f49173ef1c4c2e45366edcb4d6d18c8755d8a62b8c06
                                                                                                            • Instruction ID: 71bb222aad13521b24792c4e2650d1349ac9eb277e05bcff52fc5603fca8bc55
                                                                                                            • Opcode Fuzzy Hash: 806773b70e7ab706d630f49173ef1c4c2e45366edcb4d6d18c8755d8a62b8c06
                                                                                                            • Instruction Fuzzy Hash: 2351287061C7858FE778DF18D48A7AABBE0FB88315F104A2EE49DC7255DB749884CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116C8C0 Relevance: 2.6, Strings: 2, Instructions: 60COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 328 116c8c0-116c9e2 call 1151000 call 115be9c call 115cb6c 334 116c9e7-116c9ec 328->334
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: X2$}q
                                                                                                            • API String ID: 0-380955408
                                                                                                            • Opcode ID: 95590018382b9876e4c8128225c2283738dbe38793f10dd7529eabebcd26e986
                                                                                                            • Instruction ID: 31f1b956ff25c2da851ddd44506e42eb534a28d4e1174261598d0a0ae678996e
                                                                                                            • Opcode Fuzzy Hash: 95590018382b9876e4c8128225c2283738dbe38793f10dd7529eabebcd26e986
                                                                                                            • Instruction Fuzzy Hash: 8B21B4B011A741ABD7C8DF24C2CA51BBBE0BBC4B58FD0791DF492862A0D378D8448B47
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01161B88 Relevance: 1.8, Strings: 1, Instructions: 586COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 335 1161b88-1161c3a call 1151000 338 1161c3d-1161c43 335->338 339 116202b-1162031 338->339 340 1161c49 338->340 343 1162037-116203d 339->343 344 11621df-1162384 call 116dd40 339->344 341 1161fa6-1162021 call 1153424 340->341 342 1161c4f-1161c55 340->342 341->339 345 1161c5b-1161c61 342->345 346 1162438-11624bd call 116c8c0 342->346 349 1162043-1162049 343->349 350 116212e-11621c4 call 115c290 343->350 366 1162416 344->366 367 116238a-1162411 call 1171c2c 344->367 355 1161c67-1161c6d 345->355 356 1161f9c-1161fa1 345->356 362 11624c2-11624e2 346->362 351 1162071-1162129 call 115c290 349->351 352 116204b-1162051 349->352 363 11621c9-11621cf 350->363 377 1161cf2-1161cfe 351->377 359 1162427-116242d 352->359 360 1162057-116206c 352->360 364 1161ed2-1161f7e call 1152c68 355->364 365 1161c73-1161c79 355->365 356->338 359->362 369 1162433 359->369 360->338 363->362 372 11621d5-11621da 363->372 378 1161f83-1161f91 364->378 373 1161d03-1161ecd call 11787d8 call 116ba80 365->373 374 1161c7f-1161c85 365->374 368 116241b-1162424 366->368 367->377 368->359 369->338 372->377 373->368 374->359 379 1161c8b-1161ced call 116c8c0 374->379 377->338 378->356 379->377
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: w@
                                                                                                            • API String ID: 0-3933844196
                                                                                                            • Opcode ID: 5e190d2b37476e442a844b01a1e6e2b4e7978620d8c54b7cf5e7142be065b825
                                                                                                            • Instruction ID: 2e28f1802b5eb4616d22549c2da3b06e1dc931dc184093aa88e0285909fa76db
                                                                                                            • Opcode Fuzzy Hash: 5e190d2b37476e442a844b01a1e6e2b4e7978620d8c54b7cf5e7142be065b825
                                                                                                            • Instruction Fuzzy Hash: B952F7B1E0470E8FDB58DFA8C48A8EEBBF2FB58354F004119D846B6290D7B45919CF99
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116BD64 Relevance: 1.7, Strings: 1, Instructions: 425COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 386 116bd64-116bd96 387 116bd9b-116bda1 386->387 388 116bda7-116bdaa 387->388 389 116c092-116c22b call 115c290 * 2 387->389 390 116bdb0-116bdb6 388->390 391 116bfbe-116c077 call 116efac 388->391 407 116c230-116c252 389->407 394 116c31f-116c43f call 116c8c0 * 2 390->394 395 116bdbc-116bdc2 390->395 403 116c088-116c08d 391->403 404 116c079-116c083 391->404 411 116c444-116c450 394->411 399 116c265-116c31a call 115d794 395->399 400 116bdc8-116bdce 395->400 399->411 405 116c254-116c25a 400->405 406 116bdd4-116beec call 11530bc call 11559c0 400->406 403->387 404->387 405->411 412 116c260 405->412 416 116bef1-116bfb9 call 115f7bc 406->416 407->405 412->387 416->405
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: :q:\
                                                                                                            • API String ID: 0-2895447576
                                                                                                            • Opcode ID: 886945f031e67b58a868bdb1e381ef4a9fc1c96ab49a30106b080c815137e49d
                                                                                                            • Instruction ID: cf9da5970161d017987b3a7b165fd6ca6001120382914e4159e760282af171d0
                                                                                                            • Opcode Fuzzy Hash: 886945f031e67b58a868bdb1e381ef4a9fc1c96ab49a30106b080c815137e49d
                                                                                                            • Instruction Fuzzy Hash: AA22D1B1510689EBDB9CDF28C8CA99D3FA1FB44398F906219FD06872A0D775D8C5CB81
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116A804 Relevance: 1.5, Strings: 1, Instructions: 205COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 419 116a804-116a868 call 1151000 422 116a86d-116a872 419->422 423 116ab0b-116ab1c call 1173f50 422->423 424 116a878-116a87d 422->424 432 116ab1e-116ab23 423->432 433 116ab28 423->433 426 116aa87-116ab01 call 1166a84 424->426 427 116a883-116a888 424->427 436 116ab06 Process32NextW 426->436 429 116a88e-116a890 427->429 430 116aa78-116aa82 427->430 434 116a896-116a89b 429->434 435 116ab3a-116abba call 1169720 429->435 430->422 432->422 439 116ab2a-116ab2f 433->439 437 116a8a1-116a8a6 434->437 438 116a9aa-116aa5c call 1169ec0 434->438 443 116abbf-116abd7 435->443 436->423 437->439 441 116a8ac-116a995 call 117bc2c 437->441 446 116aa61-116aa68 438->446 442 116ab35 439->442 439->443 447 116a99a-116a9a5 441->447 442->422 446->443 448 116aa6e-116aa73 446->448 447->422 448->422
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: lr
                                                                                                            • API String ID: 0-916072004
                                                                                                            • Opcode ID: fa212b8693eb9b32a65a2385a5ea898d40d4b6b25daee9b6546e8f2daae18533
                                                                                                            • Instruction ID: 900839cd99c98fe542f0763102bf8bce30c3ba514c3bae778526540f7d2a6d19
                                                                                                            • Opcode Fuzzy Hash: fa212b8693eb9b32a65a2385a5ea898d40d4b6b25daee9b6546e8f2daae18533
                                                                                                            • Instruction Fuzzy Hash: 6B917D705597849BE7E8CF28C8C999E7BE0FB84704F502A1DF8868B2A0D775D944CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117B6BC Relevance: 1.4, Strings: 1, Instructions: 144COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 449 117b6bc-117b7bd call 1151000 call 116abd8 454 117b7c3-117b84b call 116d384 449->454 455 117b8ca-117b8e1 449->455 457 117b850-117b8c5 call 1169720 454->457 457->455
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 0OX
                                                                                                            • API String ID: 0-2247774083
                                                                                                            • Opcode ID: cbe327959dac0143b50e131ebb10b63ebbb26e3c7b73c3fb7901bf4345a69007
                                                                                                            • Instruction ID: fc24f998a2ba470f0ecec5d08db3c712b9f22b29951d437d4e2dd55cb4f87fa1
                                                                                                            • Opcode Fuzzy Hash: cbe327959dac0143b50e131ebb10b63ebbb26e3c7b73c3fb7901bf4345a69007
                                                                                                            • Instruction Fuzzy Hash: 7C6101719047488FDB48CFA8D9894DDBBF0FB4C318F158269E84AB7260D7B89905CF69
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01177E28 Relevance: .2, Instructions: 171COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fb3303564b81bcf5b35f1ad04ff7d9599e8f7a8f4ca1d0a4c5254e8142fd1683
                                                                                                            • Instruction ID: b2a1af566dfdd9a7a4ff87f76b68895edb2c1e60d3af8daab54c10a50173b397
                                                                                                            • Opcode Fuzzy Hash: fb3303564b81bcf5b35f1ad04ff7d9599e8f7a8f4ca1d0a4c5254e8142fd1683
                                                                                                            • Instruction Fuzzy Hash: B981177011074E8FDB49DF28C88A5DA3FB0FB68398F551219FC4A962A0C778D694CBC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800013FC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 324 1800013fc-18000fa1b call 1800026d5 ExitProcess
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ExitProcess
                                                                                                            • String ID: RtUNcGFzsqwwwPMKHH
                                                                                                            • API String ID: 621844428-2308616683
                                                                                                            • Opcode ID: 4ead834e3037eddd42ce8f934e35685685c76adfa99908f90d829bd459104ece
                                                                                                            • Instruction ID: 1f025aa724a7d40cba24dcc4faa593ebdf98efce34d9d125db1d969ed5f16da4
                                                                                                            • Opcode Fuzzy Hash: 4ead834e3037eddd42ce8f934e35685685c76adfa99908f90d829bd459104ece
                                                                                                            • Instruction Fuzzy Hash: 52D0123572145D82E695A7B59C517E92351574D3D0FD19415B11542A50CD2C838E5B00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180066360 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 459 180066360-18006636f 460 180066371-18006637d 459->460 461 18006637f-18006638f 459->461 460->461 462 1800663c2-1800663cd call 180002216 460->462 463 1800663a6-1800663be HeapAlloc 461->463 467 1800663cf-1800663d4 462->467 464 180066391-180066398 call 180002766 463->464 465 1800663c0 463->465 464->462 471 18006639a-1800663a4 call 1800033d2 464->471 465->467 471->462 471->463
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AllocHeap
                                                                                                            • String ID:
                                                                                                            • API String ID: 4292702814-0
                                                                                                            • Opcode ID: 2826a93e267b69a13e772367b5697dd6e0d4ce836edd58b7ba94720a5927ebb2
                                                                                                            • Instruction ID: d34f6cbe5739f2b7a3f9640804ccb9f726a75f2d933c34ec7a8388ef2763bc27
                                                                                                            • Opcode Fuzzy Hash: 2826a93e267b69a13e772367b5697dd6e0d4ce836edd58b7ba94720a5927ebb2
                                                                                                            • Instruction Fuzzy Hash: 67F0627070171C41FED796965A113D512862B9CBC0F28E434781B963E1DD1CC74C4310
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000103C Relevance: 1.3, APIs: 1, Instructions: 30memoryCOMMON
                                                                                                            Download Yara Rule

                                                                                                            Control-flow Graph

                                                                                                            • Executed
                                                                                                            • Not Executed
                                                                                                            control_flow_graph 474 18000103c-180062ac9 476 180062b07-180062b12 call 180002216 474->476 477 180062acb-180062ad7 474->477 483 180062b14-180062b19 476->483 478 180062aee-180062b03 HeapAlloc 477->478 480 180062b05 478->480 481 180062ad9-180062ae0 call 180002766 478->481 480->483 481->476 486 180062ae2-180062aec call 1800033d2 481->486 486->476 486->478
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AllocHeap
                                                                                                            • String ID:
                                                                                                            • API String ID: 4292702814-0
                                                                                                            • Opcode ID: 35cbb4341a94623705d76c4a74c34f0e10ec1fc82d0378a2e206c86dbd14c5f1
                                                                                                            • Instruction ID: 6c37476b44550b826720018d9100459ab9540b87a5957eac85aac3316f202def
                                                                                                            • Opcode Fuzzy Hash: 35cbb4341a94623705d76c4a74c34f0e10ec1fc82d0378a2e206c86dbd14c5f1
                                                                                                            • Instruction Fuzzy Hash: 57F08230300B0C46FEE76AE25D117E662869B4C7E0F28D6207C368A2C1DE98C74CD310
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Non-executed Functions

                                                                                                            Function 0000000180001721 Relevance: 66.1, APIs: 33, Strings: 4, Instructions: 1381registrystringlibraryCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Close$lstrcmpi$CharNext$Open$LibraryLoadResource$DeleteInfoQueryValue$CreateFindFreeSizeof
                                                                                                            • String ID: Delete$ForceRemove$NoRemove$Val
                                                                                                            • API String ID: 3491649438-1781481701
                                                                                                            • Opcode ID: 656af75844bd6f46099c2488e2089ec451d86aedaa1e7cf7b6718d992e82b596
                                                                                                            • Instruction ID: f97dfae0e6ecb08bd47b5a34c891fe14a18e508bd5ff985720e3ca5d0eaf694d
                                                                                                            • Opcode Fuzzy Hash: 656af75844bd6f46099c2488e2089ec451d86aedaa1e7cf7b6718d992e82b596
                                                                                                            • Instruction Fuzzy Hash: 0152A032304B8986FBA2DF66A8543EA77E5F789BC4F408125FE4957B94DF78C6488700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800013F7 Relevance: 48.2, APIs: 22, Strings: 5, Instructions: 965registrycomlibraryCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Close$DeleteInfoModuleOpenQueryString$AddressCreateFileFreeFromHandleInstanceNameProcRegisterType
                                                                                                            • String ID: CLSID\$OLEAUT32.DLL$UnRegisterTypeLibForUser$\Implemented Categories$\Required Categories
                                                                                                            • API String ID: 940573962-3005604394
                                                                                                            • Opcode ID: fba1f67f1384921728c2c6173d0594d1e9e10f4f51a4c6b29493628a23d0960d
                                                                                                            • Instruction ID: f11ccd23e77aa873c4bd888202f7ac2afb31c18683dced51d17ff8c8704a6fc2
                                                                                                            • Opcode Fuzzy Hash: fba1f67f1384921728c2c6173d0594d1e9e10f4f51a4c6b29493628a23d0960d
                                                                                                            • Instruction Fuzzy Hash: A7228132214B4982EBA6CF65D8507E973A1F74CBC4F548526FE4983A94DF39CA4DCB02
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01157CAC Relevance: 34.7, Strings: 27, Instructions: 967COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: #X$)~$* W{$,q.i$.)$0$7s$C$E1$F%$K@$L4$MV$NXT,$TL$V<$Vr$]uvB$^7$`$kS$o-$u$}Np+$~>$2$7
                                                                                                            • API String ID: 0-2134905853
                                                                                                            • Opcode ID: e13f974fcb2672a8e182c092b9ecd2b628f9c3bbec6d6571a024f9d770dcaa93
                                                                                                            • Instruction ID: dc5f56bb52d289d707c3f8bd0719f5110782a98dba02d67b8f7ef075fedc192a
                                                                                                            • Opcode Fuzzy Hash: e13f974fcb2672a8e182c092b9ecd2b628f9c3bbec6d6571a024f9d770dcaa93
                                                                                                            • Instruction Fuzzy Hash: 1DB2D771E04709DFDBA8CFA8D48A5DEBBF2FB54344F004119E946B72A0D7B8941ACB85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003C33 Relevance: 19.7, Strings: 15, Instructions: 914COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: /$[thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual $}'
                                                                                                            • API String ID: 0-2884338863
                                                                                                            • Opcode ID: b8791461a422baa8bd56ed56981e8801e2fcc367337d1c8f88414f826d81d01f
                                                                                                            • Instruction ID: 10479bcca7e170bbb66d44a368effd93a51db3e1473faf1a2c626cd93874bcc0
                                                                                                            • Opcode Fuzzy Hash: b8791461a422baa8bd56ed56981e8801e2fcc367337d1c8f88414f826d81d01f
                                                                                                            • Instruction Fuzzy Hash: 79929872614B889AE783CF14E4913DEB7A0F7983C5F509125FA8A47A99DF78C64CCB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002103 Relevance: 15.4, APIs: 10, Instructions: 372COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: memcpy_s
                                                                                                            • String ID:
                                                                                                            • API String ID: 1502251526-0
                                                                                                            • Opcode ID: 82d73465a9ce4629c342b10eed6ae2f11ad044ad577a961d1a628d65e73354fa
                                                                                                            • Instruction ID: d89bcff882ba81043d8c032eed921329ef671f3bf753b5e6b0188b18fe653775
                                                                                                            • Opcode Fuzzy Hash: 82d73465a9ce4629c342b10eed6ae2f11ad044ad577a961d1a628d65e73354fa
                                                                                                            • Instruction Fuzzy Hash: E2E1D3722046888BEBB6CF15E444BD977A0F34D7C9F509116EB8987B84DB7ACB09CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003D8C Relevance: 14.5, APIs: 3, Strings: 4, Instructions: 2205COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: memcpy_s
                                                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                            • API String ID: 1502251526-2761157908
                                                                                                            • Opcode ID: 2ec17638f7e05996e451fd26bf9dca742ae8ac4d91a0606223683582e3755e3d
                                                                                                            • Instruction ID: bc899144f117a5e3bfd441840eef00d301173f3f4645fcf64b4e469a8cfa5b94
                                                                                                            • Opcode Fuzzy Hash: 2ec17638f7e05996e451fd26bf9dca742ae8ac4d91a0606223683582e3755e3d
                                                                                                            • Instruction Fuzzy Hash: 3EB2E472B142888BE7A6CF64D940BED37A1F3483C8F549215EA0657A95DF3ADB08CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116484C Relevance: 10.9, Strings: 8, Instructions: 912COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: *D$HT$\T$f[a$h"$ot$u%$\B
                                                                                                            • API String ID: 0-968417195
                                                                                                            • Opcode ID: 63bf37535eb24419076e489a76d625db85bb6f475c5210ea91a365b5b290c744
                                                                                                            • Instruction ID: a8cf4f7441fe65054244a2d20f7600080fe36fe30a9ffe1aa0faec530c3a9b4e
                                                                                                            • Opcode Fuzzy Hash: 63bf37535eb24419076e489a76d625db85bb6f475c5210ea91a365b5b290c744
                                                                                                            • Instruction Fuzzy Hash: 81A221705447878FDB78CF68C845BEEBBE1FB84304F10452DE86A8BA51E7B49648DB41
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180071D18 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 374COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: NameTranslate$CodePageValid
                                                                                                            • String ID: utf8
                                                                                                            • API String ID: 751305153-905460609
                                                                                                            • Opcode ID: 6ba387b174d75f3c9726486d01a7d33d9907932bed29e32b4999e02a0dc9906f
                                                                                                            • Instruction ID: dfbb84b54817bc4c5d2fe706a2544e6bf0c584e1911f1b49fdc1a7a63d4ec021
                                                                                                            • Opcode Fuzzy Hash: 6ba387b174d75f3c9726486d01a7d33d9907932bed29e32b4999e02a0dc9906f
                                                                                                            • Instruction Fuzzy Hash: 209168322007888AEBA6AF2AD4413E933A5F748BC1F54C121EE49477D6DF7ACB59C740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002C11 Relevance: 10.8, APIs: 7, Instructions: 250COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: memcpy_s
                                                                                                            • String ID:
                                                                                                            • API String ID: 1502251526-0
                                                                                                            • Opcode ID: eee58f9b412b341fcf4a12cfd621dcec33eb75da4433f880c1d24ccccf78c1e0
                                                                                                            • Instruction ID: e238ed2dfde25a27d635c8af211d570bfc92074cc0a8156fb4b6598184bfdc7e
                                                                                                            • Opcode Fuzzy Hash: eee58f9b412b341fcf4a12cfd621dcec33eb75da4433f880c1d24ccccf78c1e0
                                                                                                            • Instruction Fuzzy Hash: C6A1E3B26002C48BE7BA8F54E480BD977A0F36D7C9F50D115EB8A47B85CB79DA49CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180072AD8 Relevance: 10.7, APIs: 7, Instructions: 171COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Locale$CodeInfoPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                            • String ID:
                                                                                                            • API String ID: 2191266518-0
                                                                                                            • Opcode ID: b6be2b467491b21fd1b617c159aab79a5fe754c5a0f4896ca43bce0cb5df50c4
                                                                                                            • Instruction ID: 759a736cc6535c3793cc6aad2a279970e1f588335c11b9cbfaae65cad5ec5c72
                                                                                                            • Opcode Fuzzy Hash: b6be2b467491b21fd1b617c159aab79a5fe754c5a0f4896ca43bce0cb5df50c4
                                                                                                            • Instruction Fuzzy Hash: 697168327006488AFBA6DF61D8507EC33E0BB4CB84F94C425AE1957695EF3ECA49C351
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003841 Relevance: 10.6, APIs: 7, Instructions: 73COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                            • String ID:
                                                                                                            • API String ID: 3140674995-0
                                                                                                            • Opcode ID: de013c9747b434e28f9cede62df88904ca776414c70768d3aba2c2129f99e06c
                                                                                                            • Instruction ID: 8faa440c8f9c16d820f1f832d86b61b0a4734aadf292b788bf1cf8708deca589
                                                                                                            • Opcode Fuzzy Hash: de013c9747b434e28f9cede62df88904ca776414c70768d3aba2c2129f99e06c
                                                                                                            • Instruction Fuzzy Hash: 37310D72205E888AEBA59F61E8503EE7374F788784F44842AEA4E47B95DF78C64CC710
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006680C Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 853COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileFindFirst
                                                                                                            • String ID: *?
                                                                                                            • API String ID: 1974802433-2564092906
                                                                                                            • Opcode ID: 50b7964dd94e5dd19d06664ca4b878174ceb40e4836b37a01607c3b24c260b4d
                                                                                                            • Instruction ID: 78370433cc5b2f890a343cf6b1f1bb59626434cf958385823cf342e038f2a230
                                                                                                            • Opcode Fuzzy Hash: 50b7964dd94e5dd19d06664ca4b878174ceb40e4836b37a01607c3b24c260b4d
                                                                                                            • Instruction Fuzzy Hash: 8B02E532B1075885EBA2DB25DD103ED63A6E74CBE4F24C115FE6A47BA5DF38C6498300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018002BAEC Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                            • String ID:
                                                                                                            • API String ID: 1239891234-0
                                                                                                            • Opcode ID: 4a66f4e5fe720556694b3b858a730586ed408401c9510f1bcd3bd38c034f0ff8
                                                                                                            • Instruction ID: 516373a53e58ddd3f5724ebb5ef3c9f7018838cb5df59fbbcc4d3dafc6602ae7
                                                                                                            • Opcode Fuzzy Hash: 4a66f4e5fe720556694b3b858a730586ed408401c9510f1bcd3bd38c034f0ff8
                                                                                                            • Instruction Fuzzy Hash: 8F316236204F8486DBA2CF25E8503DE73A4F788794F508116FA8D87B69DF78C659CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800677BC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119fileCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Find$CloseFile$FirstNext
                                                                                                            • String ID: .
                                                                                                            • API String ID: 1164774033-248832578
                                                                                                            • Opcode ID: 9a6577ec89b343ef92b6f0188a9006f531f54edfc475b8246d39321816d57704
                                                                                                            • Instruction ID: 716e0a4d6ae9810baf4e8034198b9a7aad656cc1fbaea80b03366e02519e4fc1
                                                                                                            • Opcode Fuzzy Hash: 9a6577ec89b343ef92b6f0188a9006f531f54edfc475b8246d39321816d57704
                                                                                                            • Instruction Fuzzy Hash: 1D41D8B271079945FAE29B659C087E9A392E748FE0F54C121BD6D076C6EE78CB4EC310
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180073160 Relevance: 8.1, APIs: 3, Strings: 1, Instructions: 1137COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: memcpy_s
                                                                                                            • String ID: s
                                                                                                            • API String ID: 1502251526-453955339
                                                                                                            • Opcode ID: d4cf05ecd455671ed48c8103a09630b378782c3b37b8624dd49ab4bcc5731587
                                                                                                            • Instruction ID: 5dd49a911b0dfbe69341cbebf1bf92d52682ef987ef9546808b4906a16f2e669
                                                                                                            • Opcode Fuzzy Hash: d4cf05ecd455671ed48c8103a09630b378782c3b37b8624dd49ab4bcc5731587
                                                                                                            • Instruction Fuzzy Hash: 49A2E1B26042C88BE7B6CE29D5417D976A5F39C7C8F50C215EB4667B94DB3ECB488B00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001DE3 Relevance: 7.8, APIs: 5, Instructions: 287COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 64cb03bf174f7852d6520b711f616752fc256074cba0987dfbc8735e31847126
                                                                                                            • Instruction ID: 27cc44d6ccc2bf9c323373cd41c7867e0971e502fecbfca535da0397870ea1d5
                                                                                                            • Opcode Fuzzy Hash: 64cb03bf174f7852d6520b711f616752fc256074cba0987dfbc8735e31847126
                                                                                                            • Instruction Fuzzy Hash: D1C1E672228A8C9AE7E29F5588503EE77A5FB88BD1F448105FA5A073D1DF78C76C8700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800039EA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 330COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: memcpy_s
                                                                                                            • String ID:
                                                                                                            • API String ID: 1502251526-3916222277
                                                                                                            • Opcode ID: 1cd2c32c6aa6f004b35156ddb6bc966c9990411d6bedea8bc6c03b4e40a679bb
                                                                                                            • Instruction ID: cf95f4459b5a2032c74a2065c2ca5d59aa31c1a22a5c39eac3b1ea6e4edd8b56
                                                                                                            • Opcode Fuzzy Hash: 1cd2c32c6aa6f004b35156ddb6bc966c9990411d6bedea8bc6c03b4e40a679bb
                                                                                                            • Instruction Fuzzy Hash: 76C1C47371568987E7A2CF59E088B9AB791F3887C4F45C125EB4A4BB84DB3DD909CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117A304 Relevance: 7.1, Strings: 5, Instructions: 835COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: rm|$4N/c$YO$B$u9E
                                                                                                            • API String ID: 0-3869539016
                                                                                                            • Opcode ID: 9a116dcf9b3a86797ace5d43516dce82c15cea16de5bd03a21175288c231a346
                                                                                                            • Instruction ID: 358f7d4b8a67808e65dc058b33512b1de76ced7a53450bd4c02ed337c75c72c2
                                                                                                            • Opcode Fuzzy Hash: 9a116dcf9b3a86797ace5d43516dce82c15cea16de5bd03a21175288c231a346
                                                                                                            • Instruction Fuzzy Hash: 1292B1719047888BEB58DFA8D48949E7FF1FB94388F20462DF95A872A0D774D885CF81
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800041E7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMONLIBRARYCODE
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0000000180015DE7
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: DebugDebuggerErrorLastOutputPresentString
                                                                                                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                            • API String ID: 389471666-631824599
                                                                                                            • Opcode ID: be4cfd8fe07a8ee859718dfe3759bbe0029b820c9bcbd343c9c097041ca894be
                                                                                                            • Instruction ID: 82ce5415c217ea102f40cb921ceb6149a2fc48caf44db374cb746065d9747d74
                                                                                                            • Opcode Fuzzy Hash: be4cfd8fe07a8ee859718dfe3759bbe0029b820c9bcbd343c9c097041ca894be
                                                                                                            • Instruction Fuzzy Hash: 8F115E32210B4897F796DB22E6543E933A5F748785F408125E64986A90EF78D6BCC700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011699F4 Relevance: 6.3, Strings: 5, Instructions: 82COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: &E$J$\$0$\$0$%
                                                                                                            • API String ID: 0-3783372379
                                                                                                            • Opcode ID: fe00409fb097cb738ccd7bb42c80f1f234878f624b9ce11e10f19b72aa3055a3
                                                                                                            • Instruction ID: 5f46f4dcfeb7458e35c6c4ee3cc8abe55e8c5b2b2da0cb4e73916b800875f140
                                                                                                            • Opcode Fuzzy Hash: fe00409fb097cb738ccd7bb42c80f1f234878f624b9ce11e10f19b72aa3055a3
                                                                                                            • Instruction Fuzzy Hash: EB41B3B490438E8FDF48DF24C88A5DE7BB0FB58358F000A19F865A6250D7B8D664CBC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116C9F0 Relevance: 5.5, Strings: 4, Instructions: 482COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: %d$et$p9$E%
                                                                                                            • API String ID: 0-2779957693
                                                                                                            • Opcode ID: 48ec8b1b1bbbc9fc28becce8326644315418b57cb87a2f48306ba2cbfa33ef8b
                                                                                                            • Instruction ID: f5046d617060889e01413f415212b219f3618caf4481851bfa85e76b2dbc8196
                                                                                                            • Opcode Fuzzy Hash: 48ec8b1b1bbbc9fc28becce8326644315418b57cb87a2f48306ba2cbfa33ef8b
                                                                                                            • Instruction Fuzzy Hash: A722F0706087C88FD758DFA9C58955AFBE2FBD4704F108A1DE4868B2A0D7B8D949CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01178B28 Relevance: 5.2, Strings: 4, Instructions: 164COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: #X$@$^Y62$|4
                                                                                                            • API String ID: 0-3495465369
                                                                                                            • Opcode ID: 44ee773b079888a6d96819c394d966fbe2abcf365905940e0a0889ecd021c25c
                                                                                                            • Instruction ID: 342b37b00d1aeaa8f67a25bea448566ed893e9a97129c7596a2fcd6f45a22264
                                                                                                            • Opcode Fuzzy Hash: 44ee773b079888a6d96819c394d966fbe2abcf365905940e0a0889ecd021c25c
                                                                                                            • Instruction Fuzzy Hash: 865129716187489FC36CDE18C58A7ABB7E1FB86754F841A1CE4CA87350D774A811CB47
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01163724 Relevance: 5.1, Strings: 4, Instructions: 144COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: ,$,$CG$Z$
                                                                                                            • API String ID: 0-827580499
                                                                                                            • Opcode ID: cb1d020630babe520e5b577854dfe4b50958e195937fa8a19b62a4c971fd48b7
                                                                                                            • Instruction ID: dabe4b927c18a093a1cfdba20c0d8baf769fd27a2c671e814d802fa296c84b9e
                                                                                                            • Opcode Fuzzy Hash: cb1d020630babe520e5b577854dfe4b50958e195937fa8a19b62a4c971fd48b7
                                                                                                            • Instruction Fuzzy Hash: BC51E87050C7858FD7B8DF28D486BDABBE0FB98300F10491DE59D87256DB74A885CB86
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01152DC0 Relevance: 5.1, Strings: 4, Instructions: 116COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: $%\$n>$r/
                                                                                                            • API String ID: 0-92184183
                                                                                                            • Opcode ID: 27b793fcb724542a7fdcfcd2546d4cab6af2ab84d0f77cd2afb0b0177177f21f
                                                                                                            • Instruction ID: babd947cc7473dc992d9a63c99ef4d81b47b34dc65f1dd0c3d1fc065bc90ff0e
                                                                                                            • Opcode Fuzzy Hash: 27b793fcb724542a7fdcfcd2546d4cab6af2ab84d0f77cd2afb0b0177177f21f
                                                                                                            • Instruction Fuzzy Hash: B851077060C7848FD7A8DF18E48979BBBE1FB98304F104A5DE48987395DB749848CB87
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116B558 Relevance: 5.1, Strings: 4, Instructions: 79COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: ;V$?q$C$]v
                                                                                                            • API String ID: 0-1725616403
                                                                                                            • Opcode ID: bdda49094d1911bb796a14ae62f81d9f56aa1ca1dcb98ca884b509e6ce0b1d15
                                                                                                            • Instruction ID: 83e2059dfef04635f2e03841c827a7d8fafe2dab0ab2da19bb4c84f9e1b7f599
                                                                                                            • Opcode Fuzzy Hash: bdda49094d1911bb796a14ae62f81d9f56aa1ca1dcb98ca884b509e6ce0b1d15
                                                                                                            • Instruction Fuzzy Hash: 7341B5B090074E8FDB48DF64C4864CE7FB4FB68398F210619E859A6250D374D6A5CFC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011614A0 Relevance: 5.1, Strings: 4, Instructions: 72COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: :$G(="$Lh$cJ
                                                                                                            • API String ID: 0-1655878502
                                                                                                            • Opcode ID: 5aa3bfd74e20475da927db53a56f1c45e16d761b7720a32f1834f4526e61cacd
                                                                                                            • Instruction ID: b2336b1ba541a42889de647fe2b1cc965c06f6a7aa5a93284a443c7e944b68ee
                                                                                                            • Opcode Fuzzy Hash: 5aa3bfd74e20475da927db53a56f1c45e16d761b7720a32f1834f4526e61cacd
                                                                                                            • Instruction Fuzzy Hash: F63182B0528780ABD788DF28C59AD1ABBF1FBC5344F806A2DF8868A390D775D505CB47
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800723C8 Relevance: 4.7, APIs: 3, Instructions: 169COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: InfoLocale
                                                                                                            • String ID:
                                                                                                            • API String ID: 2299586839-0
                                                                                                            • Opcode ID: 78ad3d06bb33505bcf208b8b36a68ca74f9c4c36f05d127d028046c4e4d0b611
                                                                                                            • Instruction ID: d666175bfc8e0553869a7ef9027b3d96fe63b8840736bd04c9530e760b8e8d0d
                                                                                                            • Opcode Fuzzy Hash: 78ad3d06bb33505bcf208b8b36a68ca74f9c4c36f05d127d028046c4e4d0b611
                                                                                                            • Instruction Fuzzy Hash: 52619F32700A498BEBB69F15E5613E973E1F388784F44C129EB8A87691DF3DDA59C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116FC70 Relevance: 4.3, Strings: 3, Instructions: 537COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: #X$<?xA$`_v
                                                                                                            • API String ID: 0-322589193
                                                                                                            • Opcode ID: 6b70401809f5a4e380f0709831ac7f15e8a4fc17e6b3291d5bd7555e7f7de519
                                                                                                            • Instruction ID: 0f2bb814de0e76e3dd1e11ceb95c9afa9f55e2f9728e8ab7fd7eaa6da3f8af44
                                                                                                            • Opcode Fuzzy Hash: 6b70401809f5a4e380f0709831ac7f15e8a4fc17e6b3291d5bd7555e7f7de519
                                                                                                            • Instruction Fuzzy Hash: 7D5218B1A047898BDBB8CF68C8996DD7BF0FB48318F90421DEA0A9F251DB745645CF09
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011541A8 Relevance: 4.2, Strings: 3, Instructions: 417COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 6IS$Y'$g&k
                                                                                                            • API String ID: 0-1347275694
                                                                                                            • Opcode ID: 5972e9e9ca915041273c62e911c59448f4779c96982aba4ba3a57c08c14b6c06
                                                                                                            • Instruction ID: 60b4390239a05b009c91a1750a1e891d914ae91b43eeff2a58ee91146c73b16e
                                                                                                            • Opcode Fuzzy Hash: 5972e9e9ca915041273c62e911c59448f4779c96982aba4ba3a57c08c14b6c06
                                                                                                            • Instruction Fuzzy Hash: FE12DE7560670DCBDB68DF28C69A5993BE1FF54308F10412DFC2A8B6A1D374E929CB48
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800637A4 Relevance: 4.0, Strings: 3, Instructions: 264COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: -$e+000$gfff
                                                                                                            • API String ID: 0-2620144452
                                                                                                            • Opcode ID: 70fc7c0cd301085c2900c31cbf0f870e11951a2f4a733f292e3a77e923206d1b
                                                                                                            • Instruction ID: 468bf5be1788515320c530bd1c831a0e90238dc8c026b035632d6d4437453a93
                                                                                                            • Opcode Fuzzy Hash: 70fc7c0cd301085c2900c31cbf0f870e11951a2f4a733f292e3a77e923206d1b
                                                                                                            • Instruction Fuzzy Hash: BA515A727147C886E7A6CA35DC027D9BB92E349BD4F18D221EAA447AC5CF79C649C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01167144 Relevance: 3.9, Strings: 3, Instructions: 189COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: \z$0k$|1#B
                                                                                                            • API String ID: 0-2604729280
                                                                                                            • Opcode ID: 8404b4b38dded9abebae47dab0adc7fa90b3b0a32bd634e0e4c225ac41767b4a
                                                                                                            • Instruction ID: 5e128bca29935dd2054aee1c6a36348471cd4a24e59fb29361f7685bde352a6e
                                                                                                            • Opcode Fuzzy Hash: 8404b4b38dded9abebae47dab0adc7fa90b3b0a32bd634e0e4c225ac41767b4a
                                                                                                            • Instruction Fuzzy Hash: 22811470D086088BDB2CDFE8C99A59DBBB5FF44304F14422ED44AAB798D7B4A946CF41
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01152820 Relevance: 3.9, Strings: 3, Instructions: 179COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Q2$`A$p"
                                                                                                            • API String ID: 0-552485201
                                                                                                            • Opcode ID: c502aedb671b04fadc2be20481da80d7c520fa3a2562906962d15d374359ee86
                                                                                                            • Instruction ID: 16e21f1b484f7e5adaa52bc4dd63bb14c0cea1b5c20431f3d6243b6c49ba678f
                                                                                                            • Opcode Fuzzy Hash: c502aedb671b04fadc2be20481da80d7c520fa3a2562906962d15d374359ee86
                                                                                                            • Instruction Fuzzy Hash: F581147190464D8BDF4CCF68C8894EE7BB1FB48358F164319E89AAB260C778D485CB89
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116C5AC Relevance: 3.8, Strings: 3, Instructions: 95COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: X$vn$zk
                                                                                                            • API String ID: 0-721357504
                                                                                                            • Opcode ID: 50b4caa98fdb08d8472cbcfe9057dc5859aff7734f74001ad36ab103d46c2b24
                                                                                                            • Instruction ID: 6ad76c39dd6460d88032f57ad1be2939eb4177bbe2022b0087f48664644fd3d3
                                                                                                            • Opcode Fuzzy Hash: 50b4caa98fdb08d8472cbcfe9057dc5859aff7734f74001ad36ab103d46c2b24
                                                                                                            • Instruction Fuzzy Hash: 784124709007098BDB48CF68D98A5DE7FB1FB18398F14422DE84AA6294D7789994CFC8
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116C720 Relevance: 3.8, Strings: 3, Instructions: 91COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: )rbY$ho$j^
                                                                                                            • API String ID: 0-3500879238
                                                                                                            • Opcode ID: 19a3861e0a1889c50caccb0f19a486b3e4770237e53b4c202be965853e098e35
                                                                                                            • Instruction ID: 957bc3bcc858c47d28bbd3e71cac1795fb0db427317273f7ce9ef83131ea7cdc
                                                                                                            • Opcode Fuzzy Hash: 19a3861e0a1889c50caccb0f19a486b3e4770237e53b4c202be965853e098e35
                                                                                                            • Instruction Fuzzy Hash: 8B41E9305187819BD7ACCF28C4C951ABEE0FB853A4FA0292DF5C386660D779D8958B43
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01173DD4 Relevance: 3.8, Strings: 3, Instructions: 89COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: '^$;j$_ugL
                                                                                                            • API String ID: 0-711956307
                                                                                                            • Opcode ID: a3dfb4ea163b488dac0c45a878ea3ce93fe05d0bf929e5ca77de4ba23b6ce8f8
                                                                                                            • Instruction ID: 74eaa471cd91b1ea27355ea8c9d4655828568f97bb2ef6b1697b02fd8118ff17
                                                                                                            • Opcode Fuzzy Hash: a3dfb4ea163b488dac0c45a878ea3ce93fe05d0bf929e5ca77de4ba23b6ce8f8
                                                                                                            • Instruction Fuzzy Hash: 8841ABB05087C48BE388DFA8D58941AFBE2FB98344F114A5CF8868B761D7B4D884CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117B570 Relevance: 3.8, Strings: 3, Instructions: 76COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Xd$toX^$o
                                                                                                            • API String ID: 0-2635763631
                                                                                                            • Opcode ID: cc9a8f5f35b0414d693a0a8f8e15fc44c02e30de63412d1481f65eb75a055ea8
                                                                                                            • Instruction ID: 3948b9e25eb26927164d38865c905e7310ec8d377619a5d65677f09000aaf69e
                                                                                                            • Opcode Fuzzy Hash: cc9a8f5f35b0414d693a0a8f8e15fc44c02e30de63412d1481f65eb75a055ea8
                                                                                                            • Instruction Fuzzy Hash: 6631E9B090074E8BDF48CF64C8864DE7FB0FB28358F104619E955A6254D3B8D6A5CFD5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002B08 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: InfoLocale
                                                                                                            • String ID: GetLocaleInfoEx
                                                                                                            • API String ID: 2299586839-2904428671
                                                                                                            • Opcode ID: 5513b84361156d68324fbd7196a4255227e3b24e70c0545b4608e231f04c98f9
                                                                                                            • Instruction ID: 86b92581e44d9d1e74f77fd1dd65aae425f86d3f99356a6c9fb0857c25292b25
                                                                                                            • Opcode Fuzzy Hash: 5513b84361156d68324fbd7196a4255227e3b24e70c0545b4608e231f04c98f9
                                                                                                            • Instruction Fuzzy Hash: 7901A734708B4895E7959B56B8007DAB365F78CBC0F54C026FE5947765CF38C7098740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01173894 Relevance: 2.8, Strings: 2, Instructions: 330COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Z/st$(<
                                                                                                            • API String ID: 0-4098472248
                                                                                                            • Opcode ID: 0bcf42cdc4c205656b4fa803c735b27a2ee53dcc839eac236b025070e442ed9e
                                                                                                            • Instruction ID: a28d68a506f10f50d183353877396df206c4086de238406fc682b2a3006898b6
                                                                                                            • Opcode Fuzzy Hash: 0bcf42cdc4c205656b4fa803c735b27a2ee53dcc839eac236b025070e442ed9e
                                                                                                            • Instruction Fuzzy Hash: BEE1CD75A0670CCBEB28CF68C58A49D7BF1FF54304F204129EC2A972A2D774E429CB49
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01160C68 Relevance: 2.8, Strings: 2, Instructions: 325COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: M"l%$\\|
                                                                                                            • API String ID: 0-3282688515
                                                                                                            • Opcode ID: fef3466aebc42e96b517a172b119936f2b1d308262c751b51633e8524cc58e5e
                                                                                                            • Instruction ID: 0d12f7302ac2e3ef6191ebe97bdffb6934ebfb78530540077afe1ee4d7df7cd6
                                                                                                            • Opcode Fuzzy Hash: fef3466aebc42e96b517a172b119936f2b1d308262c751b51633e8524cc58e5e
                                                                                                            • Instruction Fuzzy Hash: 54F1D27150460EDFDB58DF28C08A9DE3BA0FF58318F41812AFC5AAB264D774DA68CB45
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115C458 Relevance: 2.8, Strings: 2, Instructions: 309COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: $$R[$|7fq
                                                                                                            • API String ID: 0-3053601657
                                                                                                            • Opcode ID: c96b7e7975d98778142b73115a829a7a6337c70235ef8dacee511bf5012e4c55
                                                                                                            • Instruction ID: d702a6989b4a81c07f3c0028476cb4bf6eea21088961cc5883a7f58ae75e35c4
                                                                                                            • Opcode Fuzzy Hash: c96b7e7975d98778142b73115a829a7a6337c70235ef8dacee511bf5012e4c55
                                                                                                            • Instruction Fuzzy Hash: F502A471504BC88BDBBDDF24CC896EF7BA4FB44346F20551AD8899A290EBB49784CF41
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180060A88 Relevance: 2.8, Strings: 2, Instructions: 300COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: .$_.,
                                                                                                            • API String ID: 0-3384562259
                                                                                                            • Opcode ID: a61da256536a9f75ce50472c132db1afcbd778fc71c2062d363c5e559f326fd7
                                                                                                            • Instruction ID: 2925430d38b551d82d377d81095d24e2ced767648052e8915fa7b58f685bbe7d
                                                                                                            • Opcode Fuzzy Hash: a61da256536a9f75ce50472c132db1afcbd778fc71c2062d363c5e559f326fd7
                                                                                                            • Instruction Fuzzy Hash: 6651C23264074885FBB2CB61A8417EB6392F74CBE4FB4C625FA6907695DF75CB898300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180045B0C Relevance: 2.8, Strings: 2, Instructions: 286COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: $*
                                                                                                            • API String ID: 0-3982473090
                                                                                                            • Opcode ID: 09a3b5011bd69185a68b5831549615e58eb8262bccefe538b2a53b098c943a15
                                                                                                            • Instruction ID: 7ca0d0da8a42e297f45222a643de676a1882076e347e04b1d46fb75553a50e89
                                                                                                            • Opcode Fuzzy Hash: 09a3b5011bd69185a68b5831549615e58eb8262bccefe538b2a53b098c943a15
                                                                                                            • Instruction Fuzzy Hash: 72C18272105B4C86E7EACF2580943ED3BA4E70DB8EF1A8115EAC947396DF31C649C749
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180046920 Relevance: 2.8, Strings: 2, Instructions: 279COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: $*
                                                                                                            • API String ID: 0-3982473090
                                                                                                            • Opcode ID: abcc0b555ce7b021f003eff5abafc61d585b0a899f49ff192754fc391f9f8096
                                                                                                            • Instruction ID: aac3113a7d91c2f89d0ea72942155bf1d906e4af2e7e94a5bb1cd4e594acede4
                                                                                                            • Opcode Fuzzy Hash: abcc0b555ce7b021f003eff5abafc61d585b0a899f49ff192754fc391f9f8096
                                                                                                            • Instruction Fuzzy Hash: 8CC17772904B4885E7A6CF2580D43EC3BA4E30DF8CF268116EB89473A5DF35C659C75A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116A408 Relevance: 2.7, Strings: 2, Instructions: 195COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Gx!)$K&
                                                                                                            • API String ID: 0-3913818437
                                                                                                            • Opcode ID: 602b52c951a78bc629fd8f5a1cf697b3c5233d7fbd985276774e4fbf2e2954fb
                                                                                                            • Instruction ID: 6fed32d300a45a59d0a7487c6110aae93eae6923affe7016bfd3ea0b0e504262
                                                                                                            • Opcode Fuzzy Hash: 602b52c951a78bc629fd8f5a1cf697b3c5233d7fbd985276774e4fbf2e2954fb
                                                                                                            • Instruction Fuzzy Hash: CB912A71A04B0CCFDBA8DFA8D4895DDBBF5FF14308F101029E815A72A2D7B9951ACB45
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011590D4 Relevance: 2.7, Strings: 2, Instructions: 157COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 2ur$M2e7
                                                                                                            • API String ID: 0-622561414
                                                                                                            • Opcode ID: f3a0f7fe7cdfd4ec089186b0c0629e8800d922d5da475fed8d413755788e987d
                                                                                                            • Instruction ID: fb1c1d654c0656263db0697fcbc261d33a978aa1120a73f9dc54527f911134e3
                                                                                                            • Opcode Fuzzy Hash: f3a0f7fe7cdfd4ec089186b0c0629e8800d922d5da475fed8d413755788e987d
                                                                                                            • Instruction Fuzzy Hash: AB9177B650274CCFDB98CF28C28A5CD3BE0BF54308F50452AFC1A9A2A5D3B4D569CB49
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115D300 Relevance: 2.6, Strings: 2, Instructions: 150COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: dU$e
                                                                                                            • API String ID: 0-860301154
                                                                                                            • Opcode ID: 4d20e3d3d0ddaa607150751af3ba44bc43ce26d75f6e793552f6e28e9300345c
                                                                                                            • Instruction ID: 5d9543b926e80d771fe74eabbd2e6c105db1485a4bdf0a663c9b962c43225c88
                                                                                                            • Opcode Fuzzy Hash: 4d20e3d3d0ddaa607150751af3ba44bc43ce26d75f6e793552f6e28e9300345c
                                                                                                            • Instruction Fuzzy Hash: 345129B091C7848FD779DF28D48A7DABBE0FB98714F00091EE99D87256D770A841CB82
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01151014 Relevance: 2.6, Strings: 2, Instructions: 148COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: L>$!
                                                                                                            • API String ID: 0-3957590705
                                                                                                            • Opcode ID: 8e7eefd5e4a5ec16111ceca1e5a3bd8f6436754f76ea5725b70664953684caaf
                                                                                                            • Instruction ID: 353881984819f8cbc7c5345eac3bfcaa2fe37ce13902ecca9b8fd881255de1d4
                                                                                                            • Opcode Fuzzy Hash: 8e7eefd5e4a5ec16111ceca1e5a3bd8f6436754f76ea5725b70664953684caaf
                                                                                                            • Instruction Fuzzy Hash: E561F2B1510749ABDB88CF24C8C99D93FA1FF583A8FA62219FC0A97254C7B4D4C5CB85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01154C64 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: ,$6n
                                                                                                            • API String ID: 0-331226965
                                                                                                            • Opcode ID: 7aebb6b37ab07bbe85f5a0beca113342b5f6cb518f77e327aa1e19bfc114b024
                                                                                                            • Instruction ID: c0291521161f885a9966169d6abd7581e4a4239bcf28dcb867528400f673be3f
                                                                                                            • Opcode Fuzzy Hash: 7aebb6b37ab07bbe85f5a0beca113342b5f6cb518f77e327aa1e19bfc114b024
                                                                                                            • Instruction Fuzzy Hash: BC51D270618781AFD398DF28C4CA51ABBE0FBD8394F90691EF896C7264D374D845CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115B0F8 Relevance: 2.6, Strings: 2, Instructions: 115COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: /o!V$?
                                                                                                            • API String ID: 0-2462428742
                                                                                                            • Opcode ID: 8e519488506a05bd09ef9676569c20f7317acaf1ac4a6e35997866d4d24ae98d
                                                                                                            • Instruction ID: 54ab9dfdd075a533772e04885efb786c3d6c184107b2b5641f9712a6305e82a0
                                                                                                            • Opcode Fuzzy Hash: 8e519488506a05bd09ef9676569c20f7317acaf1ac4a6e35997866d4d24ae98d
                                                                                                            • Instruction Fuzzy Hash: 7541E271619784AFC398DF28C58991BBBF0FB84754F806A1DF89687260D7B4D8058F47
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115D92C Relevance: 2.6, Strings: 2, Instructions: 106COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 5}4$C
                                                                                                            • API String ID: 0-1938350828
                                                                                                            • Opcode ID: 6403902976708640ae1ffeada9c7fdc6ad2ba0260a522af9c902725f6d7b6e44
                                                                                                            • Instruction ID: ad70e36191c6bcb3173a187370d446d83c06c102a259d6e7aba0e0c024b723bb
                                                                                                            • Opcode Fuzzy Hash: 6403902976708640ae1ffeada9c7fdc6ad2ba0260a522af9c902725f6d7b6e44
                                                                                                            • Instruction Fuzzy Hash: A9315630219B449FE798DF28C08852BBBE0FBD4354FA05A2DF99AC7260C774D841CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01178990 Relevance: 2.6, Strings: 2, Instructions: 95COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: #aj$Kx=3
                                                                                                            • API String ID: 0-3217488289
                                                                                                            • Opcode ID: 5c797b4df1fad9b256fad6ce7e8cc3147628fdb8f59d641648e7e14701fbe875
                                                                                                            • Instruction ID: 93c68f6028d1378860a4319c12c530e5ce29e01da315ebcc06350b5286a8c718
                                                                                                            • Opcode Fuzzy Hash: 5c797b4df1fad9b256fad6ce7e8cc3147628fdb8f59d641648e7e14701fbe875
                                                                                                            • Instruction Fuzzy Hash: A051C3B180074A8FDF48CF64C88A5DE7FB0FB58398F10461DE856A6290D3B896A5CFD4
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01176520 Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: ":$fE
                                                                                                            • API String ID: 0-3906995390
                                                                                                            • Opcode ID: a4ac12280290c4e53d05e228cc403d3de4e0c1e0d207c578d24f1d8e013f81cc
                                                                                                            • Instruction ID: beb7bd3b419501fe3f12d8281476898eac6cb97c9fffa15ff7f7e073cb2965c1
                                                                                                            • Opcode Fuzzy Hash: a4ac12280290c4e53d05e228cc403d3de4e0c1e0d207c578d24f1d8e013f81cc
                                                                                                            • Instruction Fuzzy Hash: FE41C3B090074E8BDB48CF68C48A4DE7FB0FB68398F10461DF956A6290D778D6A4CBD5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011624E4 Relevance: 2.6, Strings: 2, Instructions: 83COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: &o$yy
                                                                                                            • API String ID: 0-59125751
                                                                                                            • Opcode ID: 19ba60e10a0a45ad4c18e66316bbdcf9a4ff12cc0565c0e3e55cdcdb483a0ba8
                                                                                                            • Instruction ID: 14354e79b92594c20bd05fc95c56ac06c5524fe416746548e52940077e651f53
                                                                                                            • Opcode Fuzzy Hash: 19ba60e10a0a45ad4c18e66316bbdcf9a4ff12cc0565c0e3e55cdcdb483a0ba8
                                                                                                            • Instruction Fuzzy Hash: 6341A3B190478E8FDF48CF64C88A5DE7BB0FB58358F004A19E86696250D3B8D664CFC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117155C Relevance: 2.6, Strings: 2, Instructions: 81COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Kj$\H7
                                                                                                            • API String ID: 0-1470819310
                                                                                                            • Opcode ID: e02b85eeaf908cf1b2fbfd8b85314d987d9180a2fff6feea1af0a8162cf9001c
                                                                                                            • Instruction ID: b6099d87222479c6fc5bd6adb6112071eca9f34d0175019c86bffa76f7816989
                                                                                                            • Opcode Fuzzy Hash: e02b85eeaf908cf1b2fbfd8b85314d987d9180a2fff6feea1af0a8162cf9001c
                                                                                                            • Instruction Fuzzy Hash: 6231927562C781ABC398CF28D49981ABBF1FBC9304F906A2DF8C686350D779D4468B47
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01170C68 Relevance: 2.6, Strings: 2, Instructions: 77COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: G$N1
                                                                                                            • API String ID: 0-2252191953
                                                                                                            • Opcode ID: 8ce5c824cbbd5addb0ecfa124f6e9a9035fe183e84c566d41c1eee401252f5dd
                                                                                                            • Instruction ID: 711e6736b6a9c32d4513167c4011d8928cd73bf6a099bd80b11b79d63c35aebe
                                                                                                            • Opcode Fuzzy Hash: 8ce5c824cbbd5addb0ecfa124f6e9a9035fe183e84c566d41c1eee401252f5dd
                                                                                                            • Instruction Fuzzy Hash: 0441A4B180078ECFDB58CF64C84A4DE7BB0FB58748F100A19F869A6294D3B4D665CBD5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01164594 Relevance: 2.6, Strings: 2, Instructions: 75COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: pG$v*U
                                                                                                            • API String ID: 0-3505048882
                                                                                                            • Opcode ID: 3bd1b8e7a831360d1a66145c2fd73055bfec599c398890b30ce089a6ee0b3c1c
                                                                                                            • Instruction ID: fee8689b1f107732b96cbff17136c5a85d3a14141f12c6f1465a2339fcbb9e16
                                                                                                            • Opcode Fuzzy Hash: 3bd1b8e7a831360d1a66145c2fd73055bfec599c398890b30ce089a6ee0b3c1c
                                                                                                            • Instruction Fuzzy Hash: C331A170628381AFD788CF28D49A92ABBE1FBC9305F846A2DF9C687350D775D445CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011525D8 Relevance: 2.6, Strings: 2, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: . $<
                                                                                                            • API String ID: 0-925536456
                                                                                                            • Opcode ID: 46f595ef1a13ba9ca77d57b7316055d0dcd1c26d9f7725bcfa2b7b4e5811abdf
                                                                                                            • Instruction ID: 536129663ef6d9b8abad341b3afc562818ae667aa4afb16130a26500a821ef7f
                                                                                                            • Opcode Fuzzy Hash: 46f595ef1a13ba9ca77d57b7316055d0dcd1c26d9f7725bcfa2b7b4e5811abdf
                                                                                                            • Instruction Fuzzy Hash: 0C317BB050078E8BDB48CF64C89A5DE7BB0FB58348F104A19E86AA6250D7B8D665CFC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01154948 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: <$ZD
                                                                                                            • API String ID: 0-2501396078
                                                                                                            • Opcode ID: 2824c35daa3de74f518df19ab1b75e9d9cda817f1187cf5d760b8d6fedb945b2
                                                                                                            • Instruction ID: 889ed5917f9bc7f1db312caac09e74f0ae3dbe9b25d68788710c732ab2202cd7
                                                                                                            • Opcode Fuzzy Hash: 2824c35daa3de74f518df19ab1b75e9d9cda817f1187cf5d760b8d6fedb945b2
                                                                                                            • Instruction Fuzzy Hash: 1B3158B45187818BD349DF28C04951ABBF1FBCC35CF904B1DF4CAAB290D77896058B4A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01166978 Relevance: 2.6, Strings: 2, Instructions: 64COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: dy$N
                                                                                                            • API String ID: 0-2062038628
                                                                                                            • Opcode ID: c97720179c95e872637b076776cb8797f0f432bfdfd54f8af27558e2adab77d4
                                                                                                            • Instruction ID: 355c7948b3e41f4bf2920da1e8f55454153375d843a3bfe34b9e6292a675cdd7
                                                                                                            • Opcode Fuzzy Hash: c97720179c95e872637b076776cb8797f0f432bfdfd54f8af27558e2adab77d4
                                                                                                            • Instruction Fuzzy Hash: 5221557020DB459BE398DF38C58952BBBE1EB94780FA02A1DF992C63B4D7748845CB02
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115BC08 Relevance: 2.6, Strings: 2, Instructions: 63COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Hbw$aF
                                                                                                            • API String ID: 0-3602373320
                                                                                                            • Opcode ID: 63be6ca9e4fa926235834e9f9773f4c38407dbca7ff0c43712e9de519cd28126
                                                                                                            • Instruction ID: 0ca57ad984779daae22f2044c653f8af25bea9fb528a98be8a8023bebdab3d9e
                                                                                                            • Opcode Fuzzy Hash: 63be6ca9e4fa926235834e9f9773f4c38407dbca7ff0c43712e9de519cd28126
                                                                                                            • Instruction Fuzzy Hash: BB317E74629380AFD388DF28C09591ABBF1BB89314F806A1DF9968A390D774D404CF47
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116ACEC Relevance: 2.6, Strings: 2, Instructions: 58COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: $^c$4
                                                                                                            • API String ID: 0-2209625224
                                                                                                            • Opcode ID: 401d73e0bbc2dfed66853937a49297a9b5588befae7a21c1bc13c69664648e7f
                                                                                                            • Instruction ID: f98e6c0f4f5dd45d95d012d9d2916e04fe5ea1f99a7368387c28b7710ff08e74
                                                                                                            • Opcode Fuzzy Hash: 401d73e0bbc2dfed66853937a49297a9b5588befae7a21c1bc13c69664648e7f
                                                                                                            • Instruction Fuzzy Hash: D42169716187848BC349DF28D44651ABBE1BBCC308F405B1DF4CAAB350D7B8A604CB4A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01160578 Relevance: 2.6, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: mqce$0
                                                                                                            • API String ID: 0-3394611740
                                                                                                            • Opcode ID: 8dc2d1d1b7f3fd8bee6d8350731ba4bb420b9c2bbd674ba1816a43f94c9f9f38
                                                                                                            • Instruction ID: 81d3bf9a475a8d1d4b0e927d375d3f3f1ad0bfb341bd954279ae48af79d97aab
                                                                                                            • Opcode Fuzzy Hash: 8dc2d1d1b7f3fd8bee6d8350731ba4bb420b9c2bbd674ba1816a43f94c9f9f38
                                                                                                            • Instruction Fuzzy Hash: 162173B0528381ABD389DF28C49991FBBE0FB89318F806A1DF98687350D7799444CB43
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01163D1C Relevance: 2.6, Strings: 2, Instructions: 52COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: EL$]F
                                                                                                            • API String ID: 0-2123762467
                                                                                                            • Opcode ID: 6ff1bc6076d5c0883e645f9af8d2b2bb5d9b8d4104f608c8574d48437c290935
                                                                                                            • Instruction ID: 15bde9ab4a755d8664b440b8dc0660d87f98eaf1f28cb99fbefd95b79a5befe6
                                                                                                            • Opcode Fuzzy Hash: 6ff1bc6076d5c0883e645f9af8d2b2bb5d9b8d4104f608c8574d48437c290935
                                                                                                            • Instruction Fuzzy Hash: E52128B45083819BD349DF68C48941ABBE0FB9D71CF400B5DF4C9AB291D778D644CB4A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01154848 Relevance: 2.6, Strings: 2, Instructions: 50COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: &l{$o#
                                                                                                            • API String ID: 0-2730603103
                                                                                                            • Opcode ID: de60d1831069c2ef89d38a7fd8998c219c9345b115e58d1be25a80c2d27f9433
                                                                                                            • Instruction ID: 10c0b4eb446b2bb665e75b9ec34d3423cb7970af79a85e9ae69d49fb7023ebd0
                                                                                                            • Opcode Fuzzy Hash: de60d1831069c2ef89d38a7fd8998c219c9345b115e58d1be25a80c2d27f9433
                                                                                                            • Instruction Fuzzy Hash: 682145B55087848BD388DF28D44A41ABBE0FB9C308F800B1DF4CEA72A1D7789645CF4A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006A5B0 Relevance: 2.4, APIs: 1, Instructions: 894COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 2f28c3276c95bc51e711947280483a6641330cfffeb9706ca56cf7039bd3568f
                                                                                                            • Instruction ID: 97de271ecfd536a8979911734d4c331931004529258dab2166341110ec4c459a
                                                                                                            • Opcode Fuzzy Hash: 2f28c3276c95bc51e711947280483a6641330cfffeb9706ca56cf7039bd3568f
                                                                                                            • Instruction Fuzzy Hash: B802AF31619B4C45FAD7EF219C113EA2796A74EBE0F24C625BE79477D2DE38CA098700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180004142 Relevance: 1.9, APIs: 1, Instructions: 372COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Info
                                                                                                            • String ID:
                                                                                                            • API String ID: 1807457897-0
                                                                                                            • Opcode ID: 9fb800df8903f029e44acac593e901b399a8457112c1f1faa07bb31342f69c91
                                                                                                            • Instruction ID: fb7c35715431a09657e6a1e7d3b9228fc869bbeffc5978da5c61fcf9f49946e8
                                                                                                            • Opcode Fuzzy Hash: 9fb800df8903f029e44acac593e901b399a8457112c1f1faa07bb31342f69c91
                                                                                                            • Instruction Fuzzy Hash: 39127D32A08BC886E7A2CF2898553ED77A4F75C788F15D215FB9886652EF34D689C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800671B0 Relevance: 1.7, APIs: 1, Instructions: 248COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 8411f535ff99bd6a039d4812c56c0eadf59e7d4fb5e495e7e40e9299299be8c3
                                                                                                            • Instruction ID: 299de8d21330fb8f37d3c00bb3280ee6b8fdcdc268fd421991c5c84dffb9e886
                                                                                                            • Opcode Fuzzy Hash: 8411f535ff99bd6a039d4812c56c0eadf59e7d4fb5e495e7e40e9299299be8c3
                                                                                                            • Instruction Fuzzy Hash: A551E272700B8485EBA1DB76AC443DE7BA5F748BD4F248215BE6927B99CF38C6458700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003026 Relevance: 1.7, APIs: 1, Instructions: 233COMMONLIBRARYCODE
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ExceptionRaise
                                                                                                            • String ID:
                                                                                                            • API String ID: 3997070919-0
                                                                                                            • Opcode ID: a5b7bc59f1562cacc64c94908ed728f54efa31a9a80f5a1e895db1f76c0d66d8
                                                                                                            • Instruction ID: 145d2707341e8db8a2ebe1687ad6fbd14135d59c43f5129b11bcda4d370d2258
                                                                                                            • Opcode Fuzzy Hash: a5b7bc59f1562cacc64c94908ed728f54efa31a9a80f5a1e895db1f76c0d66d8
                                                                                                            • Instruction Fuzzy Hash: 85B11D77610B488BEB5ACF29C88639C7BA0F348B98F15C915EB5D8B7A4CB35C655C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01174330 Relevance: 1.6, Strings: 1, Instructions: 355COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: yYO5
                                                                                                            • API String ID: 0-1967960796
                                                                                                            • Opcode ID: e2825577a0dd0e975e7e979c583ae4eab27c5c54df693b2f0feb2ff2088a3791
                                                                                                            • Instruction ID: c273ee5af90eaf5905bce1b03637273c9ba63593acabdc36fb8634e4c3ead31b
                                                                                                            • Opcode Fuzzy Hash: e2825577a0dd0e975e7e979c583ae4eab27c5c54df693b2f0feb2ff2088a3791
                                                                                                            • Instruction Fuzzy Hash: 8E02EDB0504649DFDB98DF28C0899CE7BE0FF48308F41852AFD4ADA6A4D774DA98CB45
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01174918 Relevance: 1.6, Strings: 1, Instructions: 329COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Rie
                                                                                                            • API String ID: 0-476967049
                                                                                                            • Opcode ID: 526e540bc71e94854237864a489690c71fa8e669b7e5c6485427e735c6976a30
                                                                                                            • Instruction ID: f1cf38cecfe0df112ab7283a2a3abb72a7eb322682d6764007bdafd6284662f4
                                                                                                            • Opcode Fuzzy Hash: 526e540bc71e94854237864a489690c71fa8e669b7e5c6485427e735c6976a30
                                                                                                            • Instruction Fuzzy Hash: F40266B5900709CFDB98CF28D59A5DD7BB9FB45348F004129FC0E9A2A0D3B4E919CB56
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800726A4 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: InfoLocale
                                                                                                            • String ID:
                                                                                                            • API String ID: 2299586839-0
                                                                                                            • Opcode ID: 1d5feb4513ac449a002f6161499f7849568638c2478fc41d38d8117def2169ee
                                                                                                            • Instruction ID: dd7474d9b5cf6e60dd1c43add10e417e70d490ad980dcba01da621d0ee91a8f5
                                                                                                            • Opcode Fuzzy Hash: 1d5feb4513ac449a002f6161499f7849568638c2478fc41d38d8117def2169ee
                                                                                                            • Instruction Fuzzy Hash: 7431BD3230868986EBAADB26E5413EA73E1F78C7C4F44C125AB5983795DF3DD648C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01171D2C Relevance: 1.6, Strings: 1, Instructions: 314COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: VGL
                                                                                                            • API String ID: 0-3868899587
                                                                                                            • Opcode ID: b788162f0c7f1e343e5ebd9412dadc3896a0e0c79e9535f9615901b8107fa579
                                                                                                            • Instruction ID: 6cd1f1e363c47457c0abbe41645f5cf71b298686f1384969a214fe891051f3b7
                                                                                                            • Opcode Fuzzy Hash: b788162f0c7f1e343e5ebd9412dadc3896a0e0c79e9535f9615901b8107fa579
                                                                                                            • Instruction Fuzzy Hash: 5AE1C271E0470D8FDB59DFA8C44A9DEBBF2FB58348F000519D806B7290DBB49919CBA9
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800721DC Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EnumLocalesSystem
                                                                                                            • String ID:
                                                                                                            • API String ID: 2099609381-0
                                                                                                            • Opcode ID: d46c707dae916efb297874439604c1a51d37d9ed55d0253cc21290960b618ea2
                                                                                                            • Instruction ID: 3fb11c8cd2a9a56c2e82e709c981d16b70fa814dd4a37b91dbbe396f8d67f94e
                                                                                                            • Opcode Fuzzy Hash: d46c707dae916efb297874439604c1a51d37d9ed55d0253cc21290960b618ea2
                                                                                                            • Instruction Fuzzy Hash: 6111DF73A086489AEB968F55D0807E87BE0F398FE0F44C115EA65433C5DA69C7DAC740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180072960 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: InfoLocale
                                                                                                            • String ID:
                                                                                                            • API String ID: 2299586839-0
                                                                                                            • Opcode ID: 1828f8173e96f33629a7ae4681a987d989f47d0ac66d706997fbdc6408602822
                                                                                                            • Instruction ID: 7ba51afc1076fa6754e7914bdd49afd276c6163dbbfd1ee81dcf36e61fdc3f0a
                                                                                                            • Opcode Fuzzy Hash: 1828f8173e96f33629a7ae4681a987d989f47d0ac66d706997fbdc6408602822
                                                                                                            • Instruction Fuzzy Hash: 6511593271429882E7E59B26E1103ED22E0E7487E4F188222FB65436C4CE3ACAC98700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800722DC Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EnumLocalesSystem
                                                                                                            • String ID:
                                                                                                            • API String ID: 2099609381-0
                                                                                                            • Opcode ID: f77f9165ebcf478b8adf5e4cd0bad0314ddc6cf6f551cb4d2964fef42f38387b
                                                                                                            • Instruction ID: e4901727e02562041206d13a90aa7298b0c34b19f844b070832d5347fa438a46
                                                                                                            • Opcode Fuzzy Hash: f77f9165ebcf478b8adf5e4cd0bad0314ddc6cf6f551cb4d2964fef42f38387b
                                                                                                            • Instruction Fuzzy Hash: 2D0124727042888AEB964F15E840BE972E1F758BE4F84C222E620472D8CF7E8788C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006B3D0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EnumLocalesSystem
                                                                                                            • String ID:
                                                                                                            • API String ID: 2099609381-0
                                                                                                            • Opcode ID: 00ab98bc3a5c9bb3f3b3923d92dda260a2e44bddc0d1231fa70c5ffebdba5adc
                                                                                                            • Instruction ID: da8266b40a78a019d298de52b968963eb1582660fae9cb1f45ae553c3a1e1f07
                                                                                                            • Opcode Fuzzy Hash: 00ab98bc3a5c9bb3f3b3923d92dda260a2e44bddc0d1231fa70c5ffebdba5adc
                                                                                                            • Instruction Fuzzy Hash: 26F06972714A4883E741DF59F8A03D933A6E79C7C0F54C026EA0983368CF38C6998300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180072138 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EnumLocalesSystem
                                                                                                            • String ID:
                                                                                                            • API String ID: 2099609381-0
                                                                                                            • Opcode ID: 341b5473054a6dc16d806765740429804ef16fb66559330473875781b5415a13
                                                                                                            • Instruction ID: 0cff900545061369091d3a77a19d178ac89892114ee471010ec3fc7c267c7f97
                                                                                                            • Opcode Fuzzy Hash: 341b5473054a6dc16d806765740429804ef16fb66559330473875781b5415a13
                                                                                                            • Instruction Fuzzy Hash: 35F05EB270078886EB529F26E940399BAE1E799BF0F54C211E764832E5DA788694C301
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006B534 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EnumLocalesSystem
                                                                                                            • String ID:
                                                                                                            • API String ID: 2099609381-0
                                                                                                            • Opcode ID: 0140ac47cf2f78f17c319835b88675c5597476c84e6ae71437c44f33c9876db7
                                                                                                            • Instruction ID: b8df4ba5bbec931c4477fc9f6facb1d50e5387bc5255ca449800f831b738638e
                                                                                                            • Opcode Fuzzy Hash: 0140ac47cf2f78f17c319835b88675c5597476c84e6ae71437c44f33c9876db7
                                                                                                            • Instruction Fuzzy Hash: 19E0EDB6710E4885EB859F56ECA53953365A35DBD0F90D416E90D8B724DE2CC29D8300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006B5DC Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EnumLocalesSystem
                                                                                                            • String ID:
                                                                                                            • API String ID: 2099609381-0
                                                                                                            • Opcode ID: a7d41c09b545751cfef494c926d4ff08366c976d8da29d64307ffe3134cca32a
                                                                                                            • Instruction ID: 6cd817e97e845d931ff631c83a586d11136fbdea2bbc89c2a28aa46266241d91
                                                                                                            • Opcode Fuzzy Hash: a7d41c09b545751cfef494c926d4ff08366c976d8da29d64307ffe3134cca32a
                                                                                                            • Instruction Fuzzy Hash: A4E04F32A20E4895E3859F86FC603D43265A3AD7C1F90C416BC09473149E3C839E4300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800631C4 Relevance: 1.5, Strings: 1, Instructions: 260COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: gfffffff
                                                                                                            • API String ID: 0-1523873471
                                                                                                            • Opcode ID: de896200a5408dc1f88a46acefa5676e8cf485454baafd11bfb01c49dd65bfb4
                                                                                                            • Instruction ID: e0a3d1a478b2923cb74a089d3f091615611ba0ad5cad6ffd1f68b7c5f67989f3
                                                                                                            • Opcode Fuzzy Hash: de896200a5408dc1f88a46acefa5676e8cf485454baafd11bfb01c49dd65bfb4
                                                                                                            • Instruction Fuzzy Hash: 06A189727047C886EBA3CB2598117DEBB92E758BC4F14C121EEAA47785DE3DD609C341
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01165C50 Relevance: 1.5, Strings: 1, Instructions: 260COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: #X
                                                                                                            • API String ID: 0-1684620495
                                                                                                            • Opcode ID: da2adffbae41e7923876cce57094e7750823e10b7348c86b2f4e23924cd6f9cb
                                                                                                            • Instruction ID: 6e0c9caf9aebe3cd23117e80da04dae4e72c0fde7d98e1f21d28146e47fbfbe9
                                                                                                            • Opcode Fuzzy Hash: da2adffbae41e7923876cce57094e7750823e10b7348c86b2f4e23924cd6f9cb
                                                                                                            • Instruction Fuzzy Hash: 34C1F07190170CCBDB58DF28C28A58D7BF9FF54348F118029EC1E9A2A0D7B5E929CB46
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002900 Relevance: 1.5, Strings: 1, Instructions: 256COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID: 0-3916222277
                                                                                                            • Opcode ID: d29bec9ed48686087fe7eed6511cb1be24cb4c181926e92ce447d87f137c0718
                                                                                                            • Instruction ID: a49912d2d456578f6d9c65b675ba97852ef66e66468541de679dbb4011a8bcf6
                                                                                                            • Opcode Fuzzy Hash: d29bec9ed48686087fe7eed6511cb1be24cb4c181926e92ce447d87f137c0718
                                                                                                            • Instruction Fuzzy Hash: F0B1B472104A88C6E7A68F25D0D53AD3BA5E30DB9DF1A8119EFC907396CF35CA48C719
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800464AC Relevance: 1.5, Strings: 1, Instructions: 250COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID: 0-3916222277
                                                                                                            • Opcode ID: 5b89138708a7bf507ed16d8422a6220529c1988072db0519641e8a1daa260af3
                                                                                                            • Instruction ID: cfb4333eb6721552bb662e200105df73f07452df50cbd00b4a1ba8644d5b67ad
                                                                                                            • Opcode Fuzzy Hash: 5b89138708a7bf507ed16d8422a6220529c1988072db0519641e8a1daa260af3
                                                                                                            • Instruction Fuzzy Hash: 46B18672A04B5885E7A68F39C0943AC3BA0E34DF8CF268119EF49473A5DF35C659C74A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001F87 Relevance: 1.5, Strings: 1, Instructions: 249COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID: 0-3916222277
                                                                                                            • Opcode ID: 736f86d25523d8b7cce889e12815da6ba338801071f67861044f4676f26539c4
                                                                                                            • Instruction ID: c7674a9145c37a763f7d3e7ae956bb77ff70fe9c1e4534b7a3a637ad441e4108
                                                                                                            • Opcode Fuzzy Hash: 736f86d25523d8b7cce889e12815da6ba338801071f67861044f4676f26539c4
                                                                                                            • Instruction Fuzzy Hash: 59B1A472604F9885E7A68F35C0943AD3BA0E34DB8CF1A8119EF4A473A5DF71C648C74A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180046E30 Relevance: 1.5, Strings: 1, Instructions: 244COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID: 0-3916222277
                                                                                                            • Opcode ID: 5fbacfbecbf29c1cd76c645e6c7b17cea225f0752fc5adcc74a031fad94b4b00
                                                                                                            • Instruction ID: 30d6205828894f92441175eecb7e262b0afe58ad532b16b76108c2862e53ad52
                                                                                                            • Opcode Fuzzy Hash: 5fbacfbecbf29c1cd76c645e6c7b17cea225f0752fc5adcc74a031fad94b4b00
                                                                                                            • Instruction Fuzzy Hash: E7B19472605B8885E7A68F39D0943AC3BA4F34DB8CF268119EB4D077A6CF35C659C709
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01170DBC Relevance: 1.5, Strings: 1, Instructions: 231COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: nf
                                                                                                            • API String ID: 0-511086779
                                                                                                            • Opcode ID: c783981f98dfcff9253c90c0b40cb4186f2ddc319e405974b5f0546962d9f338
                                                                                                            • Instruction ID: 8da73db01870c7d5926a84e1001b9415854dff12bcb87cda9f5aae32bd1cfddf
                                                                                                            • Opcode Fuzzy Hash: c783981f98dfcff9253c90c0b40cb4186f2ddc319e405974b5f0546962d9f338
                                                                                                            • Instruction Fuzzy Hash: 64A108715143898FDBBDCE28C88A7D97BA1FB55304F508619E88ECE251CB789689CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116D9C4 Relevance: 1.5, Strings: 1, Instructions: 215COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: iS
                                                                                                            • API String ID: 0-1343070094
                                                                                                            • Opcode ID: 25276cdb969a49ef9c1e14763d65e272f0d6356fed2457f95a15ef8918c117c0
                                                                                                            • Instruction ID: fc2f3bede761cd256b99ec43ab303b60fe7a871aa8d3c43b28d25603fdfa4ed2
                                                                                                            • Opcode Fuzzy Hash: 25276cdb969a49ef9c1e14763d65e272f0d6356fed2457f95a15ef8918c117c0
                                                                                                            • Instruction Fuzzy Hash: 7BA1F1B160474ACFDB58DF68C4898CA3BA0FF58318F41452AFC099B264D3B4DA68CB85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116E4A8 Relevance: 1.4, Strings: 1, Instructions: 194COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Z<&
                                                                                                            • API String ID: 0-3145622270
                                                                                                            • Opcode ID: 7c9071b45caa33574ddf6cbee62182f14101306f73888bb589213b9ed99f1052
                                                                                                            • Instruction ID: 331f9b85d41a40ce8d46307454684e53cb946739804237fbd1c6c6ef726253f3
                                                                                                            • Opcode Fuzzy Hash: 7c9071b45caa33574ddf6cbee62182f14101306f73888bb589213b9ed99f1052
                                                                                                            • Instruction Fuzzy Hash: 7F91E370904788CFDF68DFA9C48959EBFB0FB58348F20421DE816AB2A1DB749845CF81
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01179DA8 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: D=",
                                                                                                            • API String ID: 0-2364230774
                                                                                                            • Opcode ID: 341c41dceb64fee3a9e1cbb856ceda06c278c7da28d488f4ea5d7b40f404de38
                                                                                                            • Instruction ID: 83a84ad7eb567822613e4c0bd2d1f9dc37cb419714ecefe213698d7c1eb9b1da
                                                                                                            • Opcode Fuzzy Hash: 341c41dceb64fee3a9e1cbb856ceda06c278c7da28d488f4ea5d7b40f404de38
                                                                                                            • Instruction Fuzzy Hash: C19164B590070DCFDB99DF28C19A59E3BA8FF59308F104129FC1E8A6A4D378E518CB46
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115F850 Relevance: 1.4, Strings: 1, Instructions: 163COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: @w
                                                                                                            • API String ID: 0-944231553
                                                                                                            • Opcode ID: c62698ca862748290deff37dbeae1284497843e3a26363df58e576464d5d91bf
                                                                                                            • Instruction ID: 284c385ee6f1178b01684882ed28b8503c670e1288f13c36d8591f4d2c5f1af6
                                                                                                            • Opcode Fuzzy Hash: c62698ca862748290deff37dbeae1284497843e3a26363df58e576464d5d91bf
                                                                                                            • Instruction Fuzzy Hash: 1E712B70A04709EFDB48DFA8C08998EBBF2FB54344F018569E859EB250D7B5DA09CF46
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01158CE0 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Bc
                                                                                                            • API String ID: 0-1462570906
                                                                                                            • Opcode ID: bb32d9dcd96787bd8a8f04227a24e97fdf1c381b8affaa9db156290a7c3e22a3
                                                                                                            • Instruction ID: 1fbbcf0a688f70bc769a67ece3fdb62b9ae96f1ce9ce318d6b5830f5421c3d4e
                                                                                                            • Opcode Fuzzy Hash: bb32d9dcd96787bd8a8f04227a24e97fdf1c381b8affaa9db156290a7c3e22a3
                                                                                                            • Instruction Fuzzy Hash: C56104B061C7858FD778DF18D48579ABBE0FB89314F504A1EE88E97251EB70A841CB83
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117632C Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: I
                                                                                                            • API String ID: 0-1060183710
                                                                                                            • Opcode ID: c2af9cef214826b49f10dfe4968c25a96e4d6193812f15e310ee7a9a727fc859
                                                                                                            • Instruction ID: 81ca64ba92fe41365bc50d071193017f17d7a52005c2865b571f23c085f6a2e6
                                                                                                            • Opcode Fuzzy Hash: c2af9cef214826b49f10dfe4968c25a96e4d6193812f15e310ee7a9a727fc859
                                                                                                            • Instruction Fuzzy Hash: 78516871668B458FE798CF28C886A5BBBE0FB84384F64591DE882C7365D734D845CB82
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117344C Relevance: 1.4, Strings: 1, Instructions: 132COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: Wl
                                                                                                            • API String ID: 0-4029150239
                                                                                                            • Opcode ID: cedc8f8454eb56f89d88772d6cfbf11234f96ccc8d174e33b8960ea3f4b620f8
                                                                                                            • Instruction ID: 2bf5d083140ca6b76b7c37669e663aa28e7e7d01681aab7a6a8ef26e88c38f11
                                                                                                            • Opcode Fuzzy Hash: cedc8f8454eb56f89d88772d6cfbf11234f96ccc8d174e33b8960ea3f4b620f8
                                                                                                            • Instruction Fuzzy Hash: 81415E7421DB848FC768DF28D08965ABBF0FB9A304F004A5EE5CACB256D771D845CB82
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01172C48 Relevance: 1.4, Strings: 1, Instructions: 125COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: <;
                                                                                                            • API String ID: 0-2200011300
                                                                                                            • Opcode ID: 02deb070cdf7c7c94d140e5b76a29e9b96ecd402912a2b1909e63a8e6188e217
                                                                                                            • Instruction ID: 76628d6c35d17f170f6fb0ff9b6554b2efd72f62f6722440108f09a0b8b0c06b
                                                                                                            • Opcode Fuzzy Hash: 02deb070cdf7c7c94d140e5b76a29e9b96ecd402912a2b1909e63a8e6188e217
                                                                                                            • Instruction Fuzzy Hash: C751E5705047098BDB48CF28C5C94D97FA0EB583ACF2A631DEC4EA6291D7B4D486CBC9
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01153CE8 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: !S6%
                                                                                                            • API String ID: 0-2502476444
                                                                                                            • Opcode ID: 6b4b50e5c39155536d91a699a09ac82de18bc2f64584861a0cdfa380c6dc3a9a
                                                                                                            • Instruction ID: 1601ea8a24c0a3c7cbd86de9f9a3dfda64d732ff2661f6ed203b1bf4dd83e30b
                                                                                                            • Opcode Fuzzy Hash: 6b4b50e5c39155536d91a699a09ac82de18bc2f64584861a0cdfa380c6dc3a9a
                                                                                                            • Instruction Fuzzy Hash: 8551C270158788DBEBBACF38CC896D97BB0FB48304F904619D85E8A290DF789745CB45
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117093C Relevance: 1.3, Strings: 1, Instructions: 92COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: UGF3
                                                                                                            • API String ID: 0-2981179996
                                                                                                            • Opcode ID: 00b9b430868b34ab203f780312004b7a3f9db38ffaf101cd1310d8c7c866cdd8
                                                                                                            • Instruction ID: 647fdf243d5a4f9c3cfcff35a23574b38e3bce40697fb10308b81541d9324ceb
                                                                                                            • Opcode Fuzzy Hash: 00b9b430868b34ab203f780312004b7a3f9db38ffaf101cd1310d8c7c866cdd8
                                                                                                            • Instruction Fuzzy Hash: 1841E4B091078E8FDF48DF64D89A4DE7BB0FB18348F104A1DEC66A6290D3B49665CF85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01166418 Relevance: 1.3, Strings: 1, Instructions: 89COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: |.m
                                                                                                            • API String ID: 0-2595118319
                                                                                                            • Opcode ID: 92ddf28f1c356ab03bc0505ec08d95af0741d59e36a6a02e1d131cc58f9f4d96
                                                                                                            • Instruction ID: 4782b3f6eb4c971ec4e77474540512d3c084a9020a2e7caf6fb8a834fbe742ae
                                                                                                            • Opcode Fuzzy Hash: 92ddf28f1c356ab03bc0505ec08d95af0741d59e36a6a02e1d131cc58f9f4d96
                                                                                                            • Instruction Fuzzy Hash: 7B41C2B090074E8FDB48CF68C48A4DE7FB0FB68398F204619EC59A6250D37896A4CBC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115BD24 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: #X
                                                                                                            • API String ID: 0-1684620495
                                                                                                            • Opcode ID: ffbff1e1a92d71a1fdbdc724ef034ba15b0b49349a706bcc6f59dbf7b3898b5a
                                                                                                            • Instruction ID: 5428964ba308fba5477a1c396c2cf63df2c7417fb205f7027c99dc1547d45a43
                                                                                                            • Opcode Fuzzy Hash: ffbff1e1a92d71a1fdbdc724ef034ba15b0b49349a706bcc6f59dbf7b3898b5a
                                                                                                            • Instruction Fuzzy Hash: B831F4706187848FE3B8DF28D48975BBBE0FB99344F508A1DE4CAC7254DBB49849CB02
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117BD20 Relevance: 1.3, Strings: 1, Instructions: 83COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: }f;|
                                                                                                            • API String ID: 0-2437595872
                                                                                                            • Opcode ID: 059d8a25e2aacdc38f03fa154f81eec481445a430154ce0fe971e9a978fb816b
                                                                                                            • Instruction ID: 1e0835a32b5adde85fe6271cc884e07271a45b3a0131e8c7b3376c90d26f3c40
                                                                                                            • Opcode Fuzzy Hash: 059d8a25e2aacdc38f03fa154f81eec481445a430154ce0fe971e9a978fb816b
                                                                                                            • Instruction Fuzzy Hash: 5E41B2B181038E8FDF48CF68C88A5CE7BB0FB18348F110A19F865A6260D3B4D664CF85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01169D5C Relevance: 1.3, Strings: 1, Instructions: 82COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: .)4/
                                                                                                            • API String ID: 0-1187951824
                                                                                                            • Opcode ID: da802d97eeea30a3a1afcfaf8d49ed23e284d21ba55c848d778a22b692ba5156
                                                                                                            • Instruction ID: e8f4dee17b49a26204e95faeb998f140d69d1c31a7ffb7b557a3fb46bc1e1c97
                                                                                                            • Opcode Fuzzy Hash: da802d97eeea30a3a1afcfaf8d49ed23e284d21ba55c848d778a22b692ba5156
                                                                                                            • Instruction Fuzzy Hash: 6B41C2B090078ECFDB48CF64C88A5DE7BB0FB58358F104A19F866A6250D7B8D665CBC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011530BC Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: j
                                                                                                            • API String ID: 0-1494279412
                                                                                                            • Opcode ID: 9de9d58014fd5f56acfebab85522d303df75911e99b29ee29c0185e9eb4e26cb
                                                                                                            • Instruction ID: be8c2fa749fd30e9bb24498ee63a08b2b52d99868adef35f5f07f9c0b843737c
                                                                                                            • Opcode Fuzzy Hash: 9de9d58014fd5f56acfebab85522d303df75911e99b29ee29c0185e9eb4e26cb
                                                                                                            • Instruction Fuzzy Hash: FA31E3B190074E8BCB48DF28C88A0DE7FB1FB68398F11461DE859A6250D7B4D6A4CFC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01173304 Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: m[
                                                                                                            • API String ID: 0-1176897218
                                                                                                            • Opcode ID: 152df2dcbee70cce799082e6bf2d8d8f242c1d73cee316818e31239bc9927954
                                                                                                            • Instruction ID: 3f7cee5e3b0da8f33f4277c7bfebcf10c772b7a34c53140410f01e53cff33354
                                                                                                            • Opcode Fuzzy Hash: 152df2dcbee70cce799082e6bf2d8d8f242c1d73cee316818e31239bc9927954
                                                                                                            • Instruction Fuzzy Hash: 3641C1B080070E8FDB44CF64C88A5CE7FB0FB68798F200219E859A6250D3B8D6A4CBD5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116D4D0 Relevance: 1.3, Strings: 1, Instructions: 73COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: <
                                                                                                            • API String ID: 0-526293805
                                                                                                            • Opcode ID: 321d720d3d7db507eabee4dd342704b6ef45e660c7d068d108f30aaeb31130dd
                                                                                                            • Instruction ID: 95378e4b1897521d347bcbdc806cf7e332e16b7ace8e65e41a5452ac871b9b39
                                                                                                            • Opcode Fuzzy Hash: 321d720d3d7db507eabee4dd342704b6ef45e660c7d068d108f30aaeb31130dd
                                                                                                            • Instruction Fuzzy Hash: 87316170528380ABD388DF29C49981BBBE1FBC9304F806A1DF9C68B294D774D805CB43
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01152708 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: |-
                                                                                                            • API String ID: 0-4231097972
                                                                                                            • Opcode ID: da09cdedbf386eb0e2753eee591904f0caa87d7abe42f1abcb7c903e67c98b86
                                                                                                            • Instruction ID: f4bcca97af8ad337045e3c8ac140f5163243ef5721515da4bca9d255a8ce233e
                                                                                                            • Opcode Fuzzy Hash: da09cdedbf386eb0e2753eee591904f0caa87d7abe42f1abcb7c903e67c98b86
                                                                                                            • Instruction Fuzzy Hash: F0318CB0528781AF8388DF28D48581BBBF1FBC8304F806A2EF886CB350D774D4458B42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115ED84 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: <l
                                                                                                            • API String ID: 0-1982744179
                                                                                                            • Opcode ID: 2db1177352cd73b0331f739891796cde75e0ec20f3aeb5d2f4af3d512a179367
                                                                                                            • Instruction ID: 8b8ea5d6e09e07b6056d2d273abf0fd72f6c37a7a22d9957cb21fe1b369ae7ae
                                                                                                            • Opcode Fuzzy Hash: 2db1177352cd73b0331f739891796cde75e0ec20f3aeb5d2f4af3d512a179367
                                                                                                            • Instruction Fuzzy Hash: B5317F70528780AFD388DF28D49981EBBE0FB99344F816A2EF9868B364D775D445CB43
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01174020 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: +'\9
                                                                                                            • API String ID: 0-578698518
                                                                                                            • Opcode ID: dd5080abbe3794cc00d6f3c5414aae14ad67107c1ca0b8db0a31ef92eff77edd
                                                                                                            • Instruction ID: f60a43e3f3df0a12f27f8c15a525905191ff57296c1ebd5efa78271282a73683
                                                                                                            • Opcode Fuzzy Hash: dd5080abbe3794cc00d6f3c5414aae14ad67107c1ca0b8db0a31ef92eff77edd
                                                                                                            • Instruction Fuzzy Hash: E3212470208B859FD798DF28D58951BBBE2FB98704F805A1EF48AC7360E774D844CB02
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01166594 Relevance: 1.3, Strings: 1, Instructions: 66COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 4-
                                                                                                            • API String ID: 0-3207380349
                                                                                                            • Opcode ID: 4158c1f082f3f5a8b77e2afe5de94a8b0ae6d0ec855501ceef73a1a62d1632b4
                                                                                                            • Instruction ID: 16c0a164636ccce28980f9d24bcf0c8729a78ee771004a7449adb3eaaf0588b7
                                                                                                            • Opcode Fuzzy Hash: 4158c1f082f3f5a8b77e2afe5de94a8b0ae6d0ec855501ceef73a1a62d1632b4
                                                                                                            • Instruction Fuzzy Hash: 75319EB0629781AFD388DF28D58991ABBF1FBC9304F806A5DF9868B360D774D444CB02
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01154078 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: |
                                                                                                            • API String ID: 0-1956522723
                                                                                                            • Opcode ID: c5e3cc76b1ed70b4182e45d6f9c9cb28726a70ced03980423ed3cc30a8c5a766
                                                                                                            • Instruction ID: 2f1e5198d3f84652492ac9733e5d828b8cbd298b8c1b8cbbb07342d02e9883d2
                                                                                                            • Opcode Fuzzy Hash: c5e3cc76b1ed70b4182e45d6f9c9cb28726a70ced03980423ed3cc30a8c5a766
                                                                                                            • Instruction Fuzzy Hash: 07316AB0A187808BD349DF28D45941EBBE0BB9D31CF414B1DF5CAA6290D77CD648CB4A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01155484 Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: 5}
                                                                                                            • API String ID: 0-3445415368
                                                                                                            • Opcode ID: 86b3c4bae53a0b1bec2ad146aacb87fdd316c664a6c8b6d1ade51f187c4a9163
                                                                                                            • Instruction ID: a19a670f15ccede280dc3507a54f55b2dc588c80dfb03244ea1c15b289e819ff
                                                                                                            • Opcode Fuzzy Hash: 86b3c4bae53a0b1bec2ad146aacb87fdd316c664a6c8b6d1ade51f187c4a9163
                                                                                                            • Instruction Fuzzy Hash: E921337120AB44AFD388DF29C58981BBBE0FB94648FD0691DF492C63A0D3B8D804CF02
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115B1A8 Relevance: 1.3, Strings: 1, Instructions: 60COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: :$b
                                                                                                            • API String ID: 0-2229885062
                                                                                                            • Opcode ID: e95da024e6af3800dbf6f15e382c37e4e83d4a1b2c4dd5c1b9d0615b67ba7242
                                                                                                            • Instruction ID: dfe3fb2b1801237f1af73118ca7dbe881fe34a1f54a472376f612d1b9644e1d5
                                                                                                            • Opcode Fuzzy Hash: e95da024e6af3800dbf6f15e382c37e4e83d4a1b2c4dd5c1b9d0615b67ba7242
                                                                                                            • Instruction Fuzzy Hash: 3B317AB45087858BD348DF28C45991AFBE1BB8C71CF404B2DF4CAAB3A0D7799645CB4A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01167B24 Relevance: 1.3, Strings: 1, Instructions: 59COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: }
                                                                                                            • API String ID: 0-512092715
                                                                                                            • Opcode ID: 0e736afdf03b46ebb9b446eb3fce043211b9b92680aba01dbdb34d597fbc3562
                                                                                                            • Instruction ID: 10336db1dd62152f65f9b7b457300fcfa79ff78764951fa381f1bb8a677f9da6
                                                                                                            • Opcode Fuzzy Hash: 0e736afdf03b46ebb9b446eb3fce043211b9b92680aba01dbdb34d597fbc3562
                                                                                                            • Instruction Fuzzy Hash: C9218CB052D780AFD389DF28D48A81BBBF1FB89345F806A2DF88687250D7B4D5448B03
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002CD9 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: HeapProcess
                                                                                                            • String ID:
                                                                                                            • API String ID: 54951025-0
                                                                                                            • Opcode ID: 9fb8db1bb37ac9368848f1277739b04f9d9a6a92f809fbccbdae4d1b45c18380
                                                                                                            • Instruction ID: 2d44f3bbc4265356ad4d4aec815cb08821f8880c91c92ba0c637829f0a688550
                                                                                                            • Opcode Fuzzy Hash: 9fb8db1bb37ac9368848f1277739b04f9d9a6a92f809fbccbdae4d1b45c18380
                                                                                                            • Instruction Fuzzy Hash: FDC04C31E02E48C2E5962B266C5534416557B5C744F988515900941710DE2C07A95701
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180060F1C Relevance: .6, Instructions: 641COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fcb6dde149e1d018a7fefeea18cf0724a2e420f2b8b08b8fe0bc0f162285b521
                                                                                                            • Instruction ID: a36add6e594a9839f1744c23ab2987b417509fa413634c1d95f35e151b02e39e
                                                                                                            • Opcode Fuzzy Hash: fcb6dde149e1d018a7fefeea18cf0724a2e420f2b8b08b8fe0bc0f162285b521
                                                                                                            • Instruction Fuzzy Hash: FFE1A57120078889FBA2DBA198103EA73A6F7987C9F548015FE6A87BD5DF34C749C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180071584 Relevance: .5, Instructions: 512COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d652f8eed1bb7634c6e77ef4f56a8effe3b1d21ab32dfa2026b217d44dca3c7d
                                                                                                            • Instruction ID: 05c41f7db7311ccff83ac68200e38f35f7e47b97d7cf88f90db18e77bd6dc93f
                                                                                                            • Opcode Fuzzy Hash: d652f8eed1bb7634c6e77ef4f56a8effe3b1d21ab32dfa2026b217d44dca3c7d
                                                                                                            • Instruction Fuzzy Hash: 42B1D3326146488AEBA6DF29D4117EA33A1F388BCAF54C225EE55836C9DF3DC749C740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800640D0 Relevance: .4, Instructions: 386COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 4bedba4d916b754754e92d1d6b7250d2caeabb986c62b54373e2fc767992e332
                                                                                                            • Instruction ID: 4bab00ab1b7c35fb6d8039bfabaf8d0641a8db011bb49ed7cd062e7e4b4d00c5
                                                                                                            • Opcode Fuzzy Hash: 4bedba4d916b754754e92d1d6b7250d2caeabb986c62b54373e2fc767992e332
                                                                                                            • Instruction Fuzzy Hash: F381EA7320478446EBF5CF1998413AA7A92F39E7D4F64C215FAA94BB95CF3CC6488B00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003297 Relevance: .4, Instructions: 369COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: f935fc812dbed316ce2308b1eca220534bbb621787374a582bad6347faf9f524
                                                                                                            • Instruction ID: 503a21fee6c66f9c5fa66356c0d78ae670d11d0d0a0a401f68fd840416401a6c
                                                                                                            • Opcode Fuzzy Hash: f935fc812dbed316ce2308b1eca220534bbb621787374a582bad6347faf9f524
                                                                                                            • Instruction Fuzzy Hash: 76E1AF36200A4986EBFADE19C1807F937A1F748BCCF56C126AE45473D5CE35CA8AC708
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003477 Relevance: .4, Instructions: 365COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3ce7b0c1a01810bc282f90e163b4989e0b19603028b70489598dad528a6c1bad
                                                                                                            • Instruction ID: 046f0075a1a02b8f84d948d5c5c4c30232b604455063e23d51fc54361b3ce924
                                                                                                            • Opcode Fuzzy Hash: 3ce7b0c1a01810bc282f90e163b4989e0b19603028b70489598dad528a6c1bad
                                                                                                            • Instruction Fuzzy Hash: AEE17F76104A4986EBBADE1980803F937A1F74CBDCF57C11AAE85473E5DE25CA4AC708
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018004E924 Relevance: .4, Instructions: 364COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3220a9c1e571ddbd62ae7a343cb8b24d694aaa344fa294ac97b7fe2dd244668c
                                                                                                            • Instruction ID: d8fbc72debbd2b383114e9ef5da844c20566fbdebdd9e83b47a76c56add53576
                                                                                                            • Opcode Fuzzy Hash: 3220a9c1e571ddbd62ae7a343cb8b24d694aaa344fa294ac97b7fe2dd244668c
                                                                                                            • Instruction Fuzzy Hash: AFE1A436100A8986EBEADF19C0803E937A1F74ABDCF5AD115AE45073D5CF25CACAC349
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003C83 Relevance: .4, Instructions: 350COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 67978a7bcad8dc5d2aac55ac65f45913430debe0080c95e32e2cb28a5fa8bab9
                                                                                                            • Instruction ID: 4eb7eb593ab97838f874d734d49b4975a1907a8ac1a6fd1b1ee5e2dca911f367
                                                                                                            • Opcode Fuzzy Hash: 67978a7bcad8dc5d2aac55ac65f45913430debe0080c95e32e2cb28a5fa8bab9
                                                                                                            • Instruction Fuzzy Hash: 71E16272204A4C86EBA6CE2985843ED27A1E74DBDCF16C257EE55473E5CF31CA4AC309
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018004CAEC Relevance: .3, Instructions: 345COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 95730dadc5d6451c99ff7558c463954e302a51a9370f62bbaaee822baa6738a7
                                                                                                            • Instruction ID: 821acd9e67e9f90977fee4680a894958c0df2a26da3c412b57d8c36303ea0834
                                                                                                            • Opcode Fuzzy Hash: 95730dadc5d6451c99ff7558c463954e302a51a9370f62bbaaee822baa6738a7
                                                                                                            • Instruction Fuzzy Hash: 3CE19072500A4885EBEACA2A84C5BED27A1E70DBDCF16C115EE49573D5CF31CA4AC34A
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018004D588 Relevance: .3, Instructions: 345COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 6f5d6d6e75bf4cc2b2a0429e00623dd71ca4b9d967265e4024f7f15c776c7f86
                                                                                                            • Instruction ID: 8c3efeaf516f0397454b5055ca471d80566a540a6c8ea9b461ecdc24a569c2fe
                                                                                                            • Opcode Fuzzy Hash: 6f5d6d6e75bf4cc2b2a0429e00623dd71ca4b9d967265e4024f7f15c776c7f86
                                                                                                            • Instruction Fuzzy Hash: E5E1A072204A4C85EBAA9B2981943ED27A1E70DBCCF17C247EE49573D5CF31CA4AC708
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001D57 Relevance: .3, Instructions: 344COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 96c0cac7c4020ecc634ad0243d6f4de916a34a83cb016d32896c7c0ed520cad1
                                                                                                            • Instruction ID: 09f96dcc5513ea0cf51ec156d39aa9be73e1c0ea2e326ffe3669b432568cd308
                                                                                                            • Opcode Fuzzy Hash: 96c0cac7c4020ecc634ad0243d6f4de916a34a83cb016d32896c7c0ed520cad1
                                                                                                            • Instruction Fuzzy Hash: 12E19E72604A49C6EBEACF1980407AD37A0F748BC4F64C216FE4967394DF36CA9AC745
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000427D Relevance: .3, Instructions: 340COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ceb63e7a67298091cd13f858d3fe3f61f306cd2828d5d94660855653628f20bd
                                                                                                            • Instruction ID: 8c857066a9cbfb7cbb0425f2355b307428f999079564aaa049a16d99ec05648e
                                                                                                            • Opcode Fuzzy Hash: ceb63e7a67298091cd13f858d3fe3f61f306cd2828d5d94660855653628f20bd
                                                                                                            • Instruction Fuzzy Hash: 0CD1BD32A0464DC6EBAACF1980507AD37A0F70CBC4F64D216FE4967395DF26CA9AC744
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000269E Relevance: .3, Instructions: 340COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fb29df3b3284f958ea1748d5b3bdd4814b470f8c8801e25db0f03e24317fe633
                                                                                                            • Instruction ID: ca0c9b804cb0e7c369c446c4e83cdf3e997bae93298814ab0ccc10f251fff70f
                                                                                                            • Opcode Fuzzy Hash: fb29df3b3284f958ea1748d5b3bdd4814b470f8c8801e25db0f03e24317fe633
                                                                                                            • Instruction Fuzzy Hash: EAD19E32600A4D86EBBA9F1581807BD37A1F70CBD8F568216EE59473A5DF25CA4AC348
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180004200 Relevance: .3, Instructions: 336COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 0c6b65bcba5bf85bfc0752deddfbc1e043db31fdcb3c332b3e6d9b3d0eb8fcb5
                                                                                                            • Instruction ID: 5da21973f037b08006690474ffb02792b42d824d66591bb713e3df241b3aacb6
                                                                                                            • Opcode Fuzzy Hash: 0c6b65bcba5bf85bfc0752deddfbc1e043db31fdcb3c332b3e6d9b3d0eb8fcb5
                                                                                                            • Instruction Fuzzy Hash: 00E17D32600B8485E762DB62E8517EE37A9F79C7C8F418621AFAD57796EF34C259C300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002AA9 Relevance: .3, Instructions: 322COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: b0db7158e50f5bba77743d4231ec8ae11772107607ce477318933eac118e5d70
                                                                                                            • Instruction ID: 58f604e1cf46e6c1bfc922b720afaf4eb4b4d03010ec6e159499bd803389a02a
                                                                                                            • Opcode Fuzzy Hash: b0db7158e50f5bba77743d4231ec8ae11772107607ce477318933eac118e5d70
                                                                                                            • Instruction Fuzzy Hash: B6D1D732200A8C86EBAA8F2591807ED27A1E70EBCCF568115EE55077D5CF75CACAC748
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001302 Relevance: .3, Instructions: 318COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 16b09ae659ce0517e2164dba50530a9ea84295e54296802c540bff4129581814
                                                                                                            • Instruction ID: 6ab8f96c7e0e55d4065779e2bc8afb18c8d6a7a24518bce4bc52dd36ad1a1800
                                                                                                            • Opcode Fuzzy Hash: 16b09ae659ce0517e2164dba50530a9ea84295e54296802c540bff4129581814
                                                                                                            • Instruction Fuzzy Hash: 81D1B072604E4D86EBAA8F2990903ED27A1E70DBCCF568147EE45077D5DF35CA4AC348
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003634 Relevance: .3, Instructions: 318COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 819aeb0b15e74d69720e1f0daba5a36dc9baf9b8bf9997b821cad2c90a554f08
                                                                                                            • Instruction ID: f69ba7f7fccc04de05c6e97648d944a6f469103e1cf691e0a85479a4ebe33c64
                                                                                                            • Opcode Fuzzy Hash: 819aeb0b15e74d69720e1f0daba5a36dc9baf9b8bf9997b821cad2c90a554f08
                                                                                                            • Instruction Fuzzy Hash: 00D1D572604E8C86EBA68B2990803ED37A1E70EBDCF568105EE45077D5DF35C69AC748
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117B0EC Relevance: .3, Instructions: 280COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 25e9785e14bfc532a33a8d2b5ce6672df74705a45cb337cafce4f8a35c514c61
                                                                                                            • Instruction ID: 836096b47286639f2f6fc7e9434f3294329cad9d0e1f78c3afa734e4c7bf0515
                                                                                                            • Opcode Fuzzy Hash: 25e9785e14bfc532a33a8d2b5ce6672df74705a45cb337cafce4f8a35c514c61
                                                                                                            • Instruction Fuzzy Hash: 26D1F87050464ACFDB48CF28D88A8DA3FB1FB68398F515219FC4AA72A0D778D595CBC4
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116B028 Relevance: .2, Instructions: 224COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 037e2042bd2a0acb3e393e378e78f344ed8b94baf85b07ee52f3f9808c864edc
                                                                                                            • Instruction ID: eed05037ef13f4b59daf225786e7c1460d5c8f85011cd4e893f052eb6e251ba9
                                                                                                            • Opcode Fuzzy Hash: 037e2042bd2a0acb3e393e378e78f344ed8b94baf85b07ee52f3f9808c864edc
                                                                                                            • Instruction Fuzzy Hash: 3CA10370D0471A9FDF48CFA8C98A4AEBBB0FB48304F10851ED466F6290D7789A55CF96
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116406C Relevance: .2, Instructions: 197COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7f0a0319216a87eaaa37156c3843347877d9c742f4f57ae8c16ead42c7bd4d8b
                                                                                                            • Instruction ID: 15b20a87c6a494940898dc7d608a4c0ab3ac4e787a369c2353c613bdc114584e
                                                                                                            • Opcode Fuzzy Hash: 7f0a0319216a87eaaa37156c3843347877d9c742f4f57ae8c16ead42c7bd4d8b
                                                                                                            • Instruction Fuzzy Hash: 2181377150464C8BEB4CCF28D8895E93BB0FB48358F565329FC4AEA290C379D895CB89
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002095 Relevance: .2, Instructions: 156COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 427d617d29f1667240bea6e5ec5b81f164475f331e267f252a8ff93c00d007de
                                                                                                            • Instruction ID: ce6f135587d422924e5830bfca65210c1e3d12016a2dd9edbbcac8a12d16c1a6
                                                                                                            • Opcode Fuzzy Hash: 427d617d29f1667240bea6e5ec5b81f164475f331e267f252a8ff93c00d007de
                                                                                                            • Instruction Fuzzy Hash: 4151D33250564886FBABDF69C0543EE33A0E74DBDCF168225FA494B6D9CF25CA49C300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000322E Relevance: .2, Instructions: 156COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: e2368d11ffd37813a977caadcf2f3bb51157d2d5127685b74345bb56c4a97d4c
                                                                                                            • Instruction ID: 27615ba8d9fdcbbc2e7d1d13b54d5146c553e4cbd1355be7c027e366cc1db086
                                                                                                            • Opcode Fuzzy Hash: e2368d11ffd37813a977caadcf2f3bb51157d2d5127685b74345bb56c4a97d4c
                                                                                                            • Instruction Fuzzy Hash: 4151B23212464CC2EBA7DE29E0513EA73A0E70DBDCF179216FA460B6C9CF65CA49C341
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800018B6 Relevance: .2, Instructions: 156COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 46326237b34575b2db90ff96c55329694fad5a606d4bfdd3c5d82d9f267b74ac
                                                                                                            • Instruction ID: d6d3a92de4a3b9249e8f058c0c5b157594af98e703221313db864d664cdff280
                                                                                                            • Opcode Fuzzy Hash: 46326237b34575b2db90ff96c55329694fad5a606d4bfdd3c5d82d9f267b74ac
                                                                                                            • Instruction Fuzzy Hash: 2B51A572100A4886E7A78E29C025BEF3760E70D7DCF169215FA498B7D9CF25DA89C702
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800019A6 Relevance: .2, Instructions: 156COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: c2725e2d0382e21e48731d9b6023436c9776f2113d0533d74769ee56d99d4870
                                                                                                            • Instruction ID: 77a26e249351a58d44f84f5b349a7ddc9249c81ad99b1e1ca031593fab4e9c0f
                                                                                                            • Opcode Fuzzy Hash: c2725e2d0382e21e48731d9b6023436c9776f2113d0533d74769ee56d99d4870
                                                                                                            • Instruction Fuzzy Hash: 5751907221064886EBB7DE29C0553EA33A0E74DBDCF168215FB4A8B6D9DF35CA49C341
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003E218 Relevance: .2, Instructions: 155COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d1886929c345337fe2b47e7209536fff2fa1b33b4870171123f37d573efb61c7
                                                                                                            • Instruction ID: 60b30cc3532951d33513a01755912c963ced5c67f725b8ccc0a13c47aff52a45
                                                                                                            • Opcode Fuzzy Hash: d1886929c345337fe2b47e7209536fff2fa1b33b4870171123f37d573efb61c7
                                                                                                            • Instruction Fuzzy Hash: 835170721006C8C6EBA79E2980543EE37A1E74EBDCF168315FA465B7D9CF25CA4AC701
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003A618 Relevance: .2, Instructions: 155COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 8ee5cd7d65ba555eac087be1a651ee4d782711a591636b795167a9e5c0e9d750
                                                                                                            • Instruction ID: 08ef14c6df6963b973dd459c80130b4e4dae8cc1bb782e47aeb504ee28248c58
                                                                                                            • Opcode Fuzzy Hash: 8ee5cd7d65ba555eac087be1a651ee4d782711a591636b795167a9e5c0e9d750
                                                                                                            • Instruction Fuzzy Hash: 6451A57610864886F7A7CF29C8553EA37A0E74E7DCF168215FA460B7D9CF25CA4AC740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002F5E Relevance: .2, Instructions: 155COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: e018785e595386ac972ac869fd8e5ca571391b0609635c8f63d4254dbe8c7751
                                                                                                            • Instruction ID: 9a58d8e7dd79e47563b4cfae164498c091690b83af3ad5162703a931b9746ab1
                                                                                                            • Opcode Fuzzy Hash: e018785e595386ac972ac869fd8e5ca571391b0609635c8f63d4254dbe8c7751
                                                                                                            • Instruction Fuzzy Hash: DC51B57211064886F7A7DF29C015BEB37A1E70DBD8F169215FA499A7C9CF25CA49C302
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800011DB Relevance: .2, Instructions: 155COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 6c53839c0f845a97eb698c91a255b224ddf079ac0e2791fce9a4dda0028343cb
                                                                                                            • Instruction ID: 507b79f90adca7607216da8a3b11d31cd19595eff1d72e3ef63f584c5426a594
                                                                                                            • Opcode Fuzzy Hash: 6c53839c0f845a97eb698c91a255b224ddf079ac0e2791fce9a4dda0028343cb
                                                                                                            • Instruction Fuzzy Hash: 1E51B0321056898AF7AB8E69C0553EA37A0E70CBD8F168215FA4A1B6C9CF25CA49C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003206 Relevance: .2, Instructions: 155COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1e97c9b441f4348f1e7ff7b240152a30aedd407a2deebbc3ce81d8774cf20467
                                                                                                            • Instruction ID: ca79f43b29708f875e0bc41431c19305327c734620b9ed7b51c36a776de8e610
                                                                                                            • Opcode Fuzzy Hash: 1e97c9b441f4348f1e7ff7b240152a30aedd407a2deebbc3ce81d8774cf20467
                                                                                                            • Instruction Fuzzy Hash: D55188721186488AF7A7CF69C8553EA3760E74E7DCF168215FA4A077D9CF25CA49C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800019E2 Relevance: .2, Instructions: 155COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 44cd0b7aecdc7f6b8f368d085cdc9ffedba1a1986e3f04ca744e23b2a96ae767
                                                                                                            • Instruction ID: 8da6dde43cb66a6ef207fdd5318265d1155ff8adaaf41c63bf801a009b0de4d2
                                                                                                            • Opcode Fuzzy Hash: 44cd0b7aecdc7f6b8f368d085cdc9ffedba1a1986e3f04ca744e23b2a96ae767
                                                                                                            • Instruction Fuzzy Hash: D4517F7210064C87EBA79E29E0543EE27A0E74DBDCF169216FA4A0B6D9CF35DA4DC701
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003B510 Relevance: .2, Instructions: 154COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 97b220c05416b7d680a89d3db3bb60453f94ff276e31fd7cd3c48d47762e08fc
                                                                                                            • Instruction ID: 17bc060added96202ec13a0defbc097531f54e7119c6672836663e6ae2a1da4b
                                                                                                            • Opcode Fuzzy Hash: 97b220c05416b7d680a89d3db3bb60453f94ff276e31fd7cd3c48d47762e08fc
                                                                                                            • Instruction Fuzzy Hash: 2F51A37620464886F7A7CE29C0563EE37A0E74C7DCF168215FB498B6DACF29CA49C701
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180039710 Relevance: .2, Instructions: 154COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 644e54002218c213d82a367027309467d1dd896da02c5bf1fd9b699ff6b09e0c
                                                                                                            • Instruction ID: 8681fec1e9280bed59e91ff7b437b169da0ef59b3abca0806554fc41b4a3433c
                                                                                                            • Opcode Fuzzy Hash: 644e54002218c213d82a367027309467d1dd896da02c5bf1fd9b699ff6b09e0c
                                                                                                            • Instruction Fuzzy Hash: 6251A17211564886FBA78FA9C0543EE27A0F78DBD8F168215FA4A0B6C9CF35CA49C701
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01167DB0 Relevance: .1, Instructions: 143COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: e660bb8dbd585ac44baa89714007651326a0f7485406fcacd91da596ea4a28a8
                                                                                                            • Instruction ID: 7b5efe8b6a5447f03313a932574997e14d655d611681aecb61d85be0755574a1
                                                                                                            • Opcode Fuzzy Hash: e660bb8dbd585ac44baa89714007651326a0f7485406fcacd91da596ea4a28a8
                                                                                                            • Instruction Fuzzy Hash: 21513670D0460E8BEF58DFA8C48A4EEBBB0FB18308F104129E515F7290D7B99A55CF96
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011678C4 Relevance: .1, Instructions: 142COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ec593b80def78b66f206c32313c3bfcf58b2275c46c2ba9467975e2ce4df2791
                                                                                                            • Instruction ID: d0c5a48dc627b9b57d7e4b274f73f309df8b7544fad258c6b1875ec6b7eb87aa
                                                                                                            • Opcode Fuzzy Hash: ec593b80def78b66f206c32313c3bfcf58b2275c46c2ba9467975e2ce4df2791
                                                                                                            • Instruction Fuzzy Hash: AE71B0B090074A8BDB88DF64C58A4DE7FB1FB68398F204119FC06972A0D7B4D6A5CBD1
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01176F3C Relevance: .1, Instructions: 141COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 8f0e16368c704187141b6fb0efb02278d5bc33123132ba3fd1801deba8d4faa7
                                                                                                            • Instruction ID: 8e5186a906b573d8f87d05865ae9585e4cd180eb460cc43cee2a22b7109bfb33
                                                                                                            • Opcode Fuzzy Hash: 8f0e16368c704187141b6fb0efb02278d5bc33123132ba3fd1801deba8d4faa7
                                                                                                            • Instruction Fuzzy Hash: B451F870D0471C8FDB68DFE9D88959EBBB0FF44308F504229D856AB294D7B89946CF42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0115F580 Relevance: .1, Instructions: 140COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 944917ea1874b5bb835b2d9dfc5b5994d4cfa4edd529642523b1046e02155be7
                                                                                                            • Instruction ID: 89634dbfd2dd9ea5fbf5f4d0dddf4cec6df68202f62da3a955c7822d02e3917c
                                                                                                            • Opcode Fuzzy Hash: 944917ea1874b5bb835b2d9dfc5b5994d4cfa4edd529642523b1046e02155be7
                                                                                                            • Instruction Fuzzy Hash: 8161157090070E8BCF48DFA8C48A4EEBFB1FB58394F60411DE806A62A0D7749A95CFD4
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800043DB Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d402aca391409eef666ebef5175f76dbae9f68093d3a35d682dba505861a282f
                                                                                                            • Instruction ID: 20548f29fa9ff1c07d7a9278187ce19017f79c668c9350095e7b5e6d68559d02
                                                                                                            • Opcode Fuzzy Hash: d402aca391409eef666ebef5175f76dbae9f68093d3a35d682dba505861a282f
                                                                                                            • Instruction Fuzzy Hash: 3651B173604A5882E7AB8F28C0553BE77A0E359BACF168215EF45977D8CF21CE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002586 Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7a866bdef91c203aacd29aad74dbcf0d02de61fa256262bf3ed0c54dffbf950e
                                                                                                            • Instruction ID: 39ce0d7a8c9e16fc601b4c70ed66b681d40e65abe531c0bfab6118882680c356
                                                                                                            • Opcode Fuzzy Hash: 7a866bdef91c203aacd29aad74dbcf0d02de61fa256262bf3ed0c54dffbf950e
                                                                                                            • Instruction Fuzzy Hash: 6051D33360065886E3AF8F28C5547AE37A0E349BDCF169214EF05973D9CB21CE85CB80
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800025BD Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 8f4d87fbdcd150e6c6d31a4ad28c892a68fb4bfcf5314a499ddba4373a19804d
                                                                                                            • Instruction ID: ff4da4ad38e9836d674b7cab688e1fed77cc1e2da2643241302b86ae3f845c2a
                                                                                                            • Opcode Fuzzy Hash: 8f4d87fbdcd150e6c6d31a4ad28c892a68fb4bfcf5314a499ddba4373a19804d
                                                                                                            • Instruction Fuzzy Hash: 8751B57760069882E7AF8F28C1543AE27A0E35AB98F168315EF46177D9CF31CE85C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800029AA Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7319bd8a0fa895ad80f0e2b768743529d8318f80282f08cb050e867b330fc252
                                                                                                            • Instruction ID: f1664fde47f0de7f0c4376c5fff90134615a58976f3af01eee2b1bed1702f6db
                                                                                                            • Opcode Fuzzy Hash: 7319bd8a0fa895ad80f0e2b768743529d8318f80282f08cb050e867b330fc252
                                                                                                            • Instruction Fuzzy Hash: 0C51907360065C82E7AF8F29E0543AE27A1E359BA8F168217EF45177D9CF21DE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002E00 Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 6cfd0c90f740175f3eb19e2180c71e5e03681fca5691f7a4507f1bbea513a9dc
                                                                                                            • Instruction ID: beab91fc5516b6ec6ed49fc7833cee2c9136f592117abde040b271ab492b6fb4
                                                                                                            • Opcode Fuzzy Hash: 6cfd0c90f740175f3eb19e2180c71e5e03681fca5691f7a4507f1bbea513a9dc
                                                                                                            • Instruction Fuzzy Hash: 4751E27361565882E7AB8F68C0553BE37A1E349BA8F169214EF46177D8CF31CE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002F7C Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 5d8a2ad49dd325b37c03d7b2c22a992ec9490a95ac0323cc5ed738745f5d1e69
                                                                                                            • Instruction ID: ebbb3a72dc3d7b89a73450f50d54f663287619d7792bf24fae89fd9f055fcdab
                                                                                                            • Opcode Fuzzy Hash: 5d8a2ad49dd325b37c03d7b2c22a992ec9490a95ac0323cc5ed738745f5d1e69
                                                                                                            • Instruction Fuzzy Hash: 7051D477608A1882F7AB8F28C5543AE37A0E35ABA8F178115EE45277D8CF35CE46C740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003459 Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 71dd9a08bef68a49493ccb028e044b62926082a79501bf2aa9f3e00ae819bf68
                                                                                                            • Instruction ID: 0d4e0a15f8b821114459b47b58ba4bf1370e8b1952feff2fbe8d7dd737d7ae95
                                                                                                            • Opcode Fuzzy Hash: 71dd9a08bef68a49493ccb028e044b62926082a79501bf2aa9f3e00ae819bf68
                                                                                                            • Instruction Fuzzy Hash: 0151B477604A9882E7AB8F28C0553AE37A0E35ABECF168314EE45177D8DF21DD45C740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800019B5 Relevance: .1, Instructions: 139COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 32b2c9332f2f96c429b646f67989e5f81ae6b8865881fc566edc088a5e106155
                                                                                                            • Instruction ID: b47a22dc88069f38972ecade7c25030b34b2f07fa2730be892b477b679b0f382
                                                                                                            • Opcode Fuzzy Hash: 32b2c9332f2f96c429b646f67989e5f81ae6b8865881fc566edc088a5e106155
                                                                                                            • Instruction Fuzzy Hash: F551C0B320065882E7AB8F68C0547AF27B0E359BE8F168115EF46977D8CF21DE49C781
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003A148 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a9cafb6b6e3bdd0954076572db831dcfc8a733568b81b1db0a726fb888a601ed
                                                                                                            • Instruction ID: e2b98026ec8e45c5487a4010e513284169932ba0b6f32e186b3a35055f4b9069
                                                                                                            • Opcode Fuzzy Hash: a9cafb6b6e3bdd0954076572db831dcfc8a733568b81b1db0a726fb888a601ed
                                                                                                            • Instruction Fuzzy Hash: C551C37360861882F7AB8F29C9543AE37A0E35ABE8F168119EF45177D8CF21DE45C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003A3B0 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ab3d1bfdc3aa2f223fbf75a9660ff164acecd1beba1d87bd09117588e33fbba3
                                                                                                            • Instruction ID: 5e6764176f487724ea8230ad236d41125ce7ef81bc5bee25594e58880700dc52
                                                                                                            • Opcode Fuzzy Hash: ab3d1bfdc3aa2f223fbf75a9660ff164acecd1beba1d87bd09117588e33fbba3
                                                                                                            • Instruction Fuzzy Hash: F251DA73608A1882F7AB8F28C5583AE3760E39AB98F168115EF46177D8CF74CD46C740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800026CB Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 49048a3cc34c66d86ec5bb605fd4d3fd3d58905633e134b9bd2ffc60c27d38d7
                                                                                                            • Instruction ID: 35c8e04d1da802a4ca7629fc34e5b81574b130bd380d08158e5068f3fff44afb
                                                                                                            • Opcode Fuzzy Hash: 49048a3cc34c66d86ec5bb605fd4d3fd3d58905633e134b9bd2ffc60c27d38d7
                                                                                                            • Instruction Fuzzy Hash: C951CF7220075882E7AF8E28C0543AE37A0EB69B98F268144EF45177D9CF24CE49E780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003C6D4 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: c25417a70265999a783e691c8c67876e194dd4de9bd2f6729be0ad88264c57e2
                                                                                                            • Instruction ID: 8fa201e0e618386c24a00752ce65c0ea5a41a533e2ec8566075e0973f427c35e
                                                                                                            • Opcode Fuzzy Hash: c25417a70265999a783e691c8c67876e194dd4de9bd2f6729be0ad88264c57e2
                                                                                                            • Instruction Fuzzy Hash: 0F51B37760465882E7AB8F28C0547AF37A0E359BE8F168115EE45977D8CF31CE46CB81
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002C61 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: da629c928ab8c2cb11545f2b0ed51c9c8c979cfdd8f22b6fab48e473e11f8cec
                                                                                                            • Instruction ID: 64a893900c5956a85d550d4078225c90c4b8f995b3b84b9e6ee9729bba911210
                                                                                                            • Opcode Fuzzy Hash: da629c928ab8c2cb11545f2b0ed51c9c8c979cfdd8f22b6fab48e473e11f8cec
                                                                                                            • Instruction Fuzzy Hash: 7A51D67721065882E7AB8F29C059BAF77A0E349B9CF178106EE4597798CF30CE49C742
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002DE2 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: c674af0ce8d4b62ec4836408ddee2b68b7418a22ed6497697c9fbe018f8c5514
                                                                                                            • Instruction ID: 26ab6a5b9a0f5073739b4fe88853a831cfc9224e47f9ea62529e611fe681ef04
                                                                                                            • Opcode Fuzzy Hash: c674af0ce8d4b62ec4836408ddee2b68b7418a22ed6497697c9fbe018f8c5514
                                                                                                            • Instruction Fuzzy Hash: A051B17760065882E7AF8F28C1653AF27A0E359B9CF568105EF46977D8CF21CE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002F72 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d78c6a48d957cd35a7996e63478bb520fdf4f992e7f1bcf1718b53521257cd87
                                                                                                            • Instruction ID: 52abd69b106f2cd6a1d8f579acc76becddb3ee6d04955e984e42799f184e93dc
                                                                                                            • Opcode Fuzzy Hash: d78c6a48d957cd35a7996e63478bb520fdf4f992e7f1bcf1718b53521257cd87
                                                                                                            • Instruction Fuzzy Hash: 6651C277605A5882E7AB8F69C0543AF37A0E349B98F168115EF46177D8CF31CE4AC780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001023 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1ca6892800a1f3f30ca7fe69e4ae95a1dc50574307a8d916d6e8cd4c484920c3
                                                                                                            • Instruction ID: 1c54bc3a66adfa587e15a8897994fb51a74c22d66b4838171bbd9b8ff9a3ea06
                                                                                                            • Opcode Fuzzy Hash: 1ca6892800a1f3f30ca7fe69e4ae95a1dc50574307a8d916d6e8cd4c484920c3
                                                                                                            • Instruction Fuzzy Hash: FB51B37760466882E7AB8F29C0953AE37A0E359B9CF168115EF46977D9CF30CE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000321A Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 4a9152be51a7634fa5ac3f76ed79effbcec14a37c1fc445f30d7fcd37262d241
                                                                                                            • Instruction ID: 16d2c9c8b04794ca2f816e665d743d754edca790768677066206aac6add4a70a
                                                                                                            • Opcode Fuzzy Hash: 4a9152be51a7634fa5ac3f76ed79effbcec14a37c1fc445f30d7fcd37262d241
                                                                                                            • Instruction Fuzzy Hash: 19510373211A5882E7AF8F69D1543AE77A0E359B98F168204EF46177D9CF31CE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800034EF Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d83f1acee7181736078a669b0881a9986ce0cd64340e6f960878b1f3e08202bd
                                                                                                            • Instruction ID: 09c250c115501d2fce06b75a0fd18997cf63f04e1b6c02d36d85c9741091c8ff
                                                                                                            • Opcode Fuzzy Hash: d83f1acee7181736078a669b0881a9986ce0cd64340e6f960878b1f3e08202bd
                                                                                                            • Instruction Fuzzy Hash: 3E51D07720465886E7AB8F28C0547AF37A1E348B98F168119EF0697798CF30CE49C781
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003CB0 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: da0864e60c910ebc4a1d2329b7e31531a554ffa2f05343a62125c48da4966f5c
                                                                                                            • Instruction ID: 72b9db2b103e3d158396cf3d17b8d8775f74936f5a3d34af8258652a40e92413
                                                                                                            • Opcode Fuzzy Hash: da0864e60c910ebc4a1d2329b7e31531a554ffa2f05343a62125c48da4966f5c
                                                                                                            • Instruction Fuzzy Hash: C551D47361865883F7AB8F28C8543AE77A1E35BB98F168104EF4517799CF25CE89C740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001D2F Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 8360528a3a685893e5cf0a251580fa61c1c8a1aee2a7f61d84937747d7a1b28e
                                                                                                            • Instruction ID: e86040b62ee154d8c846f51b370adf81983d24ac22ab161a0c2a93ddd63a0be8
                                                                                                            • Opcode Fuzzy Hash: 8360528a3a685893e5cf0a251580fa61c1c8a1aee2a7f61d84937747d7a1b28e
                                                                                                            • Instruction Fuzzy Hash: 1C51B17760065882E7AF8F29C0543BE37A4E759B9CF168109EF459B799CF20CE4AC780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003DD48 Relevance: .1, Instructions: 138COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 41f65de47852127261b2a543a71ca4105b940cbfe4c0f90e9a1a11ee2025bd6f
                                                                                                            • Instruction ID: 2a32aead3be09233c858f594b3533e40fff337de258f30baca87361d1d450964
                                                                                                            • Opcode Fuzzy Hash: 41f65de47852127261b2a543a71ca4105b940cbfe4c0f90e9a1a11ee2025bd6f
                                                                                                            • Instruction Fuzzy Hash: 9F51B27361061C82E7AB9F29E1543AE37A0E759FA8F168116EF051B7D8CB31CE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003D0B0 Relevance: .1, Instructions: 137COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 42b6b08cf45bdd89051086e83f06fe8bef659b0e0e98c2bd891e801013556eff
                                                                                                            • Instruction ID: 01556f0632854ae5958d5be4065f7d07e21120e6dae78f0f770f7405f55aff74
                                                                                                            • Opcode Fuzzy Hash: 42b6b08cf45bdd89051086e83f06fe8bef659b0e0e98c2bd891e801013556eff
                                                                                                            • Instruction Fuzzy Hash: F251B27760065C93E7AB8F28E1553AF27A0E359B98F168116EF4617799CF30CE89C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800394B0 Relevance: .1, Instructions: 137COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 235dee4320a8a345010f874546331e137e7a87e59fd191b19a5ffa5768310067
                                                                                                            • Instruction ID: e52fc5a9b62fa6b56d4780f9028e1dd165315a1be0adb8d93d099320d1b2c109
                                                                                                            • Opcode Fuzzy Hash: 235dee4320a8a345010f874546331e137e7a87e59fd191b19a5ffa5768310067
                                                                                                            • Instruction Fuzzy Hash: CD51D377606A1882E7AB8F69C0553AE37A0E359BD8F168105EF46177D8CF31CE89C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003D5C4 Relevance: .1, Instructions: 137COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7a1eaafefbabe4500f64c24ec4e8a512cfafb2d3119ad5e00e86d6b26d9f545a
                                                                                                            • Instruction ID: b969d1d9628bc73e9bf1d4c7e332e5257e0887aa5016ff9281e360c9cc5a7c58
                                                                                                            • Opcode Fuzzy Hash: 7a1eaafefbabe4500f64c24ec4e8a512cfafb2d3119ad5e00e86d6b26d9f545a
                                                                                                            • Instruction Fuzzy Hash: 7451137760460C82E7AB8F29E1563AE37A0E359B98F168106EF49177D9CF30DE49C780
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018005E068 Relevance: .1, Instructions: 126COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: e0bd46db960a23efa5c32523374d987ee48a694cdfa4f408985d40ec51af35be
                                                                                                            • Instruction ID: 41d86b5b9339c61d9d7c63af45e83cbc16d75bc27bdd3e26f59eec06eca12569
                                                                                                            • Opcode Fuzzy Hash: e0bd46db960a23efa5c32523374d987ee48a694cdfa4f408985d40ec51af35be
                                                                                                            • Instruction Fuzzy Hash: E941B332320A9885EB88CF6AD9253D97391A34CFD4F49D423FE4D97B58DE38C24A8304
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011629BC Relevance: .1, Instructions: 117COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 02a684188995345922c9afdc254e5f890dc64c5b7fdf51397b32179a01d6f708
                                                                                                            • Instruction ID: 9f001227623cb160bb8085eaaa68340bbfd136d82b76e57b4081fa62e084bf51
                                                                                                            • Opcode Fuzzy Hash: 02a684188995345922c9afdc254e5f890dc64c5b7fdf51397b32179a01d6f708
                                                                                                            • Instruction Fuzzy Hash: 4551C371518788CBEBBADF24CC896D97BB1FB58308F904219D84E8E290DFB4574ACB41
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01172F3C Relevance: .1, Instructions: 116COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d419667b547a92e243f84ef97490428a889141761c3f806213dc23cdfd513faa
                                                                                                            • Instruction ID: eff38f3ec9e036337a4547846e1d49f2e9f1d63447e28e50aba2564aa5ef9d2d
                                                                                                            • Opcode Fuzzy Hash: d419667b547a92e243f84ef97490428a889141761c3f806213dc23cdfd513faa
                                                                                                            • Instruction Fuzzy Hash: 1D51D9701046898BEBBCDE58D8997E93BB0FB54304F90C11AD98ECE290DFB5468DEB41
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000285B Relevance: .1, Instructions: 102COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: b6bdf3fac82b2a416bcbfe76a4bf10ab1e4884525f38ffde4de80ce2eb4c696e
                                                                                                            • Instruction ID: 8287f789a74fd128d59854d06d3605da123458aaf46716dd7b6544f79ad0d431
                                                                                                            • Opcode Fuzzy Hash: b6bdf3fac82b2a416bcbfe76a4bf10ab1e4884525f38ffde4de80ce2eb4c696e
                                                                                                            • Instruction Fuzzy Hash: E741B132205B8885E7A68F6AC0843DD37A1E34DB9CF198225EF591B7E9CF35C549C708
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01155198 Relevance: .1, Instructions: 98COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 2be38a0491973a0032a8909769e77a99ca5202ad907bf2f316ceccf1fca314b2
                                                                                                            • Instruction ID: 20c925a3c622219761f6412d69bdcc4e6e7bc1b855aa3b465fc8f54e97c2fd67
                                                                                                            • Opcode Fuzzy Hash: 2be38a0491973a0032a8909769e77a99ca5202ad907bf2f316ceccf1fca314b2
                                                                                                            • Instruction Fuzzy Hash: 6B51B3B091078A8FDB48CF68D88A4DE7BB0FB48348F101A19FC6696264D3B49665CF85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800021C6 Relevance: .1, Instructions: 92COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1f035f70312957623c7b3f322bf5f1e56216c34f335631861e8b4d603ee194b7
                                                                                                            • Instruction ID: f96bc358bccb2fa22f7cc466d93cf7800495e21edeeee6e4356eecdc26033e9b
                                                                                                            • Opcode Fuzzy Hash: 1f035f70312957623c7b3f322bf5f1e56216c34f335631861e8b4d603ee194b7
                                                                                                            • Instruction Fuzzy Hash: CD41B272200A8881E7A58F6AC08179D77A0E38AB9CF198225EF591B7E9CF35C546C718
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002FCC Relevance: .1, Instructions: 92COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fe1439f745f1eec5ad9b16ed9f7221aadb9d5f90aeaa90eafdfc48d868e10305
                                                                                                            • Instruction ID: 1028369d3679ede2eb6c5a1dc0adfc743344189437197b1a72d3144add9259ab
                                                                                                            • Opcode Fuzzy Hash: fe1439f745f1eec5ad9b16ed9f7221aadb9d5f90aeaa90eafdfc48d868e10305
                                                                                                            • Instruction Fuzzy Hash: 5B41B172204B8885E7A68F7AC08139D7BA0E349B9CF198225EF5D1B7E9CF35C549C718
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011531F0 Relevance: .1, Instructions: 87COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 4ca1efe31156c35c298be2d637e060690348a8d13e7852dc2934e068bf2ecc89
                                                                                                            • Instruction ID: 832263a500bef40efacc8ebec538263b42c976c84242748e276a3f05d1b51ef5
                                                                                                            • Opcode Fuzzy Hash: 4ca1efe31156c35c298be2d637e060690348a8d13e7852dc2934e068bf2ecc89
                                                                                                            • Instruction Fuzzy Hash: B241C4B050078E8FDF48DF64C8964DE7BF1FB58348F114619EC6AAA250C7B8D664CB85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 011784DC Relevance: .1, Instructions: 87COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 7fd209a5bacbcf2df3ffdabd5d46f381966fb765f5ca23652f52e26abfad730a
                                                                                                            • Instruction ID: aa39ec034690dd0adaedc51f49fad4efb718af2e20c99ce4d964f65b385009ee
                                                                                                            • Opcode Fuzzy Hash: 7fd209a5bacbcf2df3ffdabd5d46f381966fb765f5ca23652f52e26abfad730a
                                                                                                            • Instruction Fuzzy Hash: 5E41D8B050474E8BDB48DF28C48A5DE3FB0FB58388F214619FC1696290D3B8DAA5CBC5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01167C30 Relevance: .1, Instructions: 85COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9823a1695063f33db6058971ba758a754b1e79fcaac480df1d26d26a3a2e3ac2
                                                                                                            • Instruction ID: 507f66c338a72815bf6cfb793e6bef7753ace0d2cfd21fe93d9a6f6301014cdb
                                                                                                            • Opcode Fuzzy Hash: 9823a1695063f33db6058971ba758a754b1e79fcaac480df1d26d26a3a2e3ac2
                                                                                                            • Instruction Fuzzy Hash: CF4191B590478E8FDF88CF64D84A5DF7BB0FB15318F000A19EC29A6294D3B49665CB85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117A088 Relevance: .1, Instructions: 81COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ea6944b051cb369f947b7ae2e54e517806258f31eb48cb890d3a99ff4cfe4e33
                                                                                                            • Instruction ID: d8766ed6a145be70e27f724084ebfce531054dfb1c7c99e8a4b35a48794e37a3
                                                                                                            • Opcode Fuzzy Hash: ea6944b051cb369f947b7ae2e54e517806258f31eb48cb890d3a99ff4cfe4e33
                                                                                                            • Instruction Fuzzy Hash: 8C41C67180074E8FDB48CF64D88A5CE7FB0FB28398F214619E815A6254D3B896A4CFD5
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01166110 Relevance: .1, Instructions: 76COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 40b4a7dd3fd6c59d2a1fe2387ab151006b48ff30fd6fa8571f39d54594e0320a
                                                                                                            • Instruction ID: f198cd31bfd31a08e1c610ac1da19babab081d2639e9443a1b5049bda1467915
                                                                                                            • Opcode Fuzzy Hash: 40b4a7dd3fd6c59d2a1fe2387ab151006b48ff30fd6fa8571f39d54594e0320a
                                                                                                            • Instruction Fuzzy Hash: D431B4B150478F8BDB4CDF28C85A49A3BA5FB54348F004A19FC66862A0D7B4DA75CBC1
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800029E1 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 5d083160cbc35a07a883af5aa1ecc7ae30571accb8146901d9229ea74333d4d9
                                                                                                            • Instruction ID: 1e63fb8dbe197bc714a89e33505682b8c31f47c138297bd86f060f60c0dd29f9
                                                                                                            • Opcode Fuzzy Hash: 5d083160cbc35a07a883af5aa1ecc7ae30571accb8146901d9229ea74333d4d9
                                                                                                            • Instruction Fuzzy Hash: 8F31937260578486DB628F29E1513AE77A4F39DF88F658125EB8C0B761CF36C156CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002BE4 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 77418fcdf767b1611a9fa5b515e795854d04060206648c186fd60311960dac2f
                                                                                                            • Instruction ID: 6af17f272383ef5a4dd8fbfa2ce027422d2579e45e0fc9e9fbe5a49381919d38
                                                                                                            • Opcode Fuzzy Hash: 77418fcdf767b1611a9fa5b515e795854d04060206648c186fd60311960dac2f
                                                                                                            • Instruction Fuzzy Hash: 3731A472204748C6EBA28F29E0403AD77A4F39DB98F658116DBCC4B761CF36C156CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002C93 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 2c2ab5b7eb62b2990ec79061d20372158d9a56c2312da2f34d49f6d4b70d968e
                                                                                                            • Instruction ID: de658b22cf4183a97c5f5e6589222008cbabd0efdc19014c03e4d77033a1d58b
                                                                                                            • Opcode Fuzzy Hash: 2c2ab5b7eb62b2990ec79061d20372158d9a56c2312da2f34d49f6d4b70d968e
                                                                                                            • Instruction Fuzzy Hash: A231AF7270468486EBA28F29D0443AE77A0F39DF8CF258115EB8C4B352DF36C196DB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001041 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: e5d3b71826d40d6050fa5bc5f829408d77b383f3c4c3bfa5694fcb5f38a73a26
                                                                                                            • Instruction ID: acc1285a16746c40c16cacf58c4b7b9c86e886a186950adbabb611b8285f24bf
                                                                                                            • Opcode Fuzzy Hash: e5d3b71826d40d6050fa5bc5f829408d77b383f3c4c3bfa5694fcb5f38a73a26
                                                                                                            • Instruction Fuzzy Hash: CB318F73215A48C6EBA28F29E0407AE77A4F388B9CF259125EB8C0F751CF36C196C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800011D6 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1981b5cb13233fad2d6a0279d8e4cd980a15364e3ef5792a9f18741320c72507
                                                                                                            • Instruction ID: 8ecd16cc75fec592c62e1a38d16da51ea225cc7dc37767b4ffaa9a72471f925b
                                                                                                            • Opcode Fuzzy Hash: 1981b5cb13233fad2d6a0279d8e4cd980a15364e3ef5792a9f18741320c72507
                                                                                                            • Instruction Fuzzy Hash: 9A31A77320578485DB628F29D04139E7BA0E39DB8CF558115EB8D4F751CF36D256CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001280 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d529982a199178ff24b7e0ced618d07de8c3a2fda5134c9b876a3a89231c666d
                                                                                                            • Instruction ID: 35a4ce3988ea7b10169c53233dab1f157132c355781e6defc2c9b77bc25a53f2
                                                                                                            • Opcode Fuzzy Hash: d529982a199178ff24b7e0ced618d07de8c3a2fda5134c9b876a3a89231c666d
                                                                                                            • Instruction Fuzzy Hash: 1C31BB72214A48C5DBA2CF19E0913AE77A4F34DB9CF158119DB8D47751CF36C196D704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800012DF Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a985acb9c93fe7079d9cc5fef9120092ec1016df999fed9ce877d608b4c073d0
                                                                                                            • Instruction ID: 1685ccb08ba74b5d6f1a72ac8e020b525b19e7e81d1f3343fb22e6d342bfabbb
                                                                                                            • Opcode Fuzzy Hash: a985acb9c93fe7079d9cc5fef9120092ec1016df999fed9ce877d608b4c073d0
                                                                                                            • Instruction Fuzzy Hash: F931AF72204648C6EBB28F29D0407AEB7A0F38DB9CF258115EB8C4B752DF36C59AC704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800034F9 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: b078ed5a7760b63d1c84f314607a53ffe8233aea616ed7bad73e58b2e4abcc05
                                                                                                            • Instruction ID: ed22ad0a32a292c735738c7daf6f9d902d1b470b74ffc113c60a6975c4fdcf88
                                                                                                            • Opcode Fuzzy Hash: b078ed5a7760b63d1c84f314607a53ffe8233aea616ed7bad73e58b2e4abcc05
                                                                                                            • Instruction Fuzzy Hash: E0319372A04B44C6DBA28F19E0403ADB7A4F38DB88F65C125DB8C0B765DF36C196C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800016AE Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9add28ec92f66b570039b74306dd2f1b94f221759090f039bbf48d6ee127ab25
                                                                                                            • Instruction ID: 8246755cf71f642713215ebb631bd13c4c11a28acb9750927b0295ef4b404458
                                                                                                            • Opcode Fuzzy Hash: 9add28ec92f66b570039b74306dd2f1b94f221759090f039bbf48d6ee127ab25
                                                                                                            • Instruction Fuzzy Hash: 52319376608B48C5DB628F29E0417AE77A4F38CB98F658125DB8D0B761CF36C156C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800019D8 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d11af24298a56da52bf300c485b2b0b25973a5e124edadea627fc63c8d85ae94
                                                                                                            • Instruction ID: 5f52d01df30965ce92fdddcb1481ab36e7376d51d619ed66443189ba57d8c024
                                                                                                            • Opcode Fuzzy Hash: d11af24298a56da52bf300c485b2b0b25973a5e124edadea627fc63c8d85ae94
                                                                                                            • Instruction Fuzzy Hash: D33195B22147888ADB668F19D05039D77A4F39DB8CF259125EB8C4B761DF36C156CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001AC3 Relevance: .1, Instructions: 71COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 05fca1b11023134f4e260a750f9b523ed7f2706657a4f12d0b9119dc985d7558
                                                                                                            • Instruction ID: b9f5c8a433f6dbdad8525cd5c2588664667653e6eb9b256f3d41cdd8d5febc6f
                                                                                                            • Opcode Fuzzy Hash: 05fca1b11023134f4e260a750f9b523ed7f2706657a4f12d0b9119dc985d7558
                                                                                                            • Instruction Fuzzy Hash: B231A472205B84C6DB628F2AD0903AE7BA4F38DB8CF258115DB8C0B761DF36C156D704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180036074 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 581cbccba7a2670af8d5e0f4d43fe3e3be4c377892e53bc2e8a94730e8d1a6d4
                                                                                                            • Instruction ID: 5bca1554a1884dd5e82a70d57cbd8742a06373c81a4bb095615909fc28da319b
                                                                                                            • Opcode Fuzzy Hash: 581cbccba7a2670af8d5e0f4d43fe3e3be4c377892e53bc2e8a94730e8d1a6d4
                                                                                                            • Instruction Fuzzy Hash: CE318172604B4885DB668F29D45139EBBA4E38DB88F19C115DB8D4B761CF36C156C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180034174 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 76dd9f1b9fd862206805df461a1ee5adf09ee570fff02767302727db9fb13e2b
                                                                                                            • Instruction ID: 7e8e6c6382c8aca79fec151ac989d16d324008198fff66c433c6926f26d643ae
                                                                                                            • Opcode Fuzzy Hash: 76dd9f1b9fd862206805df461a1ee5adf09ee570fff02767302727db9fb13e2b
                                                                                                            • Instruction Fuzzy Hash: ED31937320978485EB668F2AD05039E7BA0E39DB8CF568115EB8C4F751CF36C196C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800361BC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fb52f9a705176bafdb0f3181d35890e5cc52b20981f22d3339f985eb87c4e789
                                                                                                            • Instruction ID: a21a7b24e5e0b3987a2d4e19edb669f36ad21a5e9da1f601f3ed30ba515e3c1f
                                                                                                            • Opcode Fuzzy Hash: fb52f9a705176bafdb0f3181d35890e5cc52b20981f22d3339f985eb87c4e789
                                                                                                            • Instruction Fuzzy Hash: B9318172605B8486DB62CF29D15039EBBA4F39DB88F16C115DB8C0B361CF36C156C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800042AF Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d2230876fe428618afacef624c5f6807a9e1673a652344f2f36e4607abef4126
                                                                                                            • Instruction ID: eb7a8fb14bcfdc23bbad92a0bc7e4c4a063ff3a72b37a54369164a6246dfdf28
                                                                                                            • Opcode Fuzzy Hash: d2230876fe428618afacef624c5f6807a9e1673a652344f2f36e4607abef4126
                                                                                                            • Instruction Fuzzy Hash: 8F31A176604A8886EB62CF29D1403AEB7A4E39DF8CF65C115EB4D0B761DF36C196CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180036304 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1804bfadc8577206abe2fd290d6b4603fc55e8482646ac4e1aaf7a51e9d9c677
                                                                                                            • Instruction ID: eb644eb042984abd54cacb107b9da2a0d95e0660972e7ff5d50e84d85b0a6cf4
                                                                                                            • Opcode Fuzzy Hash: 1804bfadc8577206abe2fd290d6b4603fc55e8482646ac4e1aaf7a51e9d9c677
                                                                                                            • Instruction Fuzzy Hash: 10319372614644C5DB628F29D0503AEB7A4F38DB9CF25C129DB8D0B761CF36C256D704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003442C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: cd5e048c60b51d627f867a6c71812b83eca19f74f87d932a76f499e8d3974f02
                                                                                                            • Instruction ID: c3d78ebbd9b7b0aea8ab4e1476a18061c7b3b3d9b374fa27a6e31ea0b302ec12
                                                                                                            • Opcode Fuzzy Hash: cd5e048c60b51d627f867a6c71812b83eca19f74f87d932a76f499e8d3974f02
                                                                                                            • Instruction Fuzzy Hash: 01318473605A98C6DB628F19E0407AE77A0E38DB8CF158125EB8C4F751DF36C556C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180034574 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: f52462499e7f4ddbbc5d8f45038f6f0e5d1024763cd60d3569e390ca75415a5f
                                                                                                            • Instruction ID: d89a76c4296cb9e3d447c22dea08d299dfd9a216a13b48f78a5d81d075c42125
                                                                                                            • Opcode Fuzzy Hash: f52462499e7f4ddbbc5d8f45038f6f0e5d1024763cd60d3569e390ca75415a5f
                                                                                                            • Instruction Fuzzy Hash: 3231707320468486EB668F29E0417AD7BA4E39DF9CF158115EB8D4F751DF36C196CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800346BC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: a6b331b27d20f327014a0fc1d9a1eddc5ac5917860999c2e346711b9ed7605ee
                                                                                                            • Instruction ID: 1c0a3949344d8c8cf45e23feefddad83922938c14c7c7c742ec44fc0ffe761ce
                                                                                                            • Opcode Fuzzy Hash: a6b331b27d20f327014a0fc1d9a1eddc5ac5917860999c2e346711b9ed7605ee
                                                                                                            • Instruction Fuzzy Hash: 58318177204644C6DBA28F29E0407AE77A4F389B9CF158115EB8C4F751DF36D196CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180034808 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 35826e8ce72fe36271ae746e401e7a387b80a12a38966a8431f11546cf25ab8b
                                                                                                            • Instruction ID: fbcb0e367c9929e44d6062c5c96866dcef532a2ccf63d9815c7d8f4308a402ed
                                                                                                            • Opcode Fuzzy Hash: 35826e8ce72fe36271ae746e401e7a387b80a12a38966a8431f11546cf25ab8b
                                                                                                            • Instruction Fuzzy Hash: 66318173614688C6DBA28F19E0403AE77A4F38DB98F258115EB8C4F751DF36C196CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800349B4 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: c548ef38712fdde7167ff2853ac6337a8fccd2b898dae11cbade2ff3ec8cc081
                                                                                                            • Instruction ID: 7f41ad1a0ffa96e5efbd8c17c02722b0f95885d2032f41ffb470d13f21a5adab
                                                                                                            • Opcode Fuzzy Hash: c548ef38712fdde7167ff2853ac6337a8fccd2b898dae11cbade2ff3ec8cc081
                                                                                                            • Instruction Fuzzy Hash: A9317073204B44C5EB628F29E0403AE77A0E389B98F158125DB8C0F751CF36C156C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180034AFC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 31b2bd82db99a7095c2d1e9c56457b5f73b7129f5ff65612335ba4209b32c517
                                                                                                            • Instruction ID: 6f8d0174501b65d62425771c80eadbefbd3e5d0034947211e32cf2af0f575491
                                                                                                            • Opcode Fuzzy Hash: 31b2bd82db99a7095c2d1e9c56457b5f73b7129f5ff65612335ba4209b32c517
                                                                                                            • Instruction Fuzzy Hash: 68315E7320578486DB66CF29D4403AEB7A4E39DB98F268125EB8C4F751CF36C196C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180036B84 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ed3b1d6d66c9b8bf8b3a9a1edda66fd8e44386c1b4fb319ecb28258c706cec4d
                                                                                                            • Instruction ID: fc158ea852ff974f47727b2abbab6ce9280dbbfbbc0d0b7445a8138835ac25e8
                                                                                                            • Opcode Fuzzy Hash: ed3b1d6d66c9b8bf8b3a9a1edda66fd8e44386c1b4fb319ecb28258c706cec4d
                                                                                                            • Instruction Fuzzy Hash: 3331937261478885DB628F29E0503AEBBA4F38DB9CF15D125DB8C4B761CF36C156CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180036CCC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: aaeae15c7cf7773aff89904400df0a9b5a300318067193f94d3d6e94cdc0c8dd
                                                                                                            • Instruction ID: 5118e1374030f475fd8ca788e07e91e33f155bab511ba5f617f7628cf8afece1
                                                                                                            • Opcode Fuzzy Hash: aaeae15c7cf7773aff89904400df0a9b5a300318067193f94d3d6e94cdc0c8dd
                                                                                                            • Instruction Fuzzy Hash: 3C315072A04B8886DB628F29D1413ADB7A4F39DB98F65C125DB8C4B761CF36C156C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002CDE Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: bc8442a896b86a37d2de046eca3fe43ce2a70b45ee2c5ede744991503452ea92
                                                                                                            • Instruction ID: abe61987b1df98f506db42c9661d6bb300f98199b31b7dba81cd6b8961217015
                                                                                                            • Opcode Fuzzy Hash: bc8442a896b86a37d2de046eca3fe43ce2a70b45ee2c5ede744991503452ea92
                                                                                                            • Instruction Fuzzy Hash: E7317072604A48C6EB66CF29D0403AEB7A4E78DB9CF25C116EB8D4B760DF36C156C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002D1F Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9a8bafa6aa1df9d38da133ee8176c5112b95afe598ae02d749d28c447e81dc8c
                                                                                                            • Instruction ID: 8c0ba249299123074058f97ba73e6539d78d6c6c2f06e8874e3dcc1e4e7193c5
                                                                                                            • Opcode Fuzzy Hash: 9a8bafa6aa1df9d38da133ee8176c5112b95afe598ae02d749d28c447e81dc8c
                                                                                                            • Instruction Fuzzy Hash: A9319372604A48C6DBA2CF29D0403AEB7A4F399B88F25C115EB4C5B761DF36C15ACB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180034D8C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 12fb6a42ba1d949cb795ce97dc7e50dc8f59774df8fc27ffacb5426508d344e1
                                                                                                            • Instruction ID: 8735a0b1a36498c838d71cc8a3fa16f133748421bc703cb4942581316eef84c1
                                                                                                            • Opcode Fuzzy Hash: 12fb6a42ba1d949cb795ce97dc7e50dc8f59774df8fc27ffacb5426508d344e1
                                                                                                            • Instruction Fuzzy Hash: E1316F73204644C6DBA28F29E0403AD77A4F39DB98F668125EB8C4F751DF36C596C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180036E14 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 18bd0f568b71283b2b93e648373a10642317a8cbeae263bd393356ea5e1788cd
                                                                                                            • Instruction ID: f17db5f1d5b004c33a06658e6d7eadf52c515011bb811ad81570b6e187b31224
                                                                                                            • Opcode Fuzzy Hash: 18bd0f568b71283b2b93e648373a10642317a8cbeae263bd393356ea5e1788cd
                                                                                                            • Instruction Fuzzy Hash: DE318F72604A48C6DB628F29E0403AEB7A4F38DB9CF25C125EB8C0B765CF36C55AC704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180034F34 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: d3d24cfd3dce736f1a11d3218cc4d65447d02b4a15217b391b99b1f59bd28f64
                                                                                                            • Instruction ID: 7090112f1d2d7c2991c9c71196b35dc81e1e5a0aed15321b54c48774646be41b
                                                                                                            • Opcode Fuzzy Hash: d3d24cfd3dce736f1a11d3218cc4d65447d02b4a15217b391b99b1f59bd28f64
                                                                                                            • Instruction Fuzzy Hash: 2C3193736047488ADB668F29E0403AE7BA4F38DB9CF158125EB8C4B755CF36C556CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180036F5C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9c0a86835a708507b0da4680ae08bc06579caacedf06ef48f8d80cf45d4fa521
                                                                                                            • Instruction ID: d6f3bd7bed49a48f4220111a354a87383cd7952ed19a67235bc8e2114cc498aa
                                                                                                            • Opcode Fuzzy Hash: 9c0a86835a708507b0da4680ae08bc06579caacedf06ef48f8d80cf45d4fa521
                                                                                                            • Instruction Fuzzy Hash: 22319372204788C6DB668F19E0403AD77A4F38DB9CF258125EB8C4B761CF36C15ACB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003507C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 89f31601f32bdca2723ef6cf2cc13ee74f7a0519df4d1d18ea2418cc0577337f
                                                                                                            • Instruction ID: af3ecbf9f5196af03e29c41fe93db4e3c2fd3c6237b588d841bf274830c57f6f
                                                                                                            • Opcode Fuzzy Hash: 89f31601f32bdca2723ef6cf2cc13ee74f7a0519df4d1d18ea2418cc0577337f
                                                                                                            • Instruction Fuzzy Hash: 2D31B37220474886DB628F29D44039D7BA0F38DB8CF258125EB8C4B361CF36C156CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800330BC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: aaf8db98f7890c973a91b019af981d9a3e6e8765e38ce2e4cd3bf89621c1dd36
                                                                                                            • Instruction ID: a7bbf656f1541516bad389fc1d36e45dfe076e3af67a50bc04c6430fed0ac2b3
                                                                                                            • Opcode Fuzzy Hash: aaf8db98f7890c973a91b019af981d9a3e6e8765e38ce2e4cd3bf89621c1dd36
                                                                                                            • Instruction Fuzzy Hash: 5B31A472205B84C5EB668F29E4813AE7BA0E39DF8CF158119DB8D4B751CF36C156C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180037104 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: ed3b1d6d66c9b8bf8b3a9a1edda66fd8e44386c1b4fb319ecb28258c706cec4d
                                                                                                            • Instruction ID: 38acb9cc258b1f814c32480eda776f87ddc374967df3963549171cc3e86857da
                                                                                                            • Opcode Fuzzy Hash: ed3b1d6d66c9b8bf8b3a9a1edda66fd8e44386c1b4fb319ecb28258c706cec4d
                                                                                                            • Instruction Fuzzy Hash: 1B317E73205B8886EBA68F29D4403AE7BA4F38DB8CF258125DB8C4B752CF36C156C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800351C4 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: f949a704ef2b3ec878b013e9a0c7c7a50d5b0bbd6502967a94fe74c25232b270
                                                                                                            • Instruction ID: ad536bb256bef7bf232476e585045136609c2566541256df860fb45f206b4c75
                                                                                                            • Opcode Fuzzy Hash: f949a704ef2b3ec878b013e9a0c7c7a50d5b0bbd6502967a94fe74c25232b270
                                                                                                            • Instruction Fuzzy Hash: 0A31B172205A44C6DB628F29E0407AE77A4F38DB8CF258125EB8C0B761CF36C196CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180033204 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: baf237ce950d12dd8c3168c674611a4430741b1771c3b43fdd0728432537f5c5
                                                                                                            • Instruction ID: b1e432f134e90f4c101844c1762718d60cbbaf374736bbdf8118b247b07caffe
                                                                                                            • Opcode Fuzzy Hash: baf237ce950d12dd8c3168c674611a4430741b1771c3b43fdd0728432537f5c5
                                                                                                            • Instruction Fuzzy Hash: 7A31A27221478486DB668F29D0813AE7BA4F39DB9CF258129EB8D0B351CF36C196CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003724C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: aaeae15c7cf7773aff89904400df0a9b5a300318067193f94d3d6e94cdc0c8dd
                                                                                                            • Instruction ID: 96cece9f3124aec78e3b20e49550105fd0ccf95ed29457d201b342cee8c1379a
                                                                                                            • Opcode Fuzzy Hash: aaeae15c7cf7773aff89904400df0a9b5a300318067193f94d3d6e94cdc0c8dd
                                                                                                            • Instruction Fuzzy Hash: C2316F72204A8486DB668F29D0407AE7BA4F39DB8CF158125EB8C0B752CF36C156D704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003530C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 238fa7a04d06d8bedf1b13517945fe50ed403f8f03dc2ebb5a30cde43ce03ae7
                                                                                                            • Instruction ID: a6efc29178d91d8bda225829ecf0e073b66c7763224aff3a3b06dba943989152
                                                                                                            • Opcode Fuzzy Hash: 238fa7a04d06d8bedf1b13517945fe50ed403f8f03dc2ebb5a30cde43ce03ae7
                                                                                                            • Instruction Fuzzy Hash: DE317372214644C6DB66CF19D0407AD77A4F38DB9DF258115EB8C4B761CF36C696CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003334C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9007c8d2741e87e801d2cda9b02efa701cc5d86f97a3a83efbef6e3cd0da76ea
                                                                                                            • Instruction ID: ee14b345fea4331134cb5468109e56ce012df24d30b0a4457ee4dc6c036503b2
                                                                                                            • Opcode Fuzzy Hash: 9007c8d2741e87e801d2cda9b02efa701cc5d86f97a3a83efbef6e3cd0da76ea
                                                                                                            • Instruction Fuzzy Hash: 2E318472204784C5DB628F29E0813AE77A4F38DB9CF558129DB8C4B751DF36C556C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180037394 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 18bd0f568b71283b2b93e648373a10642317a8cbeae263bd393356ea5e1788cd
                                                                                                            • Instruction ID: 51a4eea7e12afe4ea31c9e5145c2c8f3939989918222d0338aef958feba5630c
                                                                                                            • Opcode Fuzzy Hash: 18bd0f568b71283b2b93e648373a10642317a8cbeae263bd393356ea5e1788cd
                                                                                                            • Instruction Fuzzy Hash: 77318172204648C5EB628F29D0403AE7BA4F38DB9CF658115DB8C4B752CF36C156C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180033498 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 343f2cc87ea369c8fb1fd527c31291614bc9e61514a1e26ad9a6b72aed1c9579
                                                                                                            • Instruction ID: c543b9eb668030670022d9c9072be9fee8e3c9d2be5a03843f451689a704c69b
                                                                                                            • Opcode Fuzzy Hash: 343f2cc87ea369c8fb1fd527c31291614bc9e61514a1e26ad9a6b72aed1c9579
                                                                                                            • Instruction Fuzzy Hash: 13317372205A84C6DB668F29E0813AD77A4E38DB9CF258119DB8C4B751DF36C596CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800354B4 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 581cbccba7a2670af8d5e0f4d43fe3e3be4c377892e53bc2e8a94730e8d1a6d4
                                                                                                            • Instruction ID: 63ec20039d6af41405efa3923009fa62fbd8bb4ab5b1df32fcc2f56c359af6d2
                                                                                                            • Opcode Fuzzy Hash: 581cbccba7a2670af8d5e0f4d43fe3e3be4c377892e53bc2e8a94730e8d1a6d4
                                                                                                            • Instruction Fuzzy Hash: 9031A472205B44C6DB668F29D0503AD7BA5F38DB9CF258125EB8D0B761DF36C156C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800374DC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 9c0a86835a708507b0da4680ae08bc06579caacedf06ef48f8d80cf45d4fa521
                                                                                                            • Instruction ID: 67fb9f9c7fc8be05bf02bb30dd174fdb9d2157d85e6d72e7c6c5ee319d8a844f
                                                                                                            • Opcode Fuzzy Hash: 9c0a86835a708507b0da4680ae08bc06579caacedf06ef48f8d80cf45d4fa521
                                                                                                            • Instruction Fuzzy Hash: 3F3181B2204B48C6DB668F19D0403AD77A4F39DB8CF658115DB8C4B751DF76C156D704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180033654 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 5c72b7509e175853406183baa2965f1f709845ff667e3178fa883691c8034cdd
                                                                                                            • Instruction ID: f20b0ef679c7e91c7a6b3ddaaf6bfdb55856398e677eb4dccb4b306ab0669cf9
                                                                                                            • Opcode Fuzzy Hash: 5c72b7509e175853406183baa2965f1f709845ff667e3178fa883691c8034cdd
                                                                                                            • Instruction Fuzzy Hash: 1431A7B2208784C9DB628F29E0823AD7BA0E39DF9CF258119DB8D4B751CF36C156C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180037684 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 3ce17690eb3752a5918cd71d99997e50c75010e3d12963783c9e066035eee6b8
                                                                                                            • Instruction ID: df7d602d65d3c165511fee6601e04cacea6ec9258c7a8d924c71cba2b9f678f0
                                                                                                            • Opcode Fuzzy Hash: 3ce17690eb3752a5918cd71d99997e50c75010e3d12963783c9e066035eee6b8
                                                                                                            • Instruction Fuzzy Hash: F431B37230878886DB668F29E0413AE77A0F39DB8CF258115EB8C4B752CF36C596CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018003379C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: aa7069a032f372f7c4ce7af011ba61debfe621e0e3777588533e1cef4de3e3a7
                                                                                                            • Instruction ID: 91f5e607b5fa260238e7b697b7dcf8fa8b80484dd43b28a4143d9ea4c299375b
                                                                                                            • Opcode Fuzzy Hash: aa7069a032f372f7c4ce7af011ba61debfe621e0e3777588533e1cef4de3e3a7
                                                                                                            • Instruction Fuzzy Hash: 9431B3B260478486DBA28F29E0813AD7BA0E39DF9CF258119FB8C0B751CF36C156CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800338E4 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 615c6fdf63d466c313f433dbd9731d2a88903791333f747c5956d4bb7b8e507f
                                                                                                            • Instruction ID: c3c29a37869592ffc25a5abf66136fd21c948a722cf6eec38621579e2c80d952
                                                                                                            • Opcode Fuzzy Hash: 615c6fdf63d466c313f433dbd9731d2a88903791333f747c5956d4bb7b8e507f
                                                                                                            • Instruction Fuzzy Hash: 1831B672204644C6DBA28F29E0813AD77A4F38DB9CF15811AEB8C4B751CF76C596C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180037914 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 30b2e7d3232f76ffbe9f2704989e0630baf0ade8e1a2c9a4fbf6899a0bfc3c61
                                                                                                            • Instruction ID: 2fd0aa0e9106ffe45d8f4b188730e1abbfad084e73a2b6c17b6b16da2913d970
                                                                                                            • Opcode Fuzzy Hash: 30b2e7d3232f76ffbe9f2704989e0630baf0ade8e1a2c9a4fbf6899a0bfc3c61
                                                                                                            • Instruction Fuzzy Hash: C531D472314644C6EBA68F29E0403AE77A4F38CB9CF258116EB8C4B752DF36C196D704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180033BDC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1a2d7bad57684a5d545f8a462a2f3d7c77eff89d30077c9bf927f16810aa8d09
                                                                                                            • Instruction ID: b16070f40d7c957a300f09b66b70b759d3a1739a51aae636426ed217239cd7a3
                                                                                                            • Opcode Fuzzy Hash: 1a2d7bad57684a5d545f8a462a2f3d7c77eff89d30077c9bf927f16810aa8d09
                                                                                                            • Instruction Fuzzy Hash: 353193B2214B84C5DB668F29D0813AD7BA0F39DB8CF159129EB8D0B751DF36C196CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180033D24 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 10d96a0e28455343c3c8e71d1e59e413de3a11758c845862a368826a81a1f8e2
                                                                                                            • Instruction ID: 8f87a6e909e27e5a55ad6401fca7b226114c84f41aba2fb7cbc61f843b9726e5
                                                                                                            • Opcode Fuzzy Hash: 10d96a0e28455343c3c8e71d1e59e413de3a11758c845862a368826a81a1f8e2
                                                                                                            • Instruction Fuzzy Hash: 1931A47220478486EB628F29E0813AE77A4F39DF8CF158119EB8C4B751CF36C596C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180035D6C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 1804bfadc8577206abe2fd290d6b4603fc55e8482646ac4e1aaf7a51e9d9c677
                                                                                                            • Instruction ID: 3cd43daeb0f5d7257444fc279566644f3860a8019e7c652df7661379ba1345db
                                                                                                            • Opcode Fuzzy Hash: 1804bfadc8577206abe2fd290d6b4603fc55e8482646ac4e1aaf7a51e9d9c677
                                                                                                            • Instruction Fuzzy Hash: 3A319172204B48C6DBA68F29D0403AD77A4F39DF98F658125DB8C0B760DF36C656C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180033E6C Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: fdba34f210ce7841150fa115761322f6722fc46a61be116fe9c843e81c9ccc2d
                                                                                                            • Instruction ID: 854fe0f46457a4793ec1e1da93fc87824f0423fcd523644bed50dc3246883a47
                                                                                                            • Opcode Fuzzy Hash: fdba34f210ce7841150fa115761322f6722fc46a61be116fe9c843e81c9ccc2d
                                                                                                            • Instruction Fuzzy Hash: 1A319172604744CAEB668F29E4813AE77B4F389B9CF658129EB8C0B751DF36C196C704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180035EFC Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: b0dfabb5f3009bc42dc85422adb1642c90e5caa9df72a8205037477a27804402
                                                                                                            • Instruction ID: e53381979ba5d1e8a5c1dc49df1331cc4708ec260b418947fe22307f9b1f551d
                                                                                                            • Opcode Fuzzy Hash: b0dfabb5f3009bc42dc85422adb1642c90e5caa9df72a8205037477a27804402
                                                                                                            • Instruction Fuzzy Hash: 7C318272204B84CADBA28F29D0417AE77A4F38DB98F658125EB8C4B761DF36C156CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180033FB8 Relevance: .1, Instructions: 70COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: db2da71a111e8636397d086fd4d899bb138a2694f5a6ea1aa0de7f3ad0ea5f30
                                                                                                            • Instruction ID: ab8af6f4259b968fc4e1b900af799a12bd40bf1fab3da9990b940325636eaf9c
                                                                                                            • Opcode Fuzzy Hash: db2da71a111e8636397d086fd4d899bb138a2694f5a6ea1aa0de7f3ad0ea5f30
                                                                                                            • Instruction Fuzzy Hash: EC315E73204644C6EBA6CF29E0407AE77A4F389B98F258125EB8C4F751DF36C596CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800365F4 Relevance: .1, Instructions: 69COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 44d15eedfe40dff603ae777772767bb738c71072b35dfe84052666311fb1a92e
                                                                                                            • Instruction ID: 404c4dda295e1a8c22727bc02a45b0ec68d416a7023f4ca7acea66143138731e
                                                                                                            • Opcode Fuzzy Hash: 44d15eedfe40dff603ae777772767bb738c71072b35dfe84052666311fb1a92e
                                                                                                            • Instruction Fuzzy Hash: 3731A472605A88C6DB66CF29D04139EB7A4E39DB8CF15C115DB4D4B761CF36C156CB04
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 01169720 Relevance: .1, Instructions: 68COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 0ba99abcd9c595a1e637b4c60ce9d4f7b99ca09a81bdeb8e7ca60ea3c891bfcc
                                                                                                            • Instruction ID: 94392525af34134a0e21af3bb8fc2623f871598b071541122a377198229a6220
                                                                                                            • Opcode Fuzzy Hash: 0ba99abcd9c595a1e637b4c60ce9d4f7b99ca09a81bdeb8e7ca60ea3c891bfcc
                                                                                                            • Instruction Fuzzy Hash: AB2107B021A741AFC38CDF29D59942ABAF0FB94358FD0691CF996C62A1D3B4D804CB06
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0116A130 Relevance: .1, Instructions: 65COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 28ec5479fc9c20a5c4ee2cbe5a95cc75b34517503f37ad4c7376377d5f1ddfb5
                                                                                                            • Instruction ID: 79e1fa76da59c7fd081aadfec280b8d7bb7477fa2358f0ecaf1b18183a268b30
                                                                                                            • Opcode Fuzzy Hash: 28ec5479fc9c20a5c4ee2cbe5a95cc75b34517503f37ad4c7376377d5f1ddfb5
                                                                                                            • Instruction Fuzzy Hash: BC31DEB050078E8FDB48CF64D88A5DE3FB1FB48388F100A19F86AA6250D7B4D665CF85
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0117796C Relevance: .1, Instructions: 60COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427064425.0000000001151000.00000020.00001000.00020000.00000000.sdmp, Offset: 01151000, based on PE: false
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_1151000_regsvr32.jbxd
                                                                                                            Yara matches
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 15b66e333b2d3df4a68563296aca916e451c710b76b5e65da49b60ab6bd77c42
                                                                                                            • Instruction ID: 422a9a96b60d90f09faa0fb65139306ba85052ea2442a1f81b75dd6f28c60892
                                                                                                            • Opcode Fuzzy Hash: 15b66e333b2d3df4a68563296aca916e451c710b76b5e65da49b60ab6bd77c42
                                                                                                            • Instruction Fuzzy Hash: CD317FB4529381AFD3D8DF28D19A81BBBE0FBC9308F806A1DF8CA86250D7759445CB42
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800033AA Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 445stringCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: lstrcmpi$Module$FileHandleName
                                                                                                            • String ID: Module$Module_Raw$REGISTRY
                                                                                                            • API String ID: 4056970316-549000027
                                                                                                            • Opcode ID: a596231909fedb8fb7cf6d8f518c76a0628efe62b66369530e7074f3b22c135f
                                                                                                            • Instruction ID: c88d5b63788483cb3fdd50db91642881e270c52f0ddfcb58f3b320a9d6c00a25
                                                                                                            • Opcode Fuzzy Hash: a596231909fedb8fb7cf6d8f518c76a0628efe62b66369530e7074f3b22c135f
                                                                                                            • Instruction Fuzzy Hash: 26A19372214A8881EBA2DB50E8903F97360FB9C7C4F909526FA4A47B95DF38C74DD701
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001A28 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 124COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: CREATE TABLE dbo.%s (Ct int NOT NULL )$drop table %s
                                                                                                            • API String ID: 568940515-3996912823
                                                                                                            • Opcode ID: c850652395f6e1f59dffea9771bdd1eff72104b03c22fdf3db9f9a0e1089c958
                                                                                                            • Instruction ID: 9aae2ac5ac1f963f6ef512871fee71ba6e937ef84c02e6e54e06486c0d4b2d27
                                                                                                            • Opcode Fuzzy Hash: c850652395f6e1f59dffea9771bdd1eff72104b03c22fdf3db9f9a0e1089c958
                                                                                                            • Instruction Fuzzy Hash: B4518F32214A4985FBB2EB11D4517E933A0EB8DBD5F508121FE8D4AB99DF38C64A9700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006BC48 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AddressFreeLibraryProc
                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                            • API String ID: 3013587201-537541572
                                                                                                            • Opcode ID: ebe05822f94561e54993efc06c73ba7dbe31beddd716b49a4e4d5c9acee2f0c7
                                                                                                            • Instruction ID: 9384309894529d368a6dac9de17023d14d1d7365d92b7adc177c47039afd8706
                                                                                                            • Opcode Fuzzy Hash: ebe05822f94561e54993efc06c73ba7dbe31beddd716b49a4e4d5c9acee2f0c7
                                                                                                            • Instruction Fuzzy Hash: 2B41A471311B4941FB97DB169C147E93396BB4CBE0F68C525AD298B794EE3CC6898340
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006BFB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77libraryloaderCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                            • API String ID: 2559590344-537541572
                                                                                                            • Opcode ID: 5c6c867498be17f7b4a82da35dacdefc55dd83e47f507bb598be2395b7641504
                                                                                                            • Instruction ID: 0200d1d9cdfdee912307475d8f9bbe7bfe162a07ee501957ebdc3be620dea59a
                                                                                                            • Opcode Fuzzy Hash: 5c6c867498be17f7b4a82da35dacdefc55dd83e47f507bb598be2395b7641504
                                                                                                            • Instruction Fuzzy Hash: EF31BD31711B0895FA96CB269C147A973A5BB4CBF0F688621EE39437D4EF38CA49C301
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000102D Relevance: 10.6, APIs: 7, Instructions: 131COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CharNext
                                                                                                            • String ID:
                                                                                                            • API String ID: 3213498283-0
                                                                                                            • Opcode ID: ff8410d235b8728794a2235438aa1e2d793b415053973e6f35ab459fc156dd2b
                                                                                                            • Instruction ID: 5dd945e59260f5c4599e50f87603fc54edbaa34da4406b7680b57bbc3bdf6cef
                                                                                                            • Opcode Fuzzy Hash: ff8410d235b8728794a2235438aa1e2d793b415053973e6f35ab459fc156dd2b
                                                                                                            • Instruction Fuzzy Hash: F4517E36201A9D81EAA6CF25D5547B872A1E35CBC4F84C012EB4947B95EF78CB5A8312
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018002ADC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                            • String ID: api-ms-
                                                                                                            • API String ID: 2559590344-2084034818
                                                                                                            • Opcode ID: 0e59b21ecc5e22f10e4f59a7d043c26f004daf6fd1dd7a55ad26831b82e35194
                                                                                                            • Instruction ID: d5935c8488295e42e4ba895f8ae1d870bbcc581ecbc6ecaec587449ba514f2f5
                                                                                                            • Opcode Fuzzy Hash: 0e59b21ecc5e22f10e4f59a7d043c26f004daf6fd1dd7a55ad26831b82e35194
                                                                                                            • Instruction Fuzzy Hash: 5B318331316B4896FE97DB06A8507D57394F74DBE0F5A8525BD194B790EF3CC64A8300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018002B080 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72libraryloaderCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                            • String ID: api-ms-
                                                                                                            • API String ID: 2559590344-2084034818
                                                                                                            • Opcode ID: b545b54d0dc4a6391a5f47a6c6c0a972b12180364026704646a2a5b71c62ea63
                                                                                                            • Instruction ID: 3e132f992f40af858925db8aac2dde04911dbda3a867a5cbb5173365c52d5ed9
                                                                                                            • Opcode Fuzzy Hash: b545b54d0dc4a6391a5f47a6c6c0a972b12180364026704646a2a5b71c62ea63
                                                                                                            • Instruction Fuzzy Hash: 97218331311B0891EA97DB56986439963E4FB4CBF0F988625EE29877D0EE78D659C300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006BAF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71libraryCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Library$Load$ErrorFreeLast
                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                            • API String ID: 3813093105-537541572
                                                                                                            • Opcode ID: cc287cedbab991c4830b99ee69e6c9f3bc376abe0dbf73fd7e4405c98074f49d
                                                                                                            • Instruction ID: 9ec653e029417c999f7f2ac2eafc822aecd35e0d1a542af1b1b9d0cf126c521c
                                                                                                            • Opcode Fuzzy Hash: cc287cedbab991c4830b99ee69e6c9f3bc376abe0dbf73fd7e4405c98074f49d
                                                                                                            • Instruction Fuzzy Hash: 6F219371311B0981EE92CB16AC203A83395BB4CBF0F689220ED39877D9DFB8C6498300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018006BE78 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66libraryCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Library$Load$ErrorFreeLast
                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                            • API String ID: 3813093105-537541572
                                                                                                            • Opcode ID: 91b5cf1f0730769647cce5eefe95e556aa7836da48b2472cfd6960d1f08109a3
                                                                                                            • Instruction ID: 67655563a59a8cfe9347a9c69a665de1101e5666019718bf11537ccf0250c4ce
                                                                                                            • Opcode Fuzzy Hash: 91b5cf1f0730769647cce5eefe95e556aa7836da48b2472cfd6960d1f08109a3
                                                                                                            • Instruction Fuzzy Hash: 1821A131311B4981EA96DB5A9C543A933E5AB4CBE0F698635EE39877E0DF38C6498700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003EE5 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 452COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Module$FileHandleName
                                                                                                            • String ID: Module$Module_Raw$REGISTRY
                                                                                                            • API String ID: 4146042529-549000027
                                                                                                            • Opcode ID: d36713251d1df7a5d1792ac52b66c9ecda8bc6cd5776e10cd0fb041b041fd4bf
                                                                                                            • Instruction ID: c1ae5cef054f2ba151aee0a7cd455383534cfa034d8e88302a84950bb81dc1d4
                                                                                                            • Opcode Fuzzy Hash: d36713251d1df7a5d1792ac52b66c9ecda8bc6cd5776e10cd0fb041b041fd4bf
                                                                                                            • Instruction Fuzzy Hash: C7A1D372315B8881FB92DB60E8917E97360FB897C4F849416FA4B57A96DF38C749C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001E56 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 181COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileModuleName
                                                                                                            • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                            • API String ID: 514040917-4022980321
                                                                                                            • Opcode ID: 8cf53391a26b7488a709a91de9da7d3f42699bfc254364c733c1ed78484d878a
                                                                                                            • Instruction ID: f45b054ad1441b70acfdc8d338c8d907650cff0e665b4be41e9000b2552fe37a
                                                                                                            • Opcode Fuzzy Hash: 8cf53391a26b7488a709a91de9da7d3f42699bfc254364c733c1ed78484d878a
                                                                                                            • Instruction Fuzzy Hash: 9E31903670464C85FAE2EB26A8103EAA391BB5DBD4F80C522FD15577A5DE3DC74E8700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003B5C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: False$OnResourceAllocate$True$insert into ResourceEvents (Event,lTickCount,Application, ObjectID, Type, ResourceID, Enlisted, NumRated, Rating) val
                                                                                                            • API String ID: 568940515-4149625160
                                                                                                            • Opcode ID: 0ca4346f1e72050ae68c9d6b01e80f719c4008faad69c7a5ea0580b861570db5
                                                                                                            • Instruction ID: e86a6115f094b24028abd36e3955db6120f13c627f93f4f25d1b47f882ba77b7
                                                                                                            • Opcode Fuzzy Hash: 0ca4346f1e72050ae68c9d6b01e80f719c4008faad69c7a5ea0580b861570db5
                                                                                                            • Instruction Fuzzy Hash: 4C313A32604B8885E7A69F24F8413DA77A5F7897D4F548129FA8D43B98DF38C689CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000122B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67registrylibraryloaderCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AddressCreateHandleModuleProc
                                                                                                            • String ID: Advapi32.dll$RegCreateKeyTransactedW
                                                                                                            • API String ID: 1964897782-2994018265
                                                                                                            • Opcode ID: 58e9e422b534aba2c55308f60b76957be220858f38a0ff608579a42d9cec87c4
                                                                                                            • Instruction ID: 94e9ffc88c3cdadfecc7c0611ded797ee8a50f30a6ac5e233c512e7fe4c1f987
                                                                                                            • Opcode Fuzzy Hash: 58e9e422b534aba2c55308f60b76957be220858f38a0ff608579a42d9cec87c4
                                                                                                            • Instruction Fuzzy Hash: F031EA36609B8886DBA1CF15F49479AB3A4F78CBD4F548126EA8D83B58DF3DC549CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018002AC8C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66libraryCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Library$Load$ErrorFreeLast
                                                                                                            • String ID: api-ms-
                                                                                                            • API String ID: 3813093105-2084034818
                                                                                                            • Opcode ID: ba824953f30f6176af5c750f20274eae442540c4ea576b779d4a3d1ce768bd9e
                                                                                                            • Instruction ID: e022749ffaa7c9347dbef82dc74c7124904c62915c867322b4a246464892c59f
                                                                                                            • Opcode Fuzzy Hash: ba824953f30f6176af5c750f20274eae442540c4ea576b779d4a3d1ce768bd9e
                                                                                                            • Instruction Fuzzy Hash: BB21C431216A0896FE97CB16A4503986394BB4DBF1F288720EE2A46BD1EE38C6498300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000213A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 61COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: False$OnResourceTrack$True$insert into ResourceEvents (Event,lTickCount,Application, ObjectID, Type, ResourceID, Enlisted) values ('%s',%d, '%s'
                                                                                                            • API String ID: 568940515-1265754562
                                                                                                            • Opcode ID: 70b03401a510878842d1d73f86c8b66dfa087633348fa6dd21bf0816af63e2df
                                                                                                            • Instruction ID: b6f4d82436f45a07d6d2acf65ed27fbaf8238e00ccf04a774d9c53b756535943
                                                                                                            • Opcode Fuzzy Hash: 70b03401a510878842d1d73f86c8b66dfa087633348fa6dd21bf0816af63e2df
                                                                                                            • Instruction Fuzzy Hash: B3213233214B84C6E7A59F24E8507DA73A5F7897C4F908125FA8D46BA8DF3CC649CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800014CE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 61COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: False$OnResourceCreate$True$insert into ResourceEvents (Event,lTickCount,Application, ObjectID, Type, ResourceID, Enlisted) values ('%s',%d, '%s'
                                                                                                            • API String ID: 568940515-24047494
                                                                                                            • Opcode ID: c1c25828acb0097218b753b259d041ba7181c60c289427365a33db7be2ba0bff
                                                                                                            • Instruction ID: d511615666a722055bcf2092b078b7700d383effe203c36e64905f0cf0809784
                                                                                                            • Opcode Fuzzy Hash: c1c25828acb0097218b753b259d041ba7181c60c289427365a33db7be2ba0bff
                                                                                                            • Instruction Fuzzy Hash: 98215E33214B84C2E7A29F24E8417DA73A5F7887C4F508225EA8D46BA8DF3CC589CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018002AF64 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60libraryCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Library$Load$ErrorFreeLast
                                                                                                            • String ID: api-ms-
                                                                                                            • API String ID: 3813093105-2084034818
                                                                                                            • Opcode ID: 1a07f49e3310cb59ccc04b7e01d11ab97668fd9abf31c1c0c948fc35d17403c3
                                                                                                            • Instruction ID: 3e020c810c7033c81e83a66c570c98a21bfb761fe2c08492cfcf72417494137d
                                                                                                            • Opcode Fuzzy Hash: 1a07f49e3310cb59ccc04b7e01d11ab97668fd9abf31c1c0c948fc35d17403c3
                                                                                                            • Instruction Fuzzy Hash: C821C231221F4881EA97DB5A95A43A93394EB4CFE0F588325EE3D877D0DF38D6498300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000D930 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registrylibraryloaderCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AddressHandleModuleOpenProc
                                                                                                            • String ID: Advapi32.dll$RegOpenKeyTransactedW
                                                                                                            • API String ID: 1337834000-3913318428
                                                                                                            • Opcode ID: ff3ca52bb9a9765a0a196b2f27953bffa9b2a8956b27d6791ff0270cd10b2482
                                                                                                            • Instruction ID: 1b6574a094bbe40cee02f7e0afc5647beb0cc46c31a6934c552afd52aa1b81f8
                                                                                                            • Opcode Fuzzy Hash: ff3ca52bb9a9765a0a196b2f27953bffa9b2a8956b27d6791ff0270cd10b2482
                                                                                                            • Instruction Fuzzy Hash: 5B111C32618B4882EB51CF16F454799B7A0F78CBD4F588526AA8947B68CF7CC649CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000D880 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39registrylibraryloaderCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AddressDeleteHandleModuleProc
                                                                                                            • String ID: Advapi32.dll$RegDeleteKeyTransactedW
                                                                                                            • API String ID: 588496660-2168864297
                                                                                                            • Opcode ID: 2e426c180d74b1be444a57f17336153c4fc04da86dde9c9887555b53b61004c3
                                                                                                            • Instruction ID: eeef1d9f4932fc5e4c5c1fbff7891bafa920862081ce32fb7483493e8fc7794f
                                                                                                            • Opcode Fuzzy Hash: 2e426c180d74b1be444a57f17336153c4fc04da86dde9c9887555b53b61004c3
                                                                                                            • Instruction Fuzzy Hash: 18015E31705B8C82FB96CB15E8647A9B360AB4CBC4F58C526EA4947BA4CF7CC649C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018005BFF4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                                            • API String ID: 4061214504-1276376045
                                                                                                            • Opcode ID: bbc0ef5e92eaa23319cd114df47b8b5635883812f55cb5fd8fbe9ee3414a145c
                                                                                                            • Instruction ID: f1d868471ce0653e4352c50558eae97e6424cd8e840ec99ad9dcdb87f204227d
                                                                                                            • Opcode Fuzzy Hash: bbc0ef5e92eaa23319cd114df47b8b5635883812f55cb5fd8fbe9ee3414a145c
                                                                                                            • Instruction Fuzzy Hash: 1BF0F671311B0C82EF518F24E4647A96320EB8C7F0F448216F665451E0CF3DC28DC700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000124E Relevance: 7.8, APIs: 5, Instructions: 348COMMON
                                                                                                            Download Yara Rule
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID:
                                                                                                            • API String ID:
                                                                                                            • Opcode ID: 03950b43d6fd3fbe600558dbb54b198b956683ccdf0ba3cea48ff4f4e3f6b488
                                                                                                            • Instruction ID: 7ec5827ce852fe2ddc125d001daf71ee04ca981f62041b49ffa18151aa5d0bf1
                                                                                                            • Opcode Fuzzy Hash: 03950b43d6fd3fbe600558dbb54b198b956683ccdf0ba3cea48ff4f4e3f6b488
                                                                                                            • Instruction Fuzzy Hash: AA91BC32301A4886FB96DF66E4503AD33E0E74CBD0F14C425FA098B795EF78CA998B01
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000AEB0 Relevance: 7.5, APIs: 5, Instructions: 42COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CriticalDeleteSection
                                                                                                            • String ID:
                                                                                                            • API String ID: 166494926-0
                                                                                                            • Opcode ID: 74d2728c8e2d156a0e156f0c891b5cd4679567a3a92ee8753459cd8f0bcf19bc
                                                                                                            • Instruction ID: cd862277aa768e3e98ab7926fdc539b08aa1b0600c42d336bde8c26babdf2551
                                                                                                            • Opcode Fuzzy Hash: 74d2728c8e2d156a0e156f0c891b5cd4679567a3a92ee8753459cd8f0bcf19bc
                                                                                                            • Instruction Fuzzy Hash: 66110072205A48C6FF96DF65C0943AC3360FB89F89F148521EA1D4B751DF69C949C300
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180004232 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnAuthenticateFail$Yes$insert into SecurityEvents (Event,lTickCount,Application, ActivityID, ObjectID, InterfaceID, Method, OriginalUser, DirectUser,Impe
                                                                                                            • API String ID: 568940515-1364771376
                                                                                                            • Opcode ID: 2476dfbd5489bde8fe1f064499755f8ec42ed18f5f098903c39e5718dd92a60f
                                                                                                            • Instruction ID: abf6f26a52b246ab74f2bead532ef7a45e93010316c69f2c86473727366c75a2
                                                                                                            • Opcode Fuzzy Hash: 2476dfbd5489bde8fe1f064499755f8ec42ed18f5f098903c39e5718dd92a60f
                                                                                                            • Instruction Fuzzy Hash: 1C312C33218F8485E7A19F25F8407DAB7A5F7887D4F648126EAC942B98DF7CC589CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003832 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnAuthenticate$Yes$insert into SecurityEvents (Event,lTickCount,Application, ActivityID, ObjectID, InterfaceID, Method, OriginalUser, DirectUser,Impe
                                                                                                            • API String ID: 568940515-440612529
                                                                                                            • Opcode ID: 75db6b5856dbcd5d58bbbfdf6c0876e6189508392fea9f57c1cbfa50e27dbf38
                                                                                                            • Instruction ID: b599a0f454840a10b2e9ead2ccdf6647066f0f3492ceba2726bd2b33e03c4a4a
                                                                                                            • Opcode Fuzzy Hash: 75db6b5856dbcd5d58bbbfdf6c0876e6189508392fea9f57c1cbfa50e27dbf38
                                                                                                            • Instruction Fuzzy Hash: 18311832214B8885E7A29F25F8407DAB7A4F7887D4F548126EEC942B98DF78D589CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001654 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMDeliver$Yes$insert into CRMEvents (Event,lTickCount,Application, ClerkID, Variants, RecordSize) values ('%s',%d, '%s','%s','%s',%
                                                                                                            • API String ID: 568940515-126561981
                                                                                                            • Opcode ID: 5c53fac065ba34da966241fe971c07dd2d10a035f886104d095c0a0d456b61cf
                                                                                                            • Instruction ID: c616e1d537b6a44f4ec452b39ba231236c52c99e58e118be30f26a0ebcd7ffa3
                                                                                                            • Opcode Fuzzy Hash: 5c53fac065ba34da966241fe971c07dd2d10a035f886104d095c0a0d456b61cf
                                                                                                            • Instruction Fuzzy Hash: 8D216232218B8886E7A6DB15E4513DA73E0F7897C5F509125FA8D42BA8DF3CC699CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800018D9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMWrite$Yes$insert into CRMEvents (Event,lTickCount,Application, ClerkID,Variants,RecordSize) values ('%s',%d, '%s','%s','%s',%d)
                                                                                                            • API String ID: 568940515-3607782894
                                                                                                            • Opcode ID: e6605d03e3f574cff1a4343d6941878a7bc0a618462e0a9db6d8214fc9e33fa6
                                                                                                            • Instruction ID: 7b407adb29b77b5e55b791e8f4d5789cebfdf88c9aadaee8d23eabd7893f6150
                                                                                                            • Opcode Fuzzy Hash: e6605d03e3f574cff1a4343d6941878a7bc0a618462e0a9db6d8214fc9e33fa6
                                                                                                            • Instruction Fuzzy Hash: 33216232618B8886E7A6DB14E4507DA73A0F7897C5F509125BA8D42BA4EF3CC689CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001F3C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnTransactionStart$Yes$insert into TransactionEvents (Event,lTickCount,Application, TransactionID, TSID, Root) values ('%s',%d,'%s','%s','%s
                                                                                                            • API String ID: 568940515-3769607772
                                                                                                            • Opcode ID: 3cb8ff87d764adea4ba48005ac18c77c4eafd7181eb2d272a59a7f6640e93f40
                                                                                                            • Instruction ID: 8c07b620aa76c5004bf33cde74e36e714e5d8a7c813d643ecf0a56c06c52b76b
                                                                                                            • Opcode Fuzzy Hash: 3cb8ff87d764adea4ba48005ac18c77c4eafd7181eb2d272a59a7f6640e93f40
                                                                                                            • Instruction Fuzzy Hash: 28214F72214F88C6E7A69B25F84139A73A1F749795F508126AA8D46B98DF3CC688CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002946 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnTransactionPrepared$Yes$insert into TransactionEvents (Event,lTickCount,Application, TransactionID, VoteYes) values ('%s',%d,'%s','%s','%s' )
                                                                                                            • API String ID: 568940515-3408875763
                                                                                                            • Opcode ID: c2d219bf5a4b0f4816b96dc45b2343ab1e158c064f50a93f4b836d9d965bb37a
                                                                                                            • Instruction ID: 87039d94facbf4dcb18eee8fdd3676f88c1aef2b6c0ca062c6d55045fe89eb3f
                                                                                                            • Opcode Fuzzy Hash: c2d219bf5a4b0f4816b96dc45b2343ab1e158c064f50a93f4b836d9d965bb37a
                                                                                                            • Instruction Fuzzy Hash: 23219532618F88C2E7A29F24E8503DA73A6F7497C5F109125BA8D06798DF3CC648CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003E04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: COM+ Load Balancing$TargetDown$insert into LBEvents (Event,lTickCount,Application, ServerName, ClsidEng) values ('%s',%d, '%s','%s','%s')
                                                                                                            • API String ID: 568940515-689102971
                                                                                                            • Opcode ID: 6e957370c9387279bd23a767913aa763616279fb1be2ccaf7dc66ac86fb3c588
                                                                                                            • Instruction ID: 2326eef7f3413ab391ebdbb81eddcff81d6c7aab70288304b34e9f3266f5e06f
                                                                                                            • Opcode Fuzzy Hash: 6e957370c9387279bd23a767913aa763616279fb1be2ccaf7dc66ac86fb3c588
                                                                                                            • Instruction Fuzzy Hash: 2721B733614F89C2EBA19F24F4413DA73A5F748784F508225FACD4AA98DF38C5588B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003F2B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: COM+ Load Balancing$TargetUp$insert into LBEvents (Event,lTickCount,Application, ServerName, ClsidEng) values ('%s',%d, '%s','%s','%s')
                                                                                                            • API String ID: 568940515-4093035086
                                                                                                            • Opcode ID: deb7352315766832df0284ed310a560d3fcae331a8b3435000ed01dfe91e2f5c
                                                                                                            • Instruction ID: a30cffb6a1401110f535c9ee4ddfb7d097d1c94a5d49645dd5d09949cb8c71ad
                                                                                                            • Opcode Fuzzy Hash: deb7352315766832df0284ed310a560d3fcae331a8b3435000ed01dfe91e2f5c
                                                                                                            • Instruction Fuzzy Hash: 2121B733224F89C6EBA19F64F4503DA73A5F748795F508226F6CD46A98DF3CC5988B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018007B524 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                            • String ID:
                                                                                                            • API String ID: 2718003287-0
                                                                                                            • Opcode ID: 667ef7a8fc4b5f6f9bad46d3e6c8fc96dd25f29f4d6fdcbede878eae06c1b175
                                                                                                            • Instruction ID: ff8e4cf49e8d8c3f16441617d9d743a09e7024b5beabeff718c4937262d4dfa9
                                                                                                            • Opcode Fuzzy Hash: 667ef7a8fc4b5f6f9bad46d3e6c8fc96dd25f29f4d6fdcbede878eae06c1b175
                                                                                                            • Instruction Fuzzy Hash: 78D1BC32704A888AE792CF69D4403EC77B5F749BD8F148216EF5997B99DE39C60AC700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800038B4 Relevance: 6.2, APIs: 4, Instructions: 219COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ConsoleErrorLastMode
                                                                                                            • String ID:
                                                                                                            • API String ID: 953036326-0
                                                                                                            • Opcode ID: a17a33cc187b694ea1cec9bea3e2fd4b0c7520583d99cbaefa1d1ea1fd84071e
                                                                                                            • Instruction ID: dfe92b28aea1e573a95c7b851e0509267f34f731876e810bbce9f5d09264e93a
                                                                                                            • Opcode Fuzzy Hash: a17a33cc187b694ea1cec9bea3e2fd4b0c7520583d99cbaefa1d1ea1fd84071e
                                                                                                            • Instruction Fuzzy Hash: 9491C5B2710A5889F7A2CF659490BED27A0F34CBC8F44C10AFE0A57695DF3AC689C711
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800028B0 Relevance: 6.1, APIs: 4, Instructions: 96threadCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CountCreateCriticalErrorFreeFrequencyInitializeLastMarshalerPerformanceQuerySectionSpinThreaded
                                                                                                            • String ID:
                                                                                                            • API String ID: 3280258399-0
                                                                                                            • Opcode ID: 3b6e64028e344c4fb24936a77b15fc1dd197160406ab986096ac6261c18fcb8f
                                                                                                            • Instruction ID: 06d739d0fd1f0fe23cab3416d3adc5bdd6f6abe879c9a8e5f2e424fbb5715e0b
                                                                                                            • Opcode Fuzzy Hash: 3b6e64028e344c4fb24936a77b15fc1dd197160406ab986096ac6261c18fcb8f
                                                                                                            • Instruction Fuzzy Hash: 5D417F32210B4887F7A6DF26E4507AA77A0F758BD4F008125EE8A567A0DF7CC649C302
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018007F6A4 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: FilePointer$ErrorLast
                                                                                                            • String ID:
                                                                                                            • API String ID: 142388799-0
                                                                                                            • Opcode ID: ba75338732ea9bc12c292bbe77beca2dedac072680a379a976c8a6d67b41ee99
                                                                                                            • Instruction ID: cac02d6ea8938ed1bddac5a1b476e113652aa3e5651a56517060e9e501cd61d9
                                                                                                            • Opcode Fuzzy Hash: ba75338732ea9bc12c292bbe77beca2dedac072680a379a976c8a6d67b41ee99
                                                                                                            • Instruction Fuzzy Hash: 44219676218A8881EBB19F25A8543A977A1F78CFE4F548311EE69877E4DF78C219C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001226 Relevance: 6.1, APIs: 4, Instructions: 65timethreadCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                            • String ID:
                                                                                                            • API String ID: 2933794660-0
                                                                                                            • Opcode ID: e276b68215db3042ac1611a8a3079d9ba0b93682ff8c48172cdf6038ec44b357
                                                                                                            • Instruction ID: 0639d34850784fa79cd6b62eb247b6bb65b8bdd42c59b9ee030131c730a5ca11
                                                                                                            • Opcode Fuzzy Hash: e276b68215db3042ac1611a8a3079d9ba0b93682ff8c48172cdf6038ec44b357
                                                                                                            • Instruction Fuzzy Hash: A8119E32700F098AEB669F7198553E923A4EB1C3A8F044B20BA3D867D5EF74C369C340
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000CAFD Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: CountCreateCriticalErrorFreeFrequencyInitializeLastMarshalerPerformanceQuerySectionSpinThreaded
                                                                                                            • String ID:
                                                                                                            • API String ID: 3280258399-0
                                                                                                            • Opcode ID: dcc3cf0c4519294967b572793e02cba37b279d898dec3abd09b2d7e9ae9e4c22
                                                                                                            • Instruction ID: eac1416662cd461174ea1b970c048e497c45674aca480ed068941d869f0497b9
                                                                                                            • Opcode Fuzzy Hash: dcc3cf0c4519294967b572793e02cba37b279d898dec3abd09b2d7e9ae9e4c22
                                                                                                            • Instruction Fuzzy Hash: BC113036310A4583FB969F26E4253AA7790B748FD0F008026DE8B93760DF39C54A8301
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018001D1A8 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 378COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EncodePointer
                                                                                                            • String ID: MOC$RCC
                                                                                                            • API String ID: 2118026453-2084237596
                                                                                                            • Opcode ID: 547ecf1df725ae729aff8d3e2614a1eac9fe959c360197ad231d8c4ac67454d4
                                                                                                            • Instruction ID: d350a554a7dc2edef797ee9a58a7f1944af83d9801c2f6db9581fde52081bae2
                                                                                                            • Opcode Fuzzy Hash: 547ecf1df725ae729aff8d3e2614a1eac9fe959c360197ad231d8c4ac67454d4
                                                                                                            • Instruction Fuzzy Hash: 0D9150B3614B988AE792CB65E8803DD7BB0F748798F14811AEB8957B55DF38C299C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018001CF0C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 278COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: EncodePointer
                                                                                                            • String ID: MOC$RCC
                                                                                                            • API String ID: 2118026453-2084237596
                                                                                                            • Opcode ID: 59ae28273c0bb21a4c98f595560d9171e1fb22558311292943a73a5185993d49
                                                                                                            • Instruction ID: 97e0deee28115102c81e0ae66a5acf37d43935fecac8ac27498b081c2ec6187f
                                                                                                            • Opcode Fuzzy Hash: 59ae28273c0bb21a4c98f595560d9171e1fb22558311292943a73a5185993d49
                                                                                                            • Instruction Fuzzy Hash: 17514577A04B888AE762DF65D4807DD77A0F348BC8F148216EE4913B59DF38D69AC704
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000121C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Unwind
                                                                                                            • String ID: csm$f
                                                                                                            • API String ID: 3419175465-629598281
                                                                                                            • Opcode ID: 2f9a861b5431d80b04f4cce8cb8c1bebd9457c75a134b7762c68ed2352256beb
                                                                                                            • Instruction ID: a8c09be384250ac0f4eeac65bd2fb47a3859bf48f0194db3dbea58ccd4fd8bf5
                                                                                                            • Opcode Fuzzy Hash: 2f9a861b5431d80b04f4cce8cb8c1bebd9457c75a134b7762c68ed2352256beb
                                                                                                            • Instruction Fuzzy Hash: 2551BE32319E5886EB9ADF25E504BA97795F309BD9F50C120FE4A47B88DF34DA48C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800013E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: memcpy_s
                                                                                                            • String ID: s
                                                                                                            • API String ID: 1502251526-453955339
                                                                                                            • Opcode ID: 022b5e137fcdc9cd09d4be583c6367df9d55c22d6b9ee3d1f220e6b863028f54
                                                                                                            • Instruction ID: b1ee5c94efebfa408f5cca176b8b28f8a5f7dff35c43f21e859d6a500f820cc4
                                                                                                            • Opcode Fuzzy Hash: 022b5e137fcdc9cd09d4be583c6367df9d55c22d6b9ee3d1f220e6b863028f54
                                                                                                            • Instruction Fuzzy Hash: A141E03231424887E3B68F14E449BED7791F398789F518112EA4A57B85CA7EDE4ACB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018007BEFC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ErrorFileLastWrite
                                                                                                            • String ID: U
                                                                                                            • API String ID: 442123175-4171548499
                                                                                                            • Opcode ID: 99a66a8bdf70d6e68623a3b33cb7783195b134339dfb5d6a8d2aa56904132ed7
                                                                                                            • Instruction ID: adb77b6ba2eab8359ee81247c9d3a76424592aabba4e434477552dbd0ef884e0
                                                                                                            • Opcode Fuzzy Hash: 99a66a8bdf70d6e68623a3b33cb7783195b134339dfb5d6a8d2aa56904132ed7
                                                                                                            • Instruction Fuzzy Hash: 6241B032614A8886DBA1DF65E8443EA77A0F388BC4F808125FE4D87794EF3CC649CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018001AC92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: Unwind
                                                                                                            • String ID: csm$f
                                                                                                            • API String ID: 3419175465-629598281
                                                                                                            • Opcode ID: c4354422d48ccfdb5e9c1e8e8fb67be072b32aa17e2abbac41afa3832a1fa636
                                                                                                            • Instruction ID: 03666d9617d1fbc7b7fadd30f23141f129ec3148a1feb148abbea1b62bc1288b
                                                                                                            • Opcode Fuzzy Hash: c4354422d48ccfdb5e9c1e8e8fb67be072b32aa17e2abbac41afa3832a1fa636
                                                                                                            • Instruction Fuzzy Hash: FC31AB32215E4886EB96EF12E944BA937A4F749BD9F01C020FE4A43B98CF38C648C700
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800014BF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON
                                                                                                            Download Yara Rule
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID:
                                                                                                            • String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
                                                                                                            • API String ID: 0-4196971266
                                                                                                            • Opcode ID: ef8335e5ac0dec0daa570ff7166dff53f5528bbd473254f75ff514969e43b2df
                                                                                                            • Instruction ID: 2cfaa37bbe8e021ee23ffd8430aa4757a076a0109de5f5e650bade1c2fe93130
                                                                                                            • Opcode Fuzzy Hash: ef8335e5ac0dec0daa570ff7166dff53f5528bbd473254f75ff514969e43b2df
                                                                                                            • Instruction Fuzzy Hash: 1811B275714B4C81EA969B52E9407F57362BB4C7D0F54C023B92907B64CE38CA5DC741
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001271 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnMethodReturn$insert into MethodEvents values ('%s', %d, '%s', '%s', '%s', '%s', '%s', %d, '%s')
                                                                                                            • API String ID: 568940515-398865342
                                                                                                            • Opcode ID: 85ca7181da9b529c85d5b83585cbb1ff26075f3072af2943781b437fb27dd26f
                                                                                                            • Instruction ID: 66d9e9b3a9fa892ee1bcd3d70cca11b236bcadd34ef84258a02d3167f3452fae
                                                                                                            • Opcode Fuzzy Hash: 85ca7181da9b529c85d5b83585cbb1ff26075f3072af2943781b437fb27dd26f
                                                                                                            • Instruction Fuzzy Hash: A9211C32214BC886E7A19F24F44139EB3A4F7887D4F508126EA8942B98EF3CC599CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800037A1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnQCRecord, xrefs: 0000000180013D44
                                                                                                            • insert into QCEvents (Event,lTickCount,Application, ObjectID,QueueName, MsgID, WorkFlowID, HResult) values ('%s',%d, , xrefs: 0000000180013D50
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnQCRecord$insert into QCEvents (Event,lTickCount,Application, ObjectID,QueueName, MsgID, WorkFlowID, HResult) values ('%s',%d,
                                                                                                            • API String ID: 568940515-3456665794
                                                                                                            • Opcode ID: 34c35a881dea3d9286c989252df73685382305b48bc3c35128c0d37cc8022bca
                                                                                                            • Instruction ID: b9f7edb8c6ae284740e40c7fa3e60d51d5a979624ec110fc70e272e67dd1df62
                                                                                                            • Opcode Fuzzy Hash: 34c35a881dea3d9286c989252df73685382305b48bc3c35128c0d37cc8022bca
                                                                                                            • Instruction Fuzzy Hash: 38215132219B84C6E7A19F24F84179E73A4F7887C4F50822AFAC942B98DF38C555CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002F36 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ThreadsWaiting, AvailableObjs, CreatedObjs, Min, Max) val, xrefs: 00000001800125EE
                                                                                                            • OnObjPoolCreateDecision, xrefs: 00000001800125CD
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolCreateDecision$insert into ObjectPoolEvents (Event,lTickCount,Application, ThreadsWaiting, AvailableObjs, CreatedObjs, Min, Max) val
                                                                                                            • API String ID: 568940515-494525035
                                                                                                            • Opcode ID: 70d7059b9763fcf0ffbbd3ff4c3b8096820d6a099123f91bb724b60e899f8c23
                                                                                                            • Instruction ID: 13251c9b0b7eb7f8043e101ba9181e0a762864bdb483aa77e2d81c48a6159ed1
                                                                                                            • Opcode Fuzzy Hash: 70d7059b9763fcf0ffbbd3ff4c3b8096820d6a099123f91bb724b60e899f8c23
                                                                                                            • Instruction Fuzzy Hash: 2D219032619B84C6E7A1DF24E48079A73E5F788784F108225FB8942B98EF38C559CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003C2E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into CRMEvents (Event,lTickCount,Application, ClerkID, ActivityID,TransactionUOWID,ProgIdCompensator,Description ) , xrefs: 0000000180010FDB
                                                                                                            • OnCRMBegin, xrefs: 0000000180010FCF
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMBegin$insert into CRMEvents (Event,lTickCount,Application, ClerkID, ActivityID,TransactionUOWID,ProgIdCompensator,Description )
                                                                                                            • API String ID: 568940515-4018256886
                                                                                                            • Opcode ID: 1201ab19f7897dcaf11c4a1259d0324d2b9e0aaa4516e7221b784aec65f5b33e
                                                                                                            • Instruction ID: 38445f64fc4c6c8f1b4b2872af1915978f32f96233fd6ca2ca34400143146ad2
                                                                                                            • Opcode Fuzzy Hash: 1201ab19f7897dcaf11c4a1259d0324d2b9e0aaa4516e7221b784aec65f5b33e
                                                                                                            • Instruction Fuzzy Hash: 5A211032614BC4C5E7A19F24E4417DA73E5F788784F508226EAC946A98DF7CC599CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001EF1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectEvents (Event, lTickCount,Application, ActivityID, ClassID, TSID, ContextID,ObjectID) values ('%s',, xrefs: 0000000180013313
                                                                                                            • OnObjectCreate, xrefs: 0000000180013307
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjectCreate$insert into ObjectEvents (Event, lTickCount,Application, ActivityID, ClassID, TSID, ContextID,ObjectID) values ('%s',
                                                                                                            • API String ID: 568940515-2919844774
                                                                                                            • Opcode ID: f831239a0854fa8e50eea48b2719bb8102a6595fd2f4f7295030e6a03b85b918
                                                                                                            • Instruction ID: 7295a5c56382e6de6122b74c35e4bcd2adbe0bb0ac96382781dd273906fa3d84
                                                                                                            • Opcode Fuzzy Hash: f831239a0854fa8e50eea48b2719bb8102a6595fd2f4f7295030e6a03b85b918
                                                                                                            • Instruction Fuzzy Hash: 21212C32218B84C5E7A19F24E84179AB3E5F788784F548226EBCD46B98DF3CC599CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000282F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into QCEvents (Event,lTickCount,Application, QueueName, QueueID, HResult) values ('%s',%d, '%s', '%s','%s', %d, xrefs: 00000001800139C5
                                                                                                            • OnQCQueueOpen, xrefs: 00000001800139B9
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnQCQueueOpen$insert into QCEvents (Event,lTickCount,Application, QueueName, QueueID, HResult) values ('%s',%d, '%s', '%s','%s', %d
                                                                                                            • API String ID: 568940515-82951674
                                                                                                            • Opcode ID: 7df1b050dbb5cf67f66ff58a2f8a0100009b817ff39887a9a1f1d5ada3ea719e
                                                                                                            • Instruction ID: 66fa5618533c3b3d4a6f87288b81f83e8edef92bc0336aba9a05289e8400018e
                                                                                                            • Opcode Fuzzy Hash: 7df1b050dbb5cf67f66ff58a2f8a0100009b817ff39887a9a1f1d5ada3ea719e
                                                                                                            • Instruction Fuzzy Hash: B0219272219FC886E7A18F24E44239A77A5FB897C4F504226FAC946B98DF3CC558CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000128A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID, Reason, AvailableObjs, ObjectID) values ('%s',%d, xrefs: 0000000180012D35
                                                                                                            • OnObjPoolPutObject, xrefs: 0000000180012D10
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolPutObject$insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID, Reason, AvailableObjs, ObjectID) values ('%s',%d
                                                                                                            • API String ID: 568940515-1253942311
                                                                                                            • Opcode ID: 6ef920dd3264caa83e21bf27bd7eec7a5b45d14ce6fd92a603725bc7e33d07ad
                                                                                                            • Instruction ID: dcc78664ddc642995882bcfdc9c38850cf7ad6e26d462b549a63ede1d3111d17
                                                                                                            • Opcode Fuzzy Hash: 6ef920dd3264caa83e21bf27bd7eec7a5b45d14ce6fd92a603725bc7e33d07ad
                                                                                                            • Instruction Fuzzy Hash: C4213A32618F88C6E7A19F24F45079A77A5F388784F109225BA8942B98EF3CC5988F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180004066 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen, ThreadNum) values ('%s',%d,'%, xrefs: 0000000180015126
                                                                                                            • OnThreadWorkPublic, xrefs: 00000001800150FC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadWorkPublic$insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen, ThreadNum) values ('%s',%d,'%
                                                                                                            • API String ID: 568940515-1632664556
                                                                                                            • Opcode ID: d1417ad310d96331548333505e20cffd5f82b04893ae96e969a7fd8f56df10d9
                                                                                                            • Instruction ID: 734d2e25ffc1cb744797b146884c231989100b35cac079d3309d8d21a9598376
                                                                                                            • Opcode Fuzzy Hash: d1417ad310d96331548333505e20cffd5f82b04893ae96e969a7fd8f56df10d9
                                                                                                            • Instruction Fuzzy Hash: DE214132618B84C6E7A29F24E85179A73A4F788784F508225EAC947B98DF7CC189CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800040B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into QCEvents (Event,lTickCount,Application, ObjectID, MsgID, WorkFlowID, HResult) values ('%s',%d, '%s', '%s', xrefs: 000000018001389E
                                                                                                            • OnQCMoveToDeadQueue, xrefs: 0000000180013892
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnQCMoveToDeadQueue$insert into QCEvents (Event,lTickCount,Application, ObjectID, MsgID, WorkFlowID, HResult) values ('%s',%d, '%s', '%s'
                                                                                                            • API String ID: 568940515-3879600628
                                                                                                            • Opcode ID: c302347b8b5982f05e50988b8ea27ce895821b9f70c1b9c63438234a704b252e
                                                                                                            • Instruction ID: 78a7c560bbe5d203259365a951fac62aa4677bdefc7a3f55d5bbe25a7a349513
                                                                                                            • Opcode Fuzzy Hash: c302347b8b5982f05e50988b8ea27ce895821b9f70c1b9c63438234a704b252e
                                                                                                            • Instruction Fuzzy Hash: D6215072619B84C2EBA19F64F84139A73A5F788784F508226FA8946B98DF38C559CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800127B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnObjPoolCreatePool, xrefs: 0000000180012836
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID, Min, Max, Timeout) values ('%s',%d, '%s', '%s', , xrefs: 0000000180012857
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolCreatePool$insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID, Min, Max, Timeout) values ('%s',%d, '%s', '%s',
                                                                                                            • API String ID: 568940515-3933896253
                                                                                                            • Opcode ID: ffbac1e00b861b36046f38c78824c293f64e2d1b494111ba4bbb073aab419f06
                                                                                                            • Instruction ID: aa31bce9c34c66de4889abf6e2c24f43237594a6d901c573a387fcb4a705d4ee
                                                                                                            • Opcode Fuzzy Hash: ffbac1e00b861b36046f38c78824c293f64e2d1b494111ba4bbb073aab419f06
                                                                                                            • Instruction Fuzzy Hash: 95216276619B84C6EBA5DF28E45079A73E4F788784F108225EB8942B98DF38C198CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002978 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, EnteredApp,W2KThreadID,Timeout) values ('%s',%d, xrefs: 0000000180010736
                                                                                                            • OnActivityTimeout, xrefs: 000000018001072A
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnActivityTimeout$insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, EnteredApp,W2KThreadID,Timeout) values ('%s',%d
                                                                                                            • API String ID: 568940515-3791532242
                                                                                                            • Opcode ID: 9a4ad69ffde24e05bd5f89b18e0e7692d383922ea5421321b846a7af4713221e
                                                                                                            • Instruction ID: decf3111fbedceac1184c1931f8a88dbf1c10b4c09e993cc2c1bf9d23f31fd7a
                                                                                                            • Opcode Fuzzy Hash: 9a4ad69ffde24e05bd5f89b18e0e7692d383922ea5421321b846a7af4713221e
                                                                                                            • Instruction Fuzzy Hash: FD218E32619B84C6EBA19F24F45139A73A4F7887C4F608226FACD42B98DF78C5598F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800017AD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnObjPoolGetObject, xrefs: 0000000180012BCC
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, AvailableObjs, ObjectID) values ('%s, xrefs: 0000000180012BF6
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolGetObject$insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, AvailableObjs, ObjectID) values ('%s
                                                                                                            • API String ID: 568940515-4035697589
                                                                                                            • Opcode ID: 18fa219a96e35179cfdd40e86c45e5a676d28e9da3dd6d9870234883ba549dfd
                                                                                                            • Instruction ID: 7f19125e2f4cecda2190d49f5d4f6d0ba9fd1d957b0f3d42f3078b229518912e
                                                                                                            • Opcode Fuzzy Hash: 18fa219a96e35179cfdd40e86c45e5a676d28e9da3dd6d9870234883ba549dfd
                                                                                                            • Instruction Fuzzy Hash: 4C213D32618B8886E7A5DF24E4517DE73A4F788784F508225FB8947B98DF3CC199CB80
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003A7B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into QCEvents (Event,lTickCount,Application, QueueID, MsgID, WrokFlowID, HResult) values ('%s',%d, '%s', '%s',, xrefs: 0000000180013AFA
                                                                                                            • OnQCReceive, xrefs: 0000000180013AEE
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnQCReceive$insert into QCEvents (Event,lTickCount,Application, QueueID, MsgID, WrokFlowID, HResult) values ('%s',%d, '%s', '%s',
                                                                                                            • API String ID: 568940515-3262344693
                                                                                                            • Opcode ID: 1d5a9ce0a62d8ec4b8c92517466968e206b2237d9d798969bb2bab51ef8f9290
                                                                                                            • Instruction ID: b1a7b8fdf8f86d90a353c27221631110ec79f37fc91ad5ad623575d81a4e38c3
                                                                                                            • Opcode Fuzzy Hash: 1d5a9ce0a62d8ec4b8c92517466968e206b2237d9d798969bb2bab51ef8f9290
                                                                                                            • Instruction Fuzzy Hash: C5215033619BC4C2EBA19F24E45179A73A4FB88784F508229FBC946B98DF38C559CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003DA5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnResourceDestroy, xrefs: 000000018001416E
                                                                                                            • insert into ResourceEvents (Event,lTickCount,Application,ObjectID, Type, ResourceID,HResult) values ('%s',%d, '%s','%, xrefs: 000000018001417A
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnResourceDestroy$insert into ResourceEvents (Event,lTickCount,Application,ObjectID, Type, ResourceID,HResult) values ('%s',%d, '%s','%
                                                                                                            • API String ID: 568940515-1854418082
                                                                                                            • Opcode ID: 37b2f77be8a52817977e66a1dc06e41a79f3ce47ad78e429f2468d280a118a6d
                                                                                                            • Instruction ID: f49ffc9c562840c7934bd7312a98c023122629cdcfc4f221d6895ac1923ae36d
                                                                                                            • Opcode Fuzzy Hash: 37b2f77be8a52817977e66a1dc06e41a79f3ce47ad78e429f2468d280a118a6d
                                                                                                            • Instruction Fuzzy Hash: 8B218337619B84C6E7A19F64E45079A73E4F798784F108226FA8946B98DF38C198CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000217B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into SecurityEvents (Event,lTickCount,Application, ObjectID,ClientIP, ServerIP, URL) values ('%s',%d, '%s', '%, xrefs: 00000001800120C5
                                                                                                            • OnIISRequestInfo, xrefs: 00000001800120B9
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnIISRequestInfo$insert into SecurityEvents (Event,lTickCount,Application, ObjectID,ClientIP, ServerIP, URL) values ('%s',%d, '%s', '%
                                                                                                            • API String ID: 568940515-3847537754
                                                                                                            • Opcode ID: 9dc90d98fda10a7635de536ec6d28bcacfe50352d9d2167cc75ce2707dcc76c6
                                                                                                            • Instruction ID: 332b25cb277d3e4c24d52026770106ed7b8b9bd6ceb08d721cace089b55cde18
                                                                                                            • Opcode Fuzzy Hash: 9dc90d98fda10a7635de536ec6d28bcacfe50352d9d2167cc75ce2707dcc76c6
                                                                                                            • Instruction Fuzzy Hash: FB211D32618E8485E7A2DB24E8417DA73E5F798784F508225FBCD46B98DF38C599CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000420F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnObjPoolDestroyObject, xrefs: 0000000180012961
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, TransactionID, ObjectID) values ('%s, xrefs: 0000000180012986
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolDestroyObject$insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, TransactionID, ObjectID) values ('%s
                                                                                                            • API String ID: 568940515-1376138774
                                                                                                            • Opcode ID: 8e13d405f48f7b302af24ad907446a774c4b7ef52edc5224df55006f8ba4cb6c
                                                                                                            • Instruction ID: da6ead239e84dc7c946d79b549d6b01d5ab3196aa9b620da412b7d24315d0883
                                                                                                            • Opcode Fuzzy Hash: 8e13d405f48f7b302af24ad907446a774c4b7ef52edc5224df55006f8ba4cb6c
                                                                                                            • Instruction Fuzzy Hash: AE216532618F88C6E7A19F24E45179E73A5F7897C4F109125BA8946B98DF38C6648B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000254A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnMethodException, xrefs: 0000000180012329
                                                                                                            • insert into MethodEvents (Event,lTickCount, Application, ObjectID, ClassID, InterfaceID, Method) values ('%s', %d, '%, xrefs: 0000000180012335
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnMethodException$insert into MethodEvents (Event,lTickCount, Application, ObjectID, ClassID, InterfaceID, Method) values ('%s', %d, '%
                                                                                                            • API String ID: 568940515-907425818
                                                                                                            • Opcode ID: e16fea3e0c08b31fb57e051d6b3da153424c40196195279606264ca3c8140bd0
                                                                                                            • Instruction ID: 3f9be36bd3fa0f93f18ef6bf1cd1d9aee2ecb5820acb134136877b82ae22956b
                                                                                                            • Opcode Fuzzy Hash: e16fea3e0c08b31fb57e051d6b3da153424c40196195279606264ca3c8140bd0
                                                                                                            • Instruction Fuzzy Hash: CD214172614F84C1EBA19F24E44039A73E4F788784F508225EACD46A98DF3CC299CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000101E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID,AvailableObjs, ObjectID) values ('%s',%d, '%s', ', xrefs: 000000018001271E
                                                                                                            • OnObjPoolCreateObject, xrefs: 00000001800126F9
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolCreateObject$insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID,AvailableObjs, ObjectID) values ('%s',%d, '%s', '
                                                                                                            • API String ID: 568940515-1476401236
                                                                                                            • Opcode ID: a3ae54f26e73938a36fc7f07e263426cdf3ec8e7dbcc8850343d334fc223168e
                                                                                                            • Instruction ID: d1ef2bf8a3d64d9a6297c9b9ed058d9ee1f60e5e564e187f625c12c7c7119845
                                                                                                            • Opcode Fuzzy Hash: a3ae54f26e73938a36fc7f07e263426cdf3ec8e7dbcc8850343d334fc223168e
                                                                                                            • Instruction Fuzzy Hash: 15218136618F88C6E7A19F24E4507EA73A5F7897C4F109126FA8942B98EF3CC5588F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800010D2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnMethodCall, xrefs: 00000001800121F1
                                                                                                            • insert into MethodEvents (Event,lTickCount, Application, ObjectID, ClassID, InterfaceID, Method) values('%s',%ld, '%s, xrefs: 00000001800121FD
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnMethodCall$insert into MethodEvents (Event,lTickCount, Application, ObjectID, ClassID, InterfaceID, Method) values('%s',%ld, '%s
                                                                                                            • API String ID: 568940515-2070344209
                                                                                                            • Opcode ID: 11440191b6c39f52b78ea0b8cafeddcf170d1ce04ccf45599df742a5ead70bdd
                                                                                                            • Instruction ID: 4f23e66d81d6cb6726c7d1d7ce19cfbb37988d552ba7c00daf5a5528a049bad7
                                                                                                            • Opcode Fuzzy Hash: 11440191b6c39f52b78ea0b8cafeddcf170d1ce04ccf45599df742a5ead70bdd
                                                                                                            • Instruction Fuzzy Hash: 7C213D32618A84C2E7A1DB24E85039A73A5F78C784F508125EBCD46A98DF7CC199CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003959 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, TransactionID, ObjectID) values ('%s, xrefs: 0000000180012AB9
                                                                                                            • OnObjPoolGetFromTx, xrefs: 0000000180012AAD
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolGetFromTx$insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, TransactionID, ObjectID) values ('%s
                                                                                                            • API String ID: 568940515-2945267969
                                                                                                            • Opcode ID: 430b49b9be0368a32bf93cc093adf978a80e3607dd071513cbcbd8c082946d6a
                                                                                                            • Instruction ID: de1f61dd436bae9c383996362878c6650f01293f1b2151823bb40cf51412c0ee
                                                                                                            • Opcode Fuzzy Hash: 430b49b9be0368a32bf93cc093adf978a80e3607dd071513cbcbd8c082946d6a
                                                                                                            • Instruction Fuzzy Hash: 17214F32218F8486E7B19F28E4403DA73E5F788784F508125EACD46B98EF7CC599CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001E83 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, TransactionID, ObjectID) values ('%s, xrefs: 0000000180012E6D
                                                                                                            • OnObjPoolRecycleToTx, xrefs: 0000000180012E61
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolRecycleToTx$insert into ObjectPoolEvents (Event,lTickCount,Application, ActivityID, ClassID, TransactionID, ObjectID) values ('%s
                                                                                                            • API String ID: 568940515-2479471009
                                                                                                            • Opcode ID: 4eb3f9657b9a5166fb03732326d70b57d9de6a13a0a3f0cbcc301e8be67db625
                                                                                                            • Instruction ID: 993eadf18ec0454af6dd84cca22628d66382e6e2bead81138b916eadded2d730
                                                                                                            • Opcode Fuzzy Hash: 4eb3f9657b9a5166fb03732326d70b57d9de6a13a0a3f0cbcc301e8be67db625
                                                                                                            • Instruction Fuzzy Hash: 08212C32618F84C6E7A19F24E4513DA73E5F788784F508225FA8D46B98EF7CC599CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180004039 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into QCEvents (Event,lTickCount,Application, MsgID, WorkFlowID, RetryIndex) values ('%s',%d, '%s', '%s', '%s',, xrefs: 0000000180013769
                                                                                                            • OnQCMoveToReTryQueue, xrefs: 000000018001375D
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnQCMoveToReTryQueue$insert into QCEvents (Event,lTickCount,Application, MsgID, WorkFlowID, RetryIndex) values ('%s',%d, '%s', '%s', '%s',
                                                                                                            • API String ID: 568940515-718271210
                                                                                                            • Opcode ID: b679cdff4edd8dc00428ff262954f022bdc807fccc0fbbfc3f763d5d15014e6d
                                                                                                            • Instruction ID: f95ff318f7174fcebf591ac4c1888c44270091004bba99a8fee97362978ea66c
                                                                                                            • Opcode Fuzzy Hash: b679cdff4edd8dc00428ff262954f022bdc807fccc0fbbfc3f763d5d15014e6d
                                                                                                            • Instruction Fuzzy Hash: CF218777219B8886E7B19F24E44179E73A5F789794F108125FAC942B98DF38C5548F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180004241 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen) values ('%s', %d,'%s','%s','%, xrefs: 0000000180014DB5
                                                                                                            • OnThreadWorkEnque, xrefs: 0000000180014DA9
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadWorkEnque$insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen) values ('%s', %d,'%s','%s','%
                                                                                                            • API String ID: 568940515-4068620673
                                                                                                            • Opcode ID: 6819f2b85bc022e46c6a9e2c3a4391d6c0cdc1bd414fc2a4b3543ac59eb5abd3
                                                                                                            • Instruction ID: e442d2591b4e1fbb7bb6b77e52a520fdecd1b85637bce425b374b89c29d9f599
                                                                                                            • Opcode Fuzzy Hash: 6819f2b85bc022e46c6a9e2c3a4391d6c0cdc1bd414fc2a4b3543ac59eb5abd3
                                                                                                            • Instruction Fuzzy Hash: 5A218433214B88C6EBB18F24F45179A73A5F788784F504126FB8946B98DF38C598CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000262B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnThreadUnBind, xrefs: 0000000180014B85
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, Threadid, ApartmentID, ActivityCnt) values ('%s',%d,'%s','%, xrefs: 0000000180014B91
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadUnBind$insert into ThreadEvents (Event, lTickCount, Application, Threadid, ApartmentID, ActivityCnt) values ('%s',%d,'%s','%
                                                                                                            • API String ID: 568940515-4208297778
                                                                                                            • Opcode ID: 2464a5f23693b3150c142046e77de3fa6d31c51dfa2970a4c3bafe1d29784565
                                                                                                            • Instruction ID: 09399f59c578b30d9c6d30adc10430083ec01924008d67b147a1694f1e6431fb
                                                                                                            • Opcode Fuzzy Hash: 2464a5f23693b3150c142046e77de3fa6d31c51dfa2970a4c3bafe1d29784565
                                                                                                            • Instruction Fuzzy Hash: D5218433619F88C6E7B18F24E88139A73A5F788794F105226FA8946B98DF3CC554CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002A86 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, W2KThreadID,CallDepth) values ('%s',%d, '%s', ', xrefs: 0000000180010601
                                                                                                            • OnActivityReenter, xrefs: 00000001800105F5
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnActivityReenter$insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, W2KThreadID,CallDepth) values ('%s',%d, '%s', '
                                                                                                            • API String ID: 568940515-3709571488
                                                                                                            • Opcode ID: 05627676b7c9a2cf7617d9cbe22b47118fdf40573b9f8470c6df1da5014f656b
                                                                                                            • Instruction ID: 78f0cc794b9ee55b7c845e4e9afa01b95dfb7213d74ba59414db3102ef804c93
                                                                                                            • Opcode Fuzzy Hash: 05627676b7c9a2cf7617d9cbe22b47118fdf40573b9f8470c6df1da5014f656b
                                                                                                            • Instruction Fuzzy Hash: CF219632619F8886E7A19F24E4513DA73A5F7887C4F508126FACD46B98DF78C594CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002D33 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectEvents (Event,lTickCount,Application, ClassID,ConstructString,ObjectID) values ('%s', %d, '%s', '%s, xrefs: 00000001800131CD
                                                                                                            • OnObjectConstruct, xrefs: 00000001800131C1
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjectConstruct$insert into ObjectEvents (Event,lTickCount,Application, ClassID,ConstructString,ObjectID) values ('%s', %d, '%s', '%s
                                                                                                            • API String ID: 568940515-496007354
                                                                                                            • Opcode ID: bb6a5cfe8c4e362c5862ee29d010c014bf2751535cb67d37395d3ecf82302f27
                                                                                                            • Instruction ID: c786c7162d80ade9a826bf6b2acfd7c71de9ab817dcbbf12a182210f213e5199
                                                                                                            • Opcode Fuzzy Hash: bb6a5cfe8c4e362c5862ee29d010c014bf2751535cb67d37395d3ecf82302f27
                                                                                                            • Instruction Fuzzy Hash: D921C332618F88C2E7A19F24E44139A73A4F78D7C4F508126FADD42B58DF3CC5588B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000165E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnThreadTerminate, xrefs: 0000000180014A61
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ThreadID, W2KThreadID, ThreadCnt) values ('%s',%d,'%s','%s', xrefs: 0000000180014A6D
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadTerminate$insert into ThreadEvents (Event, lTickCount, Application, ThreadID, W2KThreadID, ThreadCnt) values ('%s',%d,'%s','%s'
                                                                                                            • API String ID: 568940515-985580777
                                                                                                            • Opcode ID: 5acb6c49ab29cc8fd85df3e4a5a385be5530cea1b8d596f581b5e56acc3b8fa7
                                                                                                            • Instruction ID: e7154439529092c71d42cb93baea0e9fab6b21b27bf777b66f45b97585d6410c
                                                                                                            • Opcode Fuzzy Hash: 5acb6c49ab29cc8fd85df3e4a5a385be5530cea1b8d596f581b5e56acc3b8fa7
                                                                                                            • Instruction Fuzzy Hash: 6E219333214B88C6E7A19F24E45139A73A5FB897C4F508126FA8947B98DF38C598CF44
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001686 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, EnteredApp,W2KThreadID) values ('%s',%d, '%s', , xrefs: 00000001800102BD
                                                                                                            • OnActivityEnter, xrefs: 00000001800102B1
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnActivityEnter$insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, EnteredApp,W2KThreadID) values ('%s',%d, '%s',
                                                                                                            • API String ID: 568940515-3060000612
                                                                                                            • Opcode ID: dec01248b6f16cfde089ccd3940ef368824bfbdbd620ba131a12bb8fd3513da5
                                                                                                            • Instruction ID: 950409b551e85ddb54d778ce05186e29c4be01136353254db6727e6b6bc5d594
                                                                                                            • Opcode Fuzzy Hash: dec01248b6f16cfde089ccd3940ef368824bfbdbd620ba131a12bb8fd3513da5
                                                                                                            • Instruction Fuzzy Hash: 25218E32618F88C1E7A19F24E45039A73A5F78D7C4F609126FACD46B98DF7CC5988B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800016EA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnResourceRecycle, xrefs: 0000000180014295
                                                                                                            • insert into ResourceEvents (Event,lTickCount,Application, ObjectID, Type, ResourceID) values ('%s',%d, '%s', '%s', '%, xrefs: 00000001800142A1
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnResourceRecycle$insert into ResourceEvents (Event,lTickCount,Application, ObjectID, Type, ResourceID) values ('%s',%d, '%s', '%s', '%
                                                                                                            • API String ID: 568940515-333054373
                                                                                                            • Opcode ID: 595982c9bb6ccb0c89daa1dd80d3a923b0ccfaa8354ae3e6f50289c4fa3e7e5a
                                                                                                            • Instruction ID: 0bd7a11024a4a9ed7a6ae40ea4202dff5e81417b29b37b5988a6c7817eae53ef
                                                                                                            • Opcode Fuzzy Hash: 595982c9bb6ccb0c89daa1dd80d3a923b0ccfaa8354ae3e6f50289c4fa3e7e5a
                                                                                                            • Instruction Fuzzy Hash: 7D218133618F88C6E7A18F24E4403DA73A5F789784F509126FA8D46B68DF38C598CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800037E2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into CRMEvents (Event,lTickCount,Application, ClerkID,CRMRecordType,RecordSize) values ('%s',%d, '%s','%s','%s, xrefs: 0000000180010E95
                                                                                                            • OnCRMAnalyze, xrefs: 0000000180010E89
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMAnalyze$insert into CRMEvents (Event,lTickCount,Application, ClerkID,CRMRecordType,RecordSize) values ('%s',%d, '%s','%s','%s
                                                                                                            • API String ID: 568940515-4049717649
                                                                                                            • Opcode ID: 580137725c62e1006e56068affdeefb0dbd2911dfc704c8c07c12fb1427fa1ba
                                                                                                            • Instruction ID: 991a67a742aeb14083a529b9a55f1f936623aa8060feff026a288a41101cec40
                                                                                                            • Opcode Fuzzy Hash: 580137725c62e1006e56068affdeefb0dbd2911dfc704c8c07c12fb1427fa1ba
                                                                                                            • Instruction Fuzzy Hash: 39218133218F8886E7A18F65E44139A73E5F788784F20812ABAC942B98DF78C558CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800039DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen) values ('%s', %d,'%s','%s','%, xrefs: 000000018001524D
                                                                                                            • OnThreadWorkPublic, xrefs: 0000000180015241
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadWorkPublic$insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen) values ('%s', %d,'%s','%s','%
                                                                                                            • API String ID: 568940515-332089187
                                                                                                            • Opcode ID: 20d3f34f009d69bdc641f7501a7b3ef192c75cbc8fcbabfce332127ed3eca364
                                                                                                            • Instruction ID: cedcf640050e2704d025170879dcc955da31259c81f255ca01121aa56935e1d3
                                                                                                            • Opcode Fuzzy Hash: 20d3f34f009d69bdc641f7501a7b3ef192c75cbc8fcbabfce332127ed3eca364
                                                                                                            • Instruction Fuzzy Hash: 30218433214F88C6E7A19F64E45139A73A5F789784F508126FAC946B98DF38C5588F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800019F1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ExceptionEvents (Event,lTickCount,Application, Code,Address,StackTrace) values ('%s',%d, '%s', '%s','%s',, xrefs: 0000000180011F91
                                                                                                            • OnExceptionUser, xrefs: 0000000180011F85
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnExceptionUser$insert into ExceptionEvents (Event,lTickCount,Application, Code,Address,StackTrace) values ('%s',%d, '%s', '%s','%s',
                                                                                                            • API String ID: 568940515-1170481596
                                                                                                            • Opcode ID: 198f330582e9f0efcdaf0aeff190c58c50b59bbc0d22d1cb2eff944b2ee39498
                                                                                                            • Instruction ID: ea309bcbd62cd068d4f6057b9ba22a318f812f538256afdae23e2d77e52f76ec
                                                                                                            • Opcode Fuzzy Hash: 198f330582e9f0efcdaf0aeff190c58c50b59bbc0d22d1cb2eff944b2ee39498
                                                                                                            • Instruction Fuzzy Hash: 7A218E32618F88C6E7A18F24E4417DA73A5F788785F50912AFA8D46B98DF38C599CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003D6E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnThreadBindToApartment, xrefs: 000000018001482D
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ThreadID, ApartmentID, ActivityCnt) values ('%s', %d,'%s',', xrefs: 0000000180014839
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadBindToApartment$insert into ThreadEvents (Event, lTickCount, Application, ThreadID, ApartmentID, ActivityCnt) values ('%s', %d,'%s','
                                                                                                            • API String ID: 568940515-2595339547
                                                                                                            • Opcode ID: 496b7c0bb215130a453c696b042103c39fb1dba55ba0e40bb4500e3f41351e18
                                                                                                            • Instruction ID: 81eb7fda94767149ed3ae85ddbb6cb374f9f6eaa9ec13f6711042a7cc7f2694d
                                                                                                            • Opcode Fuzzy Hash: 496b7c0bb215130a453c696b042103c39fb1dba55ba0e40bb4500e3f41351e18
                                                                                                            • Instruction Fuzzy Hash: 2B218433618BC8C6E7A19F24E45139E73A5F7897D4F108226BA8D46B98DF38C5548F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003DF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID, ActivityID,Timeout) values ('%s',%d, '%s', '%s',, xrefs: 0000000180012F95
                                                                                                            • OnObjPoolTimeout, xrefs: 0000000180012F89
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjPoolTimeout$insert into ObjectPoolEvents (Event,lTickCount,Application, ClassID, ActivityID,Timeout) values ('%s',%d, '%s', '%s',
                                                                                                            • API String ID: 568940515-1288383151
                                                                                                            • Opcode ID: 6c270cfcf3162ab6f3ae432ca5282d8fcdbea93e3a661f9e91abf655fc62b4b1
                                                                                                            • Instruction ID: 6b9d238564f180df2f7e715ca301041ad001e96adc0e66f5809c6b84d8df79b8
                                                                                                            • Opcode Fuzzy Hash: 6c270cfcf3162ab6f3ae432ca5282d8fcdbea93e3a661f9e91abf655fc62b4b1
                                                                                                            • Instruction Fuzzy Hash: D621C936214B8886E7A19F64F44139A73A5F7887C4F104139BACD42B98DF3CC195CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003FC6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen) values ('%s', %d,'%s','%s','%, xrefs: 0000000180014FED
                                                                                                            • OnThreadWorkPublic, xrefs: 0000000180014FE1
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadWorkPublic$insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID,QueueLen) values ('%s', %d,'%s','%s','%
                                                                                                            • API String ID: 568940515-332089187
                                                                                                            • Opcode ID: 58342ebbc9bebb6c552b0edf50470aec8bb4f0e56debaa006574aa6284cd0101
                                                                                                            • Instruction ID: 9339e4e2286a54171bff242915990c74b7b58abb58e52a2d0d7eea282e3366ba
                                                                                                            • Opcode Fuzzy Hash: 58342ebbc9bebb6c552b0edf50470aec8bb4f0e56debaa006574aa6284cd0101
                                                                                                            • Instruction Fuzzy Hash: 8721A433218F88C6E7A18F64F45139A73A5F788784F10812AFAC946B98DF78C1898B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180004197 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ObjectEvents (Event, lTickCount,Application, ContextID,ObjectId) values ('%s', %d, '%s', '%s','%s'), xrefs: 0000000180013434
                                                                                                            • OnObjectDeactivate, xrefs: 0000000180013428
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjectDeactivate$insert into ObjectEvents (Event, lTickCount,Application, ContextID,ObjectId) values ('%s', %d, '%s', '%s','%s')
                                                                                                            • API String ID: 568940515-1098266360
                                                                                                            • Opcode ID: 2f55621daeaf2a1e894dcff194a2066975ba95228daa14e38bb7333b067cea50
                                                                                                            • Instruction ID: fd099bd2739640941f6ce7c2742878e7a12eb045666ecdd55aa1ab2f45a62814
                                                                                                            • Opcode Fuzzy Hash: 2f55621daeaf2a1e894dcff194a2066975ba95228daa14e38bb7333b067cea50
                                                                                                            • Instruction Fuzzy Hash: CE218132618F8886E7A29F24E44139A73A5F7897C4F508125FACD46B98DF3CC658CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002554 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ActivityID, ApartmentID) values ('%s',%d,'%s','%s','%s'), xrefs: 0000000180014718
                                                                                                            • OnThreadAssignApartment, xrefs: 000000018001470C
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadAssignApartment$insert into ThreadEvents (Event, lTickCount, Application, ActivityID, ApartmentID) values ('%s',%d,'%s','%s','%s')
                                                                                                            • API String ID: 568940515-1713661716
                                                                                                            • Opcode ID: a5509ee17c3a26b7b5adfbd306c4c8ee28921662d631efd9af40a14717c4cb24
                                                                                                            • Instruction ID: be455bc21dbc3b3768adade1ad2908abf772a49977a903cccb82c77edfaf37f7
                                                                                                            • Opcode Fuzzy Hash: a5509ee17c3a26b7b5adfbd306c4c8ee28921662d631efd9af40a14717c4cb24
                                                                                                            • Instruction Fuzzy Hash: C9214533618F88C6E7A19F24E45039A73A5F789784F509125FADD4ABA8DF3CC6588B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000263A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnQCReceiveFail, xrefs: 0000000180013C04
                                                                                                            • insert into QCEvents (Event,lTickCount,Application, QueueID, HResult) values ('%s',%d, '%s', '%s', %d), xrefs: 0000000180013C10
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnQCReceiveFail$insert into QCEvents (Event,lTickCount,Application, QueueID, HResult) values ('%s',%d, '%s', '%s', %d)
                                                                                                            • API String ID: 568940515-3996004271
                                                                                                            • Opcode ID: 96ef90863ff15173b6899dca870bfe9313255b86101873875ff8f08b060940b0
                                                                                                            • Instruction ID: 9711163301207ccc0d43e39b4cb9a0c305ecd593364d3e68f733324e0cf8b02d
                                                                                                            • Opcode Fuzzy Hash: 96ef90863ff15173b6899dca870bfe9313255b86101873875ff8f08b060940b0
                                                                                                            • Instruction Fuzzy Hash: 28117232219B8886EBA59F24E45239A73A5F789784F109225BA8D46B98DF3CC558CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000295A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnQCMoveToDeadQueue, xrefs: 000000018001363C
                                                                                                            • insert into QCEvents (Event,lTickCount,Application, MsgID, WorkFlowID) values ('%s',%d, '%s', '%s', '%s'), xrefs: 0000000180013648
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnQCMoveToDeadQueue$insert into QCEvents (Event,lTickCount,Application, MsgID, WorkFlowID) values ('%s',%d, '%s', '%s', '%s')
                                                                                                            • API String ID: 568940515-4078454887
                                                                                                            • Opcode ID: fe9d1a070d3c30c1e872f8616ecdee61ae64fa99e7aad4a20450a47f11f21a5b
                                                                                                            • Instruction ID: 504ff3344959fbbbba581a32ea5adfb646e46ff9669d1b9825ef56d6b5d7e0ab
                                                                                                            • Opcode Fuzzy Hash: fe9d1a070d3c30c1e872f8616ecdee61ae64fa99e7aad4a20450a47f11f21a5b
                                                                                                            • Instruction Fuzzy Hash: E4214F32218F88D6E7A19F24E45139A73A5F78D784F509125FACD46B98DF3CC6988F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002D83 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnThreadWorkPrivate, xrefs: 0000000180014EC0
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID) values ('%s', %d, '%s','%s','%s'), xrefs: 0000000180014ECC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadWorkPrivate$insert into ThreadEvents (Event, lTickCount, Application, ThreadID, MsgWorkID) values ('%s', %d, '%s','%s','%s')
                                                                                                            • API String ID: 568940515-2431187931
                                                                                                            • Opcode ID: 61fe36a810e73905314e5a34235403420c58c096fe55370e44377e91a13a988e
                                                                                                            • Instruction ID: 1ee1e2f56a14d1209c93cb24140caa713d30a59ca436facfde463964aace1773
                                                                                                            • Opcode Fuzzy Hash: 61fe36a810e73905314e5a34235403420c58c096fe55370e44377e91a13a988e
                                                                                                            • Instruction Fuzzy Hash: 54216033218B88C6E7B19F24E4507AA73A5F789784F109125FA8D47BA8DF38C6598B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800010BE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, LeftApp) values ('%s',%d, '%s', '%s','%s'), xrefs: 00000001800103D4
                                                                                                            • OnActivityLeave, xrefs: 00000001800103C8
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnActivityLeave$insert into ActivityEvents (Event,lTickCount,Application, CurrentApp, LeftApp) values ('%s',%d, '%s', '%s','%s')
                                                                                                            • API String ID: 568940515-3230378109
                                                                                                            • Opcode ID: d0aae46047680ece704d7fc8e05b951985fe7086b9f06442c847b66972217ee3
                                                                                                            • Instruction ID: bfdde0a8af3e60f47ef33d2185fa869ffc34d6a85e4b89eda7b9d2376b52d2b0
                                                                                                            • Opcode Fuzzy Hash: d0aae46047680ece704d7fc8e05b951985fe7086b9f06442c847b66972217ee3
                                                                                                            • Instruction Fuzzy Hash: 07217572218F8886E7A19F24E45039A73A5F7897C4F509125BBCD46B58DF78C698CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003413 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnActivityLeaveSame, xrefs: 00000001800104D8
                                                                                                            • insert into ActivityEvents (Event,lTickCount,Application, CurrentApp,CallDepth) values ('%s',%d, '%s', '%s',%d), xrefs: 00000001800104E4
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnActivityLeaveSame$insert into ActivityEvents (Event,lTickCount,Application, CurrentApp,CallDepth) values ('%s',%d, '%s', '%s',%d)
                                                                                                            • API String ID: 568940515-2804086162
                                                                                                            • Opcode ID: ec68ffbca275e8ab3ec5ec1d714b4ac2bce04fa238fe96a4b33c9633522ec0b0
                                                                                                            • Instruction ID: de28604356d8e30ddd34e06a1e9fbb035e63d9192f9bc8b05840826549f6834a
                                                                                                            • Opcode Fuzzy Hash: ec68ffbca275e8ab3ec5ec1d714b4ac2bce04fa238fe96a4b33c9633522ec0b0
                                                                                                            • Instruction Fuzzy Hash: F011A276615F88C6EBA19F64E45039B73A5FB88784F209225BAC942B98DF78C548CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003B16 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnObjectActivate, xrefs: 00000001800130A0
                                                                                                            • insert into ObjectEvents (Event, lTickCount,Application, ContextID,ObjectId) values ('%s', %d, '%s', '%s','%s'), xrefs: 00000001800130AC
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjectActivate$insert into ObjectEvents (Event, lTickCount,Application, ContextID,ObjectId) values ('%s', %d, '%s', '%s','%s')
                                                                                                            • API String ID: 568940515-2734465557
                                                                                                            • Opcode ID: e39f5fd8e7a3d9c32d6461307f32c414c6d1c736ad58def32c8b0c8f0f0d6276
                                                                                                            • Instruction ID: c2ab53566d6c207d5eccdb63696c82551bee5bdae57d88e678e56b8a78a01b85
                                                                                                            • Opcode Fuzzy Hash: e39f5fd8e7a3d9c32d6461307f32c414c6d1c736ad58def32c8b0c8f0f0d6276
                                                                                                            • Instruction Fuzzy Hash: EF219032218F8886E7A29F25E45139A73E5F78D7C4F109125AACD42B98CF3DC658CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002130 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnThreadUnAssignApartment, xrefs: 0000000180014C88
                                                                                                            • insert into ThreadEvents (Event, lTickCount, Application, ApartmentID) values ('%s', %d,'%s','%s'), xrefs: 0000000180014C99
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnThreadUnAssignApartment$insert into ThreadEvents (Event, lTickCount, Application, ApartmentID) values ('%s', %d,'%s','%s')
                                                                                                            • API String ID: 568940515-2912879012
                                                                                                            • Opcode ID: 2f7847e6cfc3e8a8b3d65ab59a5bba68975b91746de5fbc3759c75de0a075abc
                                                                                                            • Instruction ID: 0fa31e6614cadf54f6bfb01b6134850874214f5af697d13205d685803c9f5e0e
                                                                                                            • Opcode Fuzzy Hash: 2f7847e6cfc3e8a8b3d65ab59a5bba68975b91746de5fbc3759c75de0a075abc
                                                                                                            • Instruction Fuzzy Hash: 72119673615F44C2EBA1DF64E44039A73A5F748784F108135B68D46B98DF38C258CB80
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002527 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMForget$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-3951642330
                                                                                                            • Opcode ID: e60626e79bf320a19d6361516f745da9bed0fe40524bdeae13a7fc5b0d4a63f0
                                                                                                            • Instruction ID: 3fa4e5a4e40685480c0845abf2b0da6f8911f139ebcf5fea953b5fcb344d15b7
                                                                                                            • Opcode Fuzzy Hash: e60626e79bf320a19d6361516f745da9bed0fe40524bdeae13a7fc5b0d4a63f0
                                                                                                            • Instruction Fuzzy Hash: CD11E933214E8486EBA59F24E4513DA73A5F7487C5F148229F68942B98DF3DC2488F00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000271B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnDisableCommit, xrefs: 0000000180011D64
                                                                                                            • insert into ObjectEvents (Event, lTickCount,Application, ContextID) values ('%s', %d, '%s', '%s'), xrefs: 0000000180011D75
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnDisableCommit$insert into ObjectEvents (Event, lTickCount,Application, ContextID) values ('%s', %d, '%s', '%s')
                                                                                                            • API String ID: 568940515-69541152
                                                                                                            • Opcode ID: 767ab2795d919eee1ae35a787383a8f3965709ed1341890339f274e0970db21a
                                                                                                            • Instruction ID: 385f67e9c2f3b78e5988845fd81d308ad805233b0ebffb734c2b70c6c6b7d0d3
                                                                                                            • Opcode Fuzzy Hash: 767ab2795d919eee1ae35a787383a8f3965709ed1341890339f274e0970db21a
                                                                                                            • Instruction Fuzzy Hash: 7111C833215E8486EBA59F24F4403DE73A5FB89785F148225FA8D46B98DF3CC198CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002987 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnTransactionCommit, xrefs: 0000000180015444
                                                                                                            • insert into TransactionEvents (Event,lTickCount,Application, TransactionID) values ('%s',%d,'%s','%s'), xrefs: 0000000180015455
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnTransactionCommit$insert into TransactionEvents (Event,lTickCount,Application, TransactionID) values ('%s',%d,'%s','%s')
                                                                                                            • API String ID: 568940515-2160345963
                                                                                                            • Opcode ID: 5c256bea290c3654c354180a40175c321d30ca5b987ba271fd2c65ff7e7210a5
                                                                                                            • Instruction ID: 9717343466dca40f15ffdf357bdbdcc65bb5a9c33bcefb44ea50924fdd4d1b94
                                                                                                            • Opcode Fuzzy Hash: 5c256bea290c3654c354180a40175c321d30ca5b987ba271fd2c65ff7e7210a5
                                                                                                            • Instruction Fuzzy Hash: A511B936215F84C2EBB19F64E84139A73A5F74C789F108525F7C946B98DF3CC2988B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002CC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into TransactionEvents (Event,lTickCount,Application, TransactionID) values ('%s',%d,'%s','%s'), xrefs: 0000000180015355
                                                                                                            • OnTransactionAborted, xrefs: 0000000180015344
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnTransactionAborted$insert into TransactionEvents (Event,lTickCount,Application, TransactionID) values ('%s',%d,'%s','%s')
                                                                                                            • API String ID: 568940515-2664602245
                                                                                                            • Opcode ID: 6f64726dfd4ed13d3f5f83ecdeb2d467e14b615122fdb0b4d28d69098a0f9b57
                                                                                                            • Instruction ID: 8235d3252229334020a3abd787201e25cc8a2a2b132ded2da5a82e0d07bc13a0
                                                                                                            • Opcode Fuzzy Hash: 6f64726dfd4ed13d3f5f83ecdeb2d467e14b615122fdb0b4d28d69098a0f9b57
                                                                                                            • Instruction Fuzzy Hash: 2D119673215E84C2EBB19F24E44139D73A5F7487C9F148625B6C946B98DF78C2588B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002E69 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMRelease$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-3804684500
                                                                                                            • Opcode ID: 64d34a78b7a72807d58a02e91b32bfcaabca83b9ec706b5e79855d93e649764e
                                                                                                            • Instruction ID: 8377cc0ac4692585deb518731ad7fe1bf7c747e1f8d07fe7092c9e2a2bb19e39
                                                                                                            • Opcode Fuzzy Hash: 64d34a78b7a72807d58a02e91b32bfcaabca83b9ec706b5e79855d93e649764e
                                                                                                            • Instruction Fuzzy Hash: 5B11B632619F8486EBA59F64E4813DA73A5FB58785F508225FA8D46B98DF38C158CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002F31 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnObjectDestroy$insert into ObjectEvents (Event,lTickCount,Application,ContextID) values ('%s',%d, '%s', '%s')
                                                                                                            • API String ID: 568940515-163444345
                                                                                                            • Opcode ID: d74c2e4b65ce51b1a4b399231e222db17a7af5b3036b4841027c4c94e2b8c408
                                                                                                            • Instruction ID: 4098fa5bb8165a032edabe81162f0736ab1ddb0b13c47b195b663661ba5ba04e
                                                                                                            • Opcode Fuzzy Hash: d74c2e4b65ce51b1a4b399231e222db17a7af5b3036b4841027c4c94e2b8c408
                                                                                                            • Instruction Fuzzy Hash: 5411C833615F8486EBA19F24E4413DA73A5FB88BD4F508225FA8D46B98DF3CC5588B00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000114F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ActivityEvents (Event,lTickCount,Application, ActivityID) values ('%s',%d, '%s', '%s'), xrefs: 00000001800101A1
                                                                                                            • OnActivityDestroy, xrefs: 0000000180010190
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnActivityDestroy$insert into ActivityEvents (Event,lTickCount,Application, ActivityID) values ('%s',%d, '%s', '%s')
                                                                                                            • API String ID: 568940515-2869989399
                                                                                                            • Opcode ID: 75ffb78ecda83c128602cce42014ea137ae358cb80e16981610e42bc7f350e09
                                                                                                            • Instruction ID: cbf02c2c17276676b1d3f8ca491beecf59c9ec96ef77c5d6976c9a020689283e
                                                                                                            • Opcode Fuzzy Hash: 75ffb78ecda83c128602cce42014ea137ae358cb80e16981610e42bc7f350e09
                                                                                                            • Instruction Fuzzy Hash: 8511B932215E4492EBA19F64E85039A73E5F748784F108125FACD46A98DF7CC298CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001253 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnSetComplete, xrefs: 00000001800145F8
                                                                                                            • insert into ObjectEvents (Event, lTickCount,Application, ContextID) values ('%s', %d, '%s', '%s'), xrefs: 0000000180014609
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnSetComplete$insert into ObjectEvents (Event, lTickCount,Application, ContextID) values ('%s', %d, '%s', '%s')
                                                                                                            • API String ID: 568940515-60551652
                                                                                                            • Opcode ID: aa5842c92eee61220c420e5c04cef4e9d369749c6a9c2be0d4dfcdde33947342
                                                                                                            • Instruction ID: a57a81bc16eeceaab1d854d6250dd0061007662005fe025e6a296a325e1f71b2
                                                                                                            • Opcode Fuzzy Hash: aa5842c92eee61220c420e5c04cef4e9d369749c6a9c2be0d4dfcdde33947342
                                                                                                            • Instruction Fuzzy Hash: 2E11B633215F84C6EBA1DF24E49039A73A5FB49788F148225BA8D46A98DF3CC658CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800014E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnSetAbort$insert into ObjectEvents (Event, lTickCount,Application, ContextID) values ('%s', %d, '%s', '%s')
                                                                                                            • API String ID: 568940515-2606279420
                                                                                                            • Opcode ID: 3963cee9fd0c18f9cf69ccff592ee908e659f3118336ce94c95190d13a48a9fb
                                                                                                            • Instruction ID: f1e6d132cf8994c6677a4d103b3682cd600291ede4d45ff91218797acb79f48f
                                                                                                            • Opcode Fuzzy Hash: 3963cee9fd0c18f9cf69ccff592ee908e659f3118336ce94c95190d13a48a9fb
                                                                                                            • Instruction Fuzzy Hash: A0118673215F84C7EBA1DF64E49139A73A5FB48784F148225FA8D4AA98DF3CC5988B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000178A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMAbort$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-760093864
                                                                                                            • Opcode ID: 569315c4b3e79cf59e588ab66d2c60bf6aef98764b0ef4eec0c2a53ca86209fe
                                                                                                            • Instruction ID: b3f2fab263933ad2641fc5e75ec81498ec1449e262f284cef18ee0be1c229f8d
                                                                                                            • Opcode Fuzzy Hash: 569315c4b3e79cf59e588ab66d2c60bf6aef98764b0ef4eec0c2a53ca86209fe
                                                                                                            • Instruction Fuzzy Hash: 4111B632215F8882EBA1DF64F4513DA73A5FB4D784F108225BACD46B98DF7CC5588B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800017D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • insert into ActivityEvents (Event,lTickCount,Application, ActivityID) values ('%s',%d, '%s', '%s'), xrefs: 00000001800100A1
                                                                                                            • OnActivityCreate, xrefs: 0000000180010090
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnActivityCreate$insert into ActivityEvents (Event,lTickCount,Application, ActivityID) values ('%s',%d, '%s', '%s')
                                                                                                            • API String ID: 568940515-2031687629
                                                                                                            • Opcode ID: 7f70134c994a1c758c397afd5542241a838f0ef57a8b48c32f36c9a2ab5fd577
                                                                                                            • Instruction ID: a409286f7f564e30ffdd5345816d34ea62f14651f19741d91c7d685555df5488
                                                                                                            • Opcode Fuzzy Hash: 7f70134c994a1c758c397afd5542241a838f0ef57a8b48c32f36c9a2ab5fd577
                                                                                                            • Instruction Fuzzy Hash: 2A11B932215F8486EBB29F64E45039973A5F74C7C4F108225B6CD46A98DF7DC698CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018000193D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            • OnEnableCommit, xrefs: 0000000180011E64
                                                                                                            • insert into ObjectEvents (Event, lTickCount,Application, ContextID) values ('%s', %d, '%s', '%s'), xrefs: 0000000180011E75
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnEnableCommit$insert into ObjectEvents (Event, lTickCount,Application, ContextID) values ('%s', %d, '%s', '%s')
                                                                                                            • API String ID: 568940515-302487306
                                                                                                            • Opcode ID: 182bc7cda789ca8c3faa86859b05a30d6869045ee2958c1f807ec3697621e59c
                                                                                                            • Instruction ID: df5d667862c45f8a2727df9fd1d6c360cac48dd7a718246c86e31ac0360e10d9
                                                                                                            • Opcode Fuzzy Hash: 182bc7cda789ca8c3faa86859b05a30d6869045ee2958c1f807ec3697621e59c
                                                                                                            • Instruction Fuzzy Hash: FA11C833215F8486EBA59F64E4403DA73E5FB48785F148225FA8D46B98DF3CC698CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003AC6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMCommit$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-1043277395
                                                                                                            • Opcode ID: 0f8bb2f1e7dfde935065a6277982523e9ad6849cd5ee2d27be8994ad21ea8e05
                                                                                                            • Instruction ID: 0c507632e10b13ffdf4faf7abbb22cfe6954edbeebbd94063775bb7e1d39ee6d
                                                                                                            • Opcode Fuzzy Hash: 0f8bb2f1e7dfde935065a6277982523e9ad6849cd5ee2d27be8994ad21ea8e05
                                                                                                            • Instruction Fuzzy Hash: CE11E632615E8886EBA59F64F4413DE73E5FB49785F108225FB8982B88DF38C1988B00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003CDD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMPrepare$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-584695070
                                                                                                            • Opcode ID: f80a523d85fe81e914a895b26a848af4946ae27eb6602e1700d4ba7de092805a
                                                                                                            • Instruction ID: 0e9632051c4a2f0cd914d7d354f1c5be3a420d11cf32425b78592e57edf7f8fd
                                                                                                            • Opcode Fuzzy Hash: f80a523d85fe81e914a895b26a848af4946ae27eb6602e1700d4ba7de092805a
                                                                                                            • Instruction Fuzzy Hash: 0911B232615E8886EBA59F24E4413DA73A5FB487C5F108225FA8946BD8DF38C698CB40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001E06 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMForce$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-1750565757
                                                                                                            • Opcode ID: 1f864b2d1d5b8dc9eacf37058ec833121df2da06d4ed65822be09b7d6c529739
                                                                                                            • Instruction ID: 4850a8e6d27f147832c04269f6c95af86b355c3396b3031c19c9c0f2f48c3edb
                                                                                                            • Opcode Fuzzy Hash: 1f864b2d1d5b8dc9eacf37058ec833121df2da06d4ed65822be09b7d6c529739
                                                                                                            • Instruction Fuzzy Hash: 6E11E633615E84C6EBA59F24E4413DA73A5FB887C5F508225FA8E46B98DF38C248CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001E8D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMDone$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-2194791868
                                                                                                            • Opcode ID: d3cafbf4a7b4d542289830c4bc932e2ee84a397ca6362c1ddfc40700aa7c8ed9
                                                                                                            • Instruction ID: 5a704b42ce3f89225bfd4383047a164279a7f0fa3b025f4939a2b916d122c46a
                                                                                                            • Opcode Fuzzy Hash: d3cafbf4a7b4d542289830c4bc932e2ee84a397ca6362c1ddfc40700aa7c8ed9
                                                                                                            • Instruction Fuzzy Hash: 0411E632214E8486EBA59F24E4417DA73A4FB48BC5F108225FAC942B98DF38C2488F00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001FC3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMIndoubt$insert into CRMEvents (Event,lTickCount,Application, ClerkID) values ('%s',%d, '%s','%s')
                                                                                                            • API String ID: 568940515-1258298828
                                                                                                            • Opcode ID: 0bfbfc788f53373d72b49f845cbc12746ce4f40f09c2d301876e732f5a819fc5
                                                                                                            • Instruction ID: e4c582c18b98dc66dedafda414247ea7c061563b7d720787eb33f56e918a7522
                                                                                                            • Opcode Fuzzy Hash: 0bfbfc788f53373d72b49f845cbc12746ce4f40f09c2d301876e732f5a819fc5
                                                                                                            • Instruction Fuzzy Hash: 9911E632218E8486EBA59F24E4413DA73A4FB487C5F148225FA8942BD8DF38C2488F40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 00000001800020B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnAppActivation$insert into AppEvents values ('%s',%d,'%s')
                                                                                                            • API String ID: 568940515-1260590204
                                                                                                            • Opcode ID: 27db5b107c338b541e1cb38c7bec87e88935ab226e28acbbcd2a60ce7e830a2f
                                                                                                            • Instruction ID: 426dbe18cb174690ff9a8ca9d8219d6f801889a961de61be49c3c8bf0b703be6
                                                                                                            • Opcode Fuzzy Hash: 27db5b107c338b541e1cb38c7bec87e88935ab226e28acbbcd2a60ce7e830a2f
                                                                                                            • Instruction Fuzzy Hash: 3311CB33615E4486EBB19F74E4403997395FB4C7C4F609225B6CD86B98DF7CC2488B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180002522 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMRecoveryStart$insert into CRMEvents (Event,lTickCount,Application) values ('%s',%d, '%s')
                                                                                                            • API String ID: 568940515-75798316
                                                                                                            • Opcode ID: 68b709e33cc0078d043f4175b8425b948cc5cf5d9a9328d1183ff76a61925e5c
                                                                                                            • Instruction ID: 70560a2c255440c916ca8c7d6a367db52c73ff26c47c27e5a3cfc9cc437401fd
                                                                                                            • Opcode Fuzzy Hash: 68b709e33cc0078d043f4175b8425b948cc5cf5d9a9328d1183ff76a61925e5c
                                                                                                            • Instruction Fuzzy Hash: D1110873215E8486EBB59F24E4513D973A4FB4CBC5F448225BA8C82A84DF3CC248CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003125 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnAppShutdown$insert into AppEvents values ('%s',%d,'%s')
                                                                                                            • API String ID: 568940515-3950082049
                                                                                                            • Opcode ID: 70b7392a93bfa9bcbe0c8ad0f2eed45cc8506653b9139499fb0cbeec1f66b058
                                                                                                            • Instruction ID: 18194b4bcfd8e8097239625e0770ae732806e18b80e24091eef4e52af7486459
                                                                                                            • Opcode Fuzzy Hash: 70b7392a93bfa9bcbe0c8ad0f2eed45cc8506653b9139499fb0cbeec1f66b058
                                                                                                            • Instruction Fuzzy Hash: AA11B677225E8487EBA19F34E8503A973A5F74C784F508225BACD86A98DF78C2488B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180003FBC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMCheckpoint$insert into CRMEvents (Event,lTickCount,Application) values ('%s',%d, '%s')
                                                                                                            • API String ID: 568940515-3375518454
                                                                                                            • Opcode ID: c5d336df134598c6ff0b34eae346a728187688f1ba14bf0ac37a165e18b11b43
                                                                                                            • Instruction ID: 069f9e26e0705209d969ceb22cbf4ea072219d5a97689048315cb2766e6b2eb5
                                                                                                            • Opcode Fuzzy Hash: c5d336df134598c6ff0b34eae346a728187688f1ba14bf0ac37a165e18b11b43
                                                                                                            • Instruction Fuzzy Hash: A611C473615E8486EBB59F34E8413D973E5FB4C785F509225BA8D86A88DF3CC2888B40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 0000000180001FC8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: #111
                                                                                                            • String ID: OnCRMRecoveryDone$insert into CRMEvents (Event,lTickCount,Application) values ('%s',%d, '%s')
                                                                                                            • API String ID: 568940515-1293890619
                                                                                                            • Opcode ID: 07dcdb08e791c62e73451d6ba45d5b80f3ceafdd5ebc13f0524dc8756c309aca
                                                                                                            • Instruction ID: 200894bab9678c3c33c6ad9421a07055e36fc0f0e01acac55e89b91b68559a99
                                                                                                            • Opcode Fuzzy Hash: 07dcdb08e791c62e73451d6ba45d5b80f3ceafdd5ebc13f0524dc8756c309aca
                                                                                                            • Instruction Fuzzy Hash: 7311B273615E8486EBA59F24E4513DD73E5FB48B85F408225BADD86A88DF38C288CF40
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018001972C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Strings
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ExceptionFileHeaderRaise
                                                                                                            • String ID: csm
                                                                                                            • API String ID: 2573137834-1018135373
                                                                                                            • Opcode ID: acfe5d94f6ba9cd2213749e718d5a6ef7cec6f466f7639d2b5b7223949d9aa71
                                                                                                            • Instruction ID: e1e513b0c9dee84b15a2e153cc7546f0c0856458f42a1ed4c2ba83f2c2ef87f6
                                                                                                            • Opcode Fuzzy Hash: acfe5d94f6ba9cd2213749e718d5a6ef7cec6f466f7639d2b5b7223949d9aa71
                                                                                                            • Instruction Fuzzy Hash: 6E114C32219F4882EB628F15E544399B7E5FB88BD4F188221EF8C077A4DF38C655CB00
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%

                                                                                                            Function 000000018002B8F8 Relevance: 5.1, APIs: 4, Instructions: 84COMMON
                                                                                                            Download Yara Rule
                                                                                                            APIs
                                                                                                            Memory Dump Source
                                                                                                            • Source File: 00000005.00000002.427308986.000000018000A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                            • Associated: 00000005.00000002.427264000.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427268244.0000000180001000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427275505.0000000180007000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427459783.0000000180088000.00000020.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427466062.000000018008C000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427620068.00000001800B1000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427626725.00000001800B5000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427633290.00000001800BB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            • Associated: 00000005.00000002.427637946.00000001800BE000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                            Joe Sandbox IDA Plugin
                                                                                                            • Snapshot File: hcaresult_5_2_180000000_regsvr32.jbxd
                                                                                                            Similarity
                                                                                                            • API ID: ErrorLast
                                                                                                            • String ID:
                                                                                                            • API String ID: 1452528299-0
                                                                                                            • Opcode ID: 421691e25b43f44ab439ed21e195d58ebcd6b33419ffa0696bea1dd828676f4f
                                                                                                            • Instruction ID: b10cf46bfbc3b5396cc97692c65f088740ee15f72a934e1b74a0b7d77b01d302
                                                                                                            • Opcode Fuzzy Hash: 421691e25b43f44ab439ed21e195d58ebcd6b33419ffa0696bea1dd828676f4f
                                                                                                            • Instruction Fuzzy Hash: 5C21A132614A88C7EB928F22F45439977A0F788BC4F048125FB9947B99DF78C6A9C740
                                                                                                            Uniqueness

                                                                                                            Uniqueness Score: -1.00%