Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
cnaniAxghZ.exe

Overview

General Information

Sample name:cnaniAxghZ.exe
renamed because original name is a hash value
Original sample name:9993b780d61a1d757de704d2b6459cbac20803e5e2a2374cbea719aaadbb1344.exe
Analysis ID:1466891
MD5:0f85ff8e8caa7715b1ed7243ebbfcf9a
SHA1:5a600b6b969e4071d37936acf40cd3e2ba934262
SHA256:9993b780d61a1d757de704d2b6459cbac20803e5e2a2374cbea719aaadbb1344
Tags:exeRemcosRAT
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Remcos
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Drops VBS files to the startup folder
Installs a global keyboard hook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to execute programs as a different user
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
OS version to string mapping found (often used in BOTs)
One or more processes crash
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Uncommon Svchost Parent Process
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • cnaniAxghZ.exe (PID: 7264 cmdline: "C:\Users\user\Desktop\cnaniAxghZ.exe" MD5: 0F85FF8E8CAA7715B1ED7243EBBFCF9A)
    • name.exe (PID: 8048 cmdline: "C:\Users\user\Desktop\cnaniAxghZ.exe" MD5: 60C09330C233F3B7A6759B8A719245CA)
      • svchost.exe (PID: 8084 cmdline: "C:\Users\user\Desktop\cnaniAxghZ.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
        • svchost.exe (PID: 5428 cmdline: C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\ncqkhweaghcgworcchyfyhlbjpqn" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
        • svchost.exe (PID: 2080 cmdline: C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\qwvdipptuputyufolskgjmgkrwiwkdi" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
        • svchost.exe (PID: 6924 cmdline: C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\aybv" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
        • WerFault.exe (PID: 6548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8084 -s 1288 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "07.175.229.139:8087:0", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-TLPQMO", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.2877207597.0000000003000000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
        00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
        • 0x6c4a8:$a1: Remcos restarted by watchdog!
        • 0x6ca20:$a3: %02i:%02i:%02i:%03i
        00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
        • 0x664fc:$str_a1: C:\Windows\System32\cmd.exe
        • 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
        • 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
        • 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
        • 0x6656c:$str_b2: Executing file:
        • 0x675ec:$str_b3: GetDirectListeningPort
        • 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
        • 0x67118:$str_b7: \update.vbs
        • 0x66594:$str_b9: Downloaded file:
        • 0x66580:$str_b10: Downloading file:
        • 0x66624:$str_b12: Failed to upload file:
        • 0x675b4:$str_b13: StartForward
        • 0x675d4:$str_b14: StopForward
        • 0x67070:$str_b15: fso.DeleteFile "
        • 0x67004:$str_b16: On Error Resume Next
        • 0x670a0:$str_b17: fso.DeleteFolder "
        • 0x66614:$str_b18: Uploaded file:
        • 0x665d4:$str_b19: Unable to delete:
        • 0x67038:$str_b20: while fso.FileExists("
        • 0x66ab1:$str_c0: [Firefox StoredLogins not found]
        Click to see the 15 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        6.2.svchost.exe.400000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
          6.2.svchost.exe.400000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
            6.2.svchost.exe.400000.0.unpackWindows_Trojan_Remcos_b296e965unknownunknown
            • 0x6aaa8:$a1: Remcos restarted by watchdog!
            • 0x6b020:$a3: %02i:%02i:%02i:%03i
            6.2.svchost.exe.400000.0.unpackREMCOS_RAT_variantsunknownunknown
            • 0x64afc:$str_a1: C:\Windows\System32\cmd.exe
            • 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
            • 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
            • 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
            • 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
            • 0x64b6c:$str_b2: Executing file:
            • 0x65bec:$str_b3: GetDirectListeningPort
            • 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
            • 0x65718:$str_b7: \update.vbs
            • 0x64b94:$str_b9: Downloaded file:
            • 0x64b80:$str_b10: Downloading file:
            • 0x64c24:$str_b12: Failed to upload file:
            • 0x65bb4:$str_b13: StartForward
            • 0x65bd4:$str_b14: StopForward
            • 0x65670:$str_b15: fso.DeleteFile "
            • 0x65604:$str_b16: On Error Resume Next
            • 0x656a0:$str_b17: fso.DeleteFolder "
            • 0x64c14:$str_b18: Uploaded file:
            • 0x64bd4:$str_b19: Unable to delete:
            • 0x65638:$str_b20: while fso.FileExists("
            • 0x650b1:$str_c0: [Firefox StoredLogins not found]
            6.2.svchost.exe.400000.0.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
            • 0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
            • 0x6497c:$s1: CoGetObject
            • 0x64990:$s1: CoGetObject
            • 0x649ac:$s1: CoGetObject
            • 0x6e938:$s1: CoGetObject
            • 0x6493c:$s2: Elevation:Administrator!new:
            Click to see the 15 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\cnaniAxghZ.exe", CommandLine: "C:\Users\user\Desktop\cnaniAxghZ.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\cnaniAxghZ.exe", ParentImage: C:\Users\user\AppData\Local\directory\name.exe, ParentProcessId: 8048, ParentProcessName: name.exe, ProcessCommandLine: "C:\Users\user\Desktop\cnaniAxghZ.exe", ProcessId: 8084, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\cnaniAxghZ.exe", CommandLine: "C:\Users\user\Desktop\cnaniAxghZ.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\cnaniAxghZ.exe", ParentImage: C:\Users\user\AppData\Local\directory\name.exe, ParentProcessId: 8048, ParentProcessName: name.exe, ProcessCommandLine: "C:\Users\user\Desktop\cnaniAxghZ.exe", ProcessId: 8084, ProcessName: svchost.exe

            Data Obfuscation

            barindex
            Sigma detected: Drops script at startup location
            Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\directory\name.exe, ProcessId: 8048, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

            Stealing of Sensitive Information

            barindex
            Sigma detected: Remcos
            Source: Registry Key setAuthor: Joe Security: Data: Details: FD E0 AA CE 83 3E D1 AD 94 4C FF 2B B4 25 F6 66 78 82 70 9F 1D 88 26 A8 A0 4D 75 25 EC 27 5B AA 90 6E 4F E8 37 8C 06 EA 0D F8 59 23 AC FC 80 13 BC D5 5F 0E E0 45 ED 48 4F EA 2F FF 08 FD 32 83 , EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 8084, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-TLPQMO\exepath

            Snort Signatures

            Timestamp:07/03/24-14:50:54.905973
            SID:2032776
            Source Port:49737
            Destination Port:8087
            Protocol:TCP
            Classtype:A Network Trojan was detected
            Timestamp:07/03/24-14:50:55.983200
            SID:2032777
            Source Port:8087
            Destination Port:49737
            Protocol:TCP
            Classtype:A Network Trojan was detected

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: cnaniAxghZ.exeAvira: detected
            Found malware configuration
            Source: 00000006.00000002.2877207597.0000000003000000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "07.175.229.139:8087:0", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-TLPQMO", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
            Multi AV Scanner detection for submitted file
            Source: cnaniAxghZ.exeReversingLabs: Detection: 79%
            Yara detected Remcos RAT
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.2877207597.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: name.exe PID: 8048, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTR
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: cnaniAxghZ.exeJoe Sandbox ML: detected
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,6_2_00433837
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData,7_2_00404423
            Source: name.exe, 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_2b0e0a7b-1

            Exploits

            barindex
            Yara detected UAC Bypass using CMSTP
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: name.exe PID: 8048, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTR

            Privilege Escalation

            barindex
            Contains functionality to bypass UAC (CMSTPLUA)
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004074FD _wcslen,CoGetObject,6_2_004074FD
            Source: cnaniAxghZ.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: wntdll.pdbUGP source: name.exe, 00000005.00000003.2819399918.0000000004030000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2820079168.00000000041D0000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: name.exe, 00000005.00000003.2819399918.0000000004030000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2820079168.00000000041D0000.00000004.00001000.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00074696 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00074696
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007C93C FindFirstFileW,FindClose,0_2_0007C93C
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0007C9C7
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0007F200
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0007F35D
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0007F65E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00073A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00073A2B
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00073D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00073D4E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0007BF27
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00104696 GetFileAttributesW,FindFirstFileW,FindClose,5_2_00104696
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010C93C FindFirstFileW,FindClose,5_2_0010C93C
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,5_2_0010C9C7
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,5_2_0010F200
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,5_2_0010F35D
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,5_2_0010F65E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00103A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,5_2_00103A2B
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00103D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,5_2_00103D4E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,5_2_0010BF27
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,6_2_00409253
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,6_2_0041C291
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,6_2_0040C34D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,6_2_00409665
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,6_2_0040880C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040783C FindFirstFileW,FindNextFileW,6_2_0040783C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,6_2_00419AF5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,6_2_0040BB30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,6_2_0040BD37
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040AE51 FindFirstFileW,FindNextFileW,7_2_0040AE51
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,6_2_00407C97

            Networking

            barindex
            Snort IDS alert for network traffic
            Source: TrafficSnort IDS: 2032776 ET TROJAN Remcos 3.x Unencrypted Checkin 192.168.2.4:49737 -> 107.175.229.139:8087
            Source: TrafficSnort IDS: 2032777 ET TROJAN Remcos 3.x Unencrypted Server Response 107.175.229.139:8087 -> 192.168.2.4:49737
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 107.175.229.139 8087Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 178.237.33.50 80Jump to behavior
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: 07.175.229.139
            Source: global trafficTCP traffic: 192.168.2.4:49737 -> 107.175.229.139:8087
            Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
            Source: Joe Sandbox ViewIP Address: 107.175.229.139 107.175.229.139
            Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
            Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
            Source: Joe Sandbox ViewASN Name: ATOM86-ASATOM86NL ATOM86-ASATOM86NL
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.229.139
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000825E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_000825E2
            Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
            Source: svchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
            Source: svchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
            Source: svchost.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
            Source: svchost.exe, 00000007.00000003.2864837706.0000000003144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
            Source: svchost.exe, 00000007.00000003.2864837706.0000000003144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
            Source: bhv5230.tmp.7.drString found in binary or memory: pop-lva1.www.linkedin.com equals www.linkedin.com (Linkedin)
            Source: bhv5230.tmp.7.drString found in binary or memory: pop-lva1.www.linkedin.com0 equals www.linkedin.com (Linkedin)
            Source: svchost.exe, 00000007.00000003.2868404025.0000000003144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: tps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
            Source: svchost.exe, 00000007.00000003.2868404025.0000000003144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: tps://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
            Source: svchost.exe, 00000006.00000002.2877948678.00000000050C0000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
            Source: svchost.exe, 00000006.00000002.2877948678.00000000050C0000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
            Source: global trafficDNS traffic detected: DNS query: geoplugin.net
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0?
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
            Source: bhv5230.tmp.7.drString found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
            Source: svchost.exe, 00000006.00000002.2877479755.0000000003077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2877334638.0000000003068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.2840816406.0000000003068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.2841755060.0000000003068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2877524808.000000000308A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.2839396466.0000000003068000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
            Source: name.exe, 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
            Source: svchost.exe, 00000006.00000002.2877479755.0000000003077000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpSystem32
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0:
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0H
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0I
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocsp.digicert.com0Q
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocsp.msocsp.com0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocsp.msocsp.com0S
            Source: bhv5230.tmp.7.drString found in binary or memory: http://ocspx.digicert.com0E
            Source: bhv5230.tmp.7.drString found in binary or memory: http://www.digicert.com/CPS0
            Source: bhv5230.tmp.7.drString found in binary or memory: http://www.digicert.com/CPS0~
            Source: svchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
            Source: svchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
            Source: svchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
            Source: svchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
            Source: bhv5230.tmp.7.drString found in binary or memory: http://www.msftconnecttest.com/connecttest.txt?n=1696334965379
            Source: svchost.exe, 00000007.00000002.2868756077.00000000009B3000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
            Source: svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
            Source: bhv5230.tmp.7.drString found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437
            Source: bhv5230.tmp.7.drString found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d
            Source: bhv5230.tmp.7.drString found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03
            Source: bhv5230.tmp.7.drString found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7
            Source: bhv5230.tmp.7.drString found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5
            Source: bhv5230.tmp.7.drString found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742
            Source: bhv5230.tmp.7.drString found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc
            Source: bhv5230.tmp.7.drString found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d
            Source: bhv5230.tmp.7.drString found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W
            Source: bhv5230.tmp.7.drString found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326
            Source: bhv5230.tmp.7.drString found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68
            Source: bhv5230.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
            Source: bhv5230.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
            Source: bhv5230.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
            Source: bhv5230.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
            Source: bhv5230.tmp.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
            Source: bhv5230.tmp.7.drString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
            Source: bhv5230.tmp.7.drString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
            Source: bhv5230.tmp.7.drString found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
            Source: bhv5230.tmp.7.drString found in binary or memory: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpX
            Source: bhv5230.tmp.7.drString found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
            Source: bhv5230.tmp.7.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
            Source: bhv5230.tmp.7.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr
            Source: bhv5230.tmp.7.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr
            Source: bhv5230.tmp.7.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?99bdaa7641aea1439604d0afe8971477
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?bc7d158a1b0c0bcddb88a222b6122bda
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?4be9f57fdbd89d63c136fa90032d1d91
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?e5772e13592c9d33c9159aed24f891a7
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?a6aceac28fb5ae421a73cab7cdd76bd8
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?b57fe5cd49060a950d25a1d237496815
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?2f6c563d6db8702d4f61cfc28e14d6ba
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?3dacce210479f0b4d47ed33c21160712
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?7e0e9c3a9f02f17275e789accf11532b
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?81f59f7d566abbd2077a5b6cdfd04c7b
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?3c5bdbf226e2549812723f51b8fe2023
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?c50299ad5b45bb3d4c7a57024998a291
            Source: bhv5230.tmp.7.drString found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
            Source: bhv5230.tmp.7.drString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: bhv5230.tmp.7.drString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: svchost.exe, 00000007.00000003.2868404025.0000000003144000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv
            Source: bhv5230.tmp.7.drString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: bhv5230.tmp.7.drString found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3
            Source: bhv5230.tmp.7.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae
            Source: svchost.exeString found in binary or memory: https://login.yahoo.com/config/login
            Source: bhv5230.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_sKiljltKC1Ne_Y3fl1HuHQ2.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qo
            Source: bhv5230.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
            Source: bhv5230.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://maps.windows.com/windows-app-web-link
            Source: bhv5230.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
            Source: bhv5230.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=27ff908e89d7b6264fde
            Source: bhv5230.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=586ba6
            Source: bhv5230.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=7ccb04
            Source: bhv5230.tmp.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=b1ed69
            Source: bhv5230.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d
            Source: bhv5230.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad
            Source: bhv5230.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8
            Source: bhv5230.tmp.7.drString found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-0debb885be07c402c948.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ec3581b6c9e6e9985aa7.chunk.v7.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.9ba2d4c9e339ba497e10.chunk.v7.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-1652fd8b358d589e6ec0.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7.j
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.d918c7fc33e22b41b936.chunk.v7.c
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
            Source: bhv5230.tmp.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
            Source: bhv5230.tmp.7.drString found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993
            Source: bhv5230.tmp.7.drString found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51
            Source: bhv5230.tmp.7.drString found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2
            Source: bhv5230.tmp.7.drString found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59
            Source: bhv5230.tmp.7.drString found in binary or memory: https://www.digicert.com/CPS0
            Source: svchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
            Source: svchost.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
            Source: bhv5230.tmp.7.drString found in binary or memory: https://www.office.com/

            Key, Mouse, Clipboard, Microphone and Screen Capturing

            barindex
            Contains functionality to register a low level keyboard hook
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,000000006_2_0040A2B8
            Installs a global keyboard hook
            Source: C:\Windows\SysWOW64\svchost.exeWindows user hook set: 0 keyboard low level C:\Windows\SysWOW64\svchost.exeJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0008425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0008425A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00084458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00084458
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00114458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,5_2_00114458
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,6_2_004168C1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,7_2_0040987A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,7_2_004098E2
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0008425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0008425A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00070219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00070219
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0009CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0009CDAC
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0012CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,5_2_0012CDAC

            E-Banking Fraud

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.2877207597.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: name.exe PID: 8048, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTR

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Contains functionalty to change the wallpaper
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0041C9E2 SystemParametersInfoW,6_2_0041C9E2

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
            Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
            Source: Process Memory Space: name.exe PID: 8048, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
            Binary is likely a compiled AutoIt script file
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: This is a third-party compiled AutoIt script.0_2_00013B4C
            Source: cnaniAxghZ.exeString found in binary or memory: This is a third-party compiled AutoIt script.
            Source: cnaniAxghZ.exe, 00000000.00000000.1620231758.00000000000C5000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_2bb9372d-e
            Source: cnaniAxghZ.exe, 00000000.00000000.1620231758.00000000000C5000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_4c7fb676-b
            Source: cnaniAxghZ.exe, 00000000.00000003.2795789078.0000000003CA5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_4522a80f-f
            Source: cnaniAxghZ.exe, 00000000.00000003.2795789078.0000000003CA5000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_1302d4fb-d
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: This is a third-party compiled AutoIt script.5_2_000A3B4C
            Source: name.exeString found in binary or memory: This is a third-party compiled AutoIt script.
            Source: name.exe, 00000005.00000000.2809555856.0000000000155000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_37850323-c
            Source: name.exe, 00000005.00000000.2809555856.0000000000155000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_26da15f7-9
            Source: cnaniAxghZ.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_7b96de99-6
            Source: cnaniAxghZ.exeString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_96ed0e6b-8
            Source: name.exe.0.drString found in binary or memory: This is a third-party compiled AutoIt script.memstr_2c2517af-6
            Source: name.exe.0.drString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_03223356-2
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeProcess Stats: CPU usage > 49%
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,6_2_004180EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,7_2_0040DD85
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00401806 NtdllDefWindowProc_W,7_2_00401806
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004018C0 NtdllDefWindowProc_W,7_2_004018C0
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00074021: CreateFileW,DeviceIoControl,CloseHandle,0_2_00074021
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00068858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00068858
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_0007545F
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,5_2_0010545F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,6_2_004167B4
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0001E8000_2_0001E800
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003DBB50_2_0003DBB5
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0009804A0_2_0009804A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0001E0600_2_0001E060
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000241400_2_00024140
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000324050_2_00032405
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000465220_2_00046522
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000906650_2_00090665
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0004267E0_2_0004267E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003283A0_2_0003283A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000268430_2_00026843
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000489DF0_2_000489DF
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00028A0E0_2_00028A0E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00046A940_2_00046A94
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00090AE20_2_00090AE2
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0006EB070_2_0006EB07
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00078B130_2_00078B13
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003CD610_2_0003CD61
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000470060_2_00047006
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0002710E0_2_0002710E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000231900_2_00023190
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000112870_2_00011287
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000333C70_2_000333C7
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003F4190_2_0003F419
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000256800_2_00025680
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000316C40_2_000316C4
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000258C00_2_000258C0
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000378D30_2_000378D3
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00031BB80_2_00031BB8
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00049D050_2_00049D05
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0001FE400_2_0001FE40
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00031FD00_2_00031FD0
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003BFE60_2_0003BFE6
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_01E736B00_2_01E736B0
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000AE8005_2_000AE800
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CDBB55_2_000CDBB5
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000AFE405_2_000AFE40
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0012804A5_2_0012804A
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000AE0605_2_000AE060
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000B41405_2_000B4140
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C24055_2_000C2405
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000D65225_2_000D6522
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000D267E5_2_000D267E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_001206655_2_00120665
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C283A5_2_000C283A
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000B68435_2_000B6843
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000D89DF5_2_000D89DF
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000B8A0E5_2_000B8A0E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000D6A945_2_000D6A94
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00120AE25_2_00120AE2
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00108B135_2_00108B13
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000FEB075_2_000FEB07
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CCD615_2_000CCD61
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000D70065_2_000D7006
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000B710E5_2_000B710E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000B31905_2_000B3190
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000A12875_2_000A1287
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C33C75_2_000C33C7
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CF4195_2_000CF419
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000B56805_2_000B5680
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C16C45_2_000C16C4
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000B58C05_2_000B58C0
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C78D35_2_000C78D3
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C1BB85_2_000C1BB8
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000D9D055_2_000D9D05
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C1FD05_2_000C1FD0
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CBFE65_2_000CBFE6
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_03B936B05_2_03B936B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0043E0CC6_2_0043E0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0041F0FA6_2_0041F0FA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004541596_2_00454159
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004381686_2_00438168
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004461F06_2_004461F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0043E2FB6_2_0043E2FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0045332B6_2_0045332B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0042739D6_2_0042739D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004374E66_2_004374E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0043E5586_2_0043E558
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004387706_2_00438770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004378FE6_2_004378FE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004339466_2_00433946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0044D9C96_2_0044D9C9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00427A466_2_00427A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0041DB626_2_0041DB62
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00427BAF6_2_00427BAF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00437D336_2_00437D33
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00435E5E6_2_00435E5E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00426E0E6_2_00426E0E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0043DE9D6_2_0043DE9D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00413FCA6_2_00413FCA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00436FEA6_2_00436FEA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044B0407_2_0044B040
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0043610D7_2_0043610D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004473107_2_00447310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044A4907_2_0044A490
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040755A7_2_0040755A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0043C5607_2_0043C560
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044B6107_2_0044B610
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044D6C07_2_0044D6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004476F07_2_004476F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044B8707_2_0044B870
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044081D7_2_0044081D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004149577_2_00414957
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004079EE7_2_004079EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00407AEB7_2_00407AEB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044AA807_2_0044AA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00412AA97_2_00412AA9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00404B747_2_00404B74
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00404B037_2_00404B03
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044BBD87_2_0044BBD8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00404BE57_2_00404BE5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00404C767_2_00404C76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00415CFE7_2_00415CFE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00416D727_2_00416D72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00446D307_2_00446D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00446D8B7_2_00446D8B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00406E8F7_2_00406E8F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 00434E10 appears 54 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 00402093 appears 50 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 00434770 appears 41 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 004169A7 appears 87 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0044DB70 appears 41 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 004165FF appears 35 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 00401E65 appears 34 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 00416760 appears 69 times
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: String function: 00017F41 appears 35 times
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: String function: 00038B40 appears 42 times
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: String function: 00030D27 appears 70 times
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: String function: 000C8B40 appears 42 times
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: String function: 000A7F41 appears 35 times
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: String function: 000C0D27 appears 70 times
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8084 -s 1288
            Source: cnaniAxghZ.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
            Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
            Source: Process Memory Space: name.exe PID: 8048, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winEXE@12/14@1/2
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007A2D5 GetLastError,FormatMessageW,0_2_0007A2D5
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00068713 AdjustTokenPrivileges,CloseHandle,0_2_00068713
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00068CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00068CC3
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000F8713 AdjustTokenPrivileges,CloseHandle,5_2_000F8713
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000F8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,5_2_000F8CC3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,6_2_00417952
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_0007B59E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0008F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0008F121
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007C602 CoInitialize,CoCreateInstance,CoUninitialize,0_2_0007C602
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00014FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00014FE9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,6_2_0041AA4A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeFile created: C:\Users\user\AppData\Local\directoryJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8084
            Source: C:\Windows\SysWOW64\svchost.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-TLPQMO
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeFile created: C:\Users\user\AppData\Local\Temp\aut708F.tmpJump to behavior
            Source: cnaniAxghZ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\SysWOW64\svchost.exeSystem information queried: HandleInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: svchost.exe, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
            Source: svchost.exe, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmp, svchost.exe, 00000008.00000002.2852218695.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
            Source: svchost.exe, 00000006.00000002.2877948678.00000000050C0000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
            Source: svchost.exe, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
            Source: svchost.exe, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
            Source: svchost.exe, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
            Source: svchost.exe, 00000007.00000003.2868319315.000000000312E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2868382286.0000000003130000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: svchost.exe, svchost.exe, 00000007.00000002.2868513015.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
            Source: cnaniAxghZ.exeReversingLabs: Detection: 79%
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeFile read: C:\Users\user\Desktop\cnaniAxghZ.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\cnaniAxghZ.exe "C:\Users\user\Desktop\cnaniAxghZ.exe"
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeProcess created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\Desktop\cnaniAxghZ.exe"
            Source: C:\Users\user\AppData\Local\directory\name.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\cnaniAxghZ.exe"
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\ncqkhweaghcgworcchyfyhlbjpqn"
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\qwvdipptuputyufolskgjmgkrwiwkdi"
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\aybv"
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8084 -s 1288
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeProcess created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\Desktop\cnaniAxghZ.exe"Jump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\cnaniAxghZ.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\ncqkhweaghcgworcchyfyhlbjpqn"Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\qwvdipptuputyufolskgjmgkrwiwkdi"Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\aybv"Jump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: pstorec.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: pstorec.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
            Source: cnaniAxghZ.exeStatic file information: File size 1355776 > 1048576
            Source: cnaniAxghZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: cnaniAxghZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: cnaniAxghZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: cnaniAxghZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: cnaniAxghZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: cnaniAxghZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: cnaniAxghZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: wntdll.pdbUGP source: name.exe, 00000005.00000003.2819399918.0000000004030000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2820079168.00000000041D0000.00000004.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: name.exe, 00000005.00000003.2819399918.0000000004030000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2820079168.00000000041D0000.00000004.00001000.00020000.00000000.sdmp
            Source: cnaniAxghZ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: cnaniAxghZ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: cnaniAxghZ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: cnaniAxghZ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: cnaniAxghZ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0008C304 LoadLibraryA,GetProcAddress,0_2_0008C304
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0001C590 push eax; retn 0001h0_2_0001C599
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00078719 push FFFFFF8Bh; iretd 0_2_0007871B
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003E94F push edi; ret 0_2_0003E951
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003EA68 push esi; ret 0_2_0003EA6A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00038B85 push ecx; ret 0_2_00038B98
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003EC43 push esi; ret 0_2_0003EC45
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003ED2C push edi; ret 0_2_0003ED2E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000AC590 push eax; retn 000Ah5_2_000AC599
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00108719 push FFFFFF8Bh; iretd 5_2_0010871B
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CE94F push edi; ret 5_2_000CE951
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CEA68 push esi; ret 5_2_000CEA6A
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000C8B85 push ecx; ret 5_2_000C8B98
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CEC43 push esi; ret 5_2_000CEC45
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CED2C push edi; ret 5_2_000CED2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00457106 push ecx; ret 6_2_00457119
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0045B11A push esp; ret 6_2_0045B141
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00457A28 push eax; ret 6_2_00457A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00434E56 push ecx; ret 6_2_00434E69
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044693D push ecx; ret 7_2_0044694D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044DB70 push eax; ret 7_2_0044DB84
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0044DB70 push eax; ret 7_2_0044DBAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00451D54 push eax; ret 7_2_00451D61
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00406EB0 ShellExecuteW,URLDownloadToFileW,6_2_00406EB0
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeFile created: C:\Users\user\AppData\Local\directory\name.exeJump to dropped file

            Boot Survival

            barindex
            Drops VBS files to the startup folder
            Source: C:\Users\user\AppData\Local\directory\name.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbsJump to dropped file
            Source: C:\Users\user\AppData\Local\directory\name.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbsJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbsJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,6_2_0041AA4A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00014A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00014A35
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000955FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_000955FD
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000A4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,5_2_000A4A35
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_001255FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,5_2_001255FD
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000333C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_000333C7
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\directory\name.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Delayed program exit found
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040F7A7 Sleep,ExitProcess,6_2_0040F7A7
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\AppData\Local\directory\name.exeAPI/Special instruction interceptor: Address: 3B932D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,7_2_0040DD85
            Source: C:\Windows\SysWOW64\svchost.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,6_2_0041A748
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-98362
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeAPI coverage: 4.6 %
            Source: C:\Users\user\AppData\Local\directory\name.exeAPI coverage: 4.9 %
            Source: C:\Windows\SysWOW64\svchost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00074696 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00074696
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007C93C FindFirstFileW,FindClose,0_2_0007C93C
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0007C9C7
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0007F200
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0007F35D
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0007F65E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00073A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00073A2B
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00073D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00073D4E
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0007BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0007BF27
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00104696 GetFileAttributesW,FindFirstFileW,FindClose,5_2_00104696
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010C93C FindFirstFileW,FindClose,5_2_0010C93C
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,5_2_0010C9C7
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,5_2_0010F200
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,5_2_0010F35D
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,5_2_0010F65E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00103A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,5_2_00103A2B
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00103D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,5_2_00103D4E
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_0010BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,5_2_0010BF27
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,6_2_00409253
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,6_2_0041C291
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,6_2_0040C34D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,6_2_00409665
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,6_2_0040880C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040783C FindFirstFileW,FindNextFileW,6_2_0040783C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,6_2_00419AF5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,6_2_0040BB30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,6_2_0040BD37
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040AE51 FindFirstFileW,FindNextFileW,7_2_0040AE51
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,6_2_00407C97
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00014AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00014AFE
            Source: svchost.exe, 00000006.00000002.2877334638.0000000003068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.2840816406.0000000003068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.2841755060.0000000003068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2877524808.000000000308A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.2839396466.0000000003068000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: bhv5230.tmp.7.drBinary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
            Source: svchost.exe, 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(
            Source: bhv5230.tmp.7.drBinary or memory string: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpXOaQeBtbq%2B7LgJauNdx5lF%2FQ%2FOy2qwXRNGjU%3D&Manufacturer=VMware%2C%20Inc.&Model=VMware20%2C1&Language=en&Locale=en-US
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeAPI call chain: ExitProcess graph end nodegraph_0-98176
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeAPI call chain: ExitProcess graph end nodegraph_0-97747
            Source: C:\Users\user\AppData\Local\directory\name.exeAPI call chain: ExitProcess graph end node
            Source: C:\Users\user\AppData\Local\directory\name.exeAPI call chain: ExitProcess graph end node
            Source: C:\Windows\SysWOW64\svchost.exeAPI call chain: ExitProcess graph end node
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000841FD BlockInput,0_2_000841FD
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00013B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00013B4C
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00045CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00045CCC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,7_2_0040DD85
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0008C304 LoadLibraryA,GetProcAddress,0_2_0008C304
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_01E735A0 mov eax, dword ptr fs:[00000030h]0_2_01E735A0
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_01E73540 mov eax, dword ptr fs:[00000030h]0_2_01E73540
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_01E71ED0 mov eax, dword ptr fs:[00000030h]0_2_01E71ED0
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_03B935A0 mov eax, dword ptr fs:[00000030h]5_2_03B935A0
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_03B93540 mov eax, dword ptr fs:[00000030h]5_2_03B93540
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_03B91ED0 mov eax, dword ptr fs:[00000030h]5_2_03B91ED0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004432B5 mov eax, dword ptr fs:[00000030h]6_2_004432B5
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000681F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_000681F7
            Source: C:\Windows\SysWOW64\svchost.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003A364 SetUnhandledExceptionFilter,0_2_0003A364
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0003A395
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CA364 SetUnhandledExceptionFilter,5_2_000CA364
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_000CA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_000CA395
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_004349F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00434B47 SetUnhandledExceptionFilter,6_2_00434B47
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_0043BB22
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00434FDC

            HIPS / PFW / Operating System Protection Evasion

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 107.175.229.139 8087Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 178.237.33.50 80Jump to behavior
            Contains functionality to inject code into remote processes
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 6_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,6_2_004180EF
            Maps a DLL or memory area into another process
            Source: C:\Users\user\AppData\Local\directory\name.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\AppData\Local\directory\name.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 89C008Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe6_2_004120F7
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00068C93 LogonUserW,0_2_00068C93
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00013B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00013B4C
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00014A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00014A35
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00074EC9 mouse_event,0_2_00074EC9
            Source: C:\Users\user\AppData\Local\directory\name.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\cnaniAxghZ.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\ncqkhweaghcgworcchyfyhlbjpqn"Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\qwvdipptuputyufolskgjmgkrwiwkdi"Jump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\aybv"Jump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000681F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_000681F7
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00074C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00074C03
            Source: cnaniAxghZ.exe, name.exe.0.drBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
            Source: svchost.exe, 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagersInfo
            Source: svchost.exe, 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
            Source: cnaniAxghZ.exe, name.exeBinary or memory string: Shell_TrayWnd
            Source: svchost.exe, 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager\??\C:\Usersgp
            Source: svchost.exe, 00000006.00000002.2877479755.0000000003077000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2877299346.0000000003031000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
            Source: svchost.exe, 00000006.00000002.2877299346.0000000003031000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [Program Manager]
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0003886B cpuid 0_2_0003886B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoA,6_2_0040F8D1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: EnumSystemLocalesW,6_2_00452036
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,6_2_004520C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoW,6_2_00452313
            Source: C:\Windows\SysWOW64\svchost.exeCode function: EnumSystemLocalesW,6_2_00448404
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,6_2_0045243C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoW,6_2_00452543
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,6_2_00452610
            Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoW,6_2_004488ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,6_2_00451CD8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: EnumSystemLocalesW,6_2_00451F50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: EnumSystemLocalesW,6_2_00451F9B
            Source: C:\Windows\SysWOW64\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_000450D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_000450D7
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00052230 GetUserNameW,0_2_00052230
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_0004418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_0004418A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00014AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00014AFE
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.2877207597.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: name.exe PID: 8048, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTR
            Contains functionality to steal Chrome passwords or cookies
            Source: C:\Windows\SysWOW64\svchost.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data6_2_0040BA12
            Contains functionality to steal Firefox passwords or cookies
            Source: C:\Windows\SysWOW64\svchost.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\6_2_0040BB30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: \key3.db6_2_0040BB30
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.dbJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Tries to steal Instant Messenger accounts or passwords
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\PaltalkJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
            Yara detected WebBrowserPassView password recovery tool
            Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 5428, type: MEMORYSTR
            Source: name.exeBinary or memory string: WIN_81
            Source: name.exeBinary or memory string: WIN_XP
            Source: name.exeBinary or memory string: WIN_XPe
            Source: name.exeBinary or memory string: WIN_VISTA
            Source: name.exeBinary or memory string: WIN_7
            Source: name.exeBinary or memory string: WIN_8
            Source: name.exe.0.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

            Remote Access Functionality

            barindex
            Detected Remcos RAT
            Source: C:\Windows\SysWOW64\svchost.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-TLPQMOJump to behavior
            Yara detected Remcos RAT
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 5.2.name.exe.3f20000.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.2877207597.0000000003000000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: name.exe PID: 8048, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 8084, type: MEMORYSTR
            Source: C:\Windows\SysWOW64\svchost.exeCode function: cmd.exe6_2_0040569A
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00086596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00086596
            Source: C:\Users\user\Desktop\cnaniAxghZ.exeCode function: 0_2_00086A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00086A5A
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00116596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,5_2_00116596
            Source: C:\Users\user\AppData\Local\directory\name.exeCode function: 5_2_00116A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,5_2_00116A5A

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity Information1
            Scripting            		2
            Valid Accounts            		2
            Native API            		1
            Scripting            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		2
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services11
            Archive Collected Data            		12
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault Accounts1
            Command and Scripting Interpreter            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		221
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		2
            Encrypted Channel            		Exfiltration Over Bluetooth1
            Defacement
            Email AddressesDNS ServerDomain Accounts2
            Service Execution            		2
            Valid Accounts            		1
            Bypass User Account Control            		2
            Obfuscated Files or Information            		1
            Credentials in Registry            		1
            System Service Discovery            		SMB/Windows Admin Shares1
            Email Collection            		1
            Non-Standard Port            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCron1
            Windows Service            		2
            Valid Accounts            		1
            DLL Side-Loading            		3
            Credentials In Files            		3
            File and Directory Discovery            		Distributed Component Object Model221
            Input Capture            		1
            Remote Access Software            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchd2
            Registry Run Keys / Startup Folder            		21
            Access Token Manipulation            		1
            Bypass User Account Control            		LSA Secrets138
            System Information Discovery            		SSH3
            Clipboard Data            		2
            Non-Application Layer Protocol            		Scheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
            Windows Service            		1
            Masquerading            		Cached Domain Credentials151
            Security Software Discovery            		VNCGUI Input Capture12
            Application Layer Protocol            		Data Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items422
            Process Injection            		2
            Valid Accounts            		DCSync1
            Virtualization/Sandbox Evasion            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/Job2
            Registry Run Keys / Startup Folder            		1
            Virtualization/Sandbox Evasion            		Proc Filesystem4
            Process Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
            Access Token Manipulation            		/etc/passwd and /etc/shadow1
            Application Window Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron422
            Process Injection            		Network Sniffing1
            System Owner/User Discovery            		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1466891 Sample: cnaniAxghZ.exe Startdate: 03/07/2024 Architecture: WINDOWS Score: 100 38 geoplugin.net 2->38 48 Snort IDS alert for network traffic 2->48 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 11 other signatures 2->54 9 cnaniAxghZ.exe 6 2->9         started        signatures3 process4 file5 30 C:\Users\user\AppData\Local\...\name.exe, PE32 9->30 dropped 62 Binary is likely a compiled AutoIt script file 9->62 13 name.exe 3 9->13         started        signatures6 process7 file8 32 C:\Users\user\AppData\Roaming\...\name.vbs, data 13->32 dropped 64 Binary is likely a compiled AutoIt script file 13->64 66 Drops VBS files to the startup folder 13->66 68 Writes to foreign memory regions 13->68 70 2 other signatures 13->70 17 svchost.exe 3 13 13->17         started        signatures9 process10 dnsIp11 34 geoplugin.net 178.237.33.50, 49739, 80 ATOM86-ASATOM86NL Netherlands 17->34 36 107.175.229.139, 49737, 49738, 8087 AS-COLOCROSSINGUS United States 17->36 40 System process connects to network (likely due to code injection or exploit) 17->40 42 Contains functionality to bypass UAC (CMSTPLUA) 17->42 44 Detected Remcos RAT 17->44 46 8 other signatures 17->46 21 svchost.exe 1 17->21         started        24 svchost.exe 1 17->24         started        26 svchost.exe 2 17->26         started        28 WerFault.exe 22 12 17->28         started        signatures12 process13 signatures14 56 Tries to steal Instant Messenger accounts or passwords 21->56 58 Tries to harvest and steal browser information (history, passwords, etc) 21->58 60 Tries to steal Mail credentials (via file / registry access) 24->60

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            cnaniAxghZ.exe79%ReversingLabsWin32.Backdoor.Remcos
            cnaniAxghZ.exe100%AviraTR/AutoIt.mqvhn
            cnaniAxghZ.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://geoplugin.net/json.gp/C0%URL Reputationsafe
            http://geoplugin.net/json.gp0%URL Reputationsafe
            http://www.nirsoft.net0%Avira URL Cloudsafe
            https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W0%Avira URL Cloudsafe
            https://aefd.nelreports.net/api/report?cat=bingth0%Avira URL Cloudsafe
            https://deff.nelreports.net/api/report?cat=msn0%Avira URL Cloudsafe
            07.175.229.1390%Avira URL Cloudsafe
            https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr0%Avira URL Cloudsafe
            https://aefd.nelreports.net/api/report?cat=bingaotak0%Avira URL Cloudsafe
            http://www.imvu.comr0%Avira URL Cloudsafe
            https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc0%Avira URL Cloudsafe
            https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad0%Avira URL Cloudsafe
            https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e7420%Avira URL Cloudsafe
            https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr0%Avira URL Cloudsafe
            http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com0%Avira URL Cloudsafe
            https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc80%Avira URL Cloudsafe
            https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c0%Avira URL Cloudsafe
            https://login.yahoo.com/config/login0%Avira URL Cloudsafe
            https://www.google.com0%Avira URL Cloudsafe
            https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb510%Avira URL Cloudsafe
            https://maps.windows.com/windows-app-web-link0%Avira URL Cloudsafe
            https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat0%Avira URL Cloudsafe
            https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a80%Avira URL Cloudsafe
            https://www.office.com/0%Avira URL Cloudsafe
            https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d0%Avira URL Cloudsafe
            https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d0%Avira URL Cloudsafe
            https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg0%Avira URL Cloudsafe
            https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf680%Avira URL Cloudsafe
            http://www.nirsoft.net/0%Avira URL Cloudsafe
            https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e20%Avira URL Cloudsafe
            https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d0%Avira URL Cloudsafe
            https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa4370%Avira URL Cloudsafe
            http://www.imvu.com0%Avira URL Cloudsafe
            https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d7888073423260%Avira URL Cloudsafe
            https://aefd.nelreports.net/api/report?cat=wsb0%Avira URL Cloudsafe
            http://geoplugin.net/json.gpSystem320%Avira URL Cloudsafe
            https://aefd.nelreports.net/api/report?cat=bingaot0%Avira URL Cloudsafe
            https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae0%Avira URL Cloudsafe
            https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b030%Avira URL Cloudsafe
            https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad70%Avira URL Cloudsafe
            https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD0%Avira URL Cloudsafe
            https://aefd.nelreports.net/api/report?cat=bingrms0%Avira URL Cloudsafe
            https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc1749930%Avira URL Cloudsafe
            https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b30%Avira URL Cloudsafe
            https://www.google.com/accounts/servicelogin0%Avira URL Cloudsafe
            https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d50%Avira URL Cloudsafe
            https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc781350%Avira URL Cloudsafe
            https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c590%Avira URL Cloudsafe
            http://www.ebuddy.com0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            geoplugin.net
            		178.237.33.50
            		truetrue
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              07.175.229.139true
              • Avira URL Cloud: safe
              		unknown
              http://geoplugin.net/json.gptrue
              • URL Reputation: safe
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://www.imvu.comrsvchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=Wbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbadbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://aefd.nelreports.net/api/report?cat=bingthbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fccbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.nirsoft.netsvchost.exe, 00000007.00000002.2868756077.00000000009B3000.00000004.00000010.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://aefd.nelreports.net/api/report?cat=bingaotakbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://deff.nelreports.net/api/report?cat=msnbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Frbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Frbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.comsvchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://www.google.comsvchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950cbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              http://geoplugin.net/json.gp/Cname.exe, 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              https://maps.windows.com/windows-app-web-linkbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&platbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://login.yahoo.com/config/loginsvchost.exefalse
              • Avira URL Cloud: safe
              		unknown
              http://www.nirsoft.net/svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816dbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367dbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svgbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://www.office.com/bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8dbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.imvu.comsvchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://aefd.nelreports.net/api/report?cat=wsbbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              http://geoplugin.net/json.gpSystem32svchost.exe, 00000006.00000002.2877479755.0000000003077000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://aefd.nelreports.net/api/report?cat=bingaotbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-aebhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFDbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://aefd.nelreports.net/api/report?cat=bingrmsbhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://www.google.com/accounts/serviceloginsvchost.exefalse
              • Avira URL Cloud: safe
              		unknown
              https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59bhv5230.tmp.7.drfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.ebuddy.comsvchost.exe, 00000006.00000002.2878530155.0000000005D20000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000009.00000002.2854252619.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              107.175.229.139
              		unknownUnited States
              		36352AS-COLOCROSSINGUStrue
              178.237.33.50
              		geoplugin.netNetherlands
              		8455ATOM86-ASATOM86NLtrue

              General Information

              Joe Sandbox version:40.0.0 Tourmaline
              Analysis ID:1466891
              Start date and time:2024-07-03 14:48:08 +02:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 8m 11s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:14
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:cnaniAxghZ.exe
              renamed because original name is a hash value
              Original Sample Name:9993b780d61a1d757de704d2b6459cbac20803e5e2a2374cbea719aaadbb1344.exe
              Detection:MAL
              Classification:mal100.rans.phis.troj.spyw.expl.evad.winEXE@12/14@1/2
              EGA Information:
              • Successful, ratio: 100%
              HCA Information:
              • Successful, ratio: 99%
              • Number of executed functions: 58
              • Number of non-executed functions: 273
              Cookbook Comments:
              • Found application associated with file extension: .exe

              Warnings

              • Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
              • Not all processes where analyzed, report is missing behavior information
              • Report creation exceeded maximum time and may have missing disassembly code information.
              • Report size exceeded maximum capacity and may have missing disassembly code.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • Report size getting too big, too many NtReadVirtualMemory calls found.
              • VT rate limit hit for: cnaniAxghZ.exe

              Simulations

              Behavior and APIs

              TimeTypeDescription
              13:50:57AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              107.175.229.139REM6789098756GHUITR.bat.exeGet hashmaliciousRemcosBrowse
                GF87654456789900..DOC.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                  z24FATUR8767909876500.exeGet hashmaliciousRemcosBrowse
                    FATCR09867000000.exeGet hashmaliciousRemcosBrowse
                      HGTQP09643009.scr.exeGet hashmaliciousRemcos, DBatLoader, PrivateLoaderBrowse
                        z49factura098765679000.bat.exeGet hashmaliciousRemcos, PrivateLoaderBrowse
                          #U00dcberpr#U00fcfen Sie Ihre_INV-2087_A97OPY7R#4DE688II65-DHL.scr.exeGet hashmaliciousRemcos, PrivateLoaderBrowse
                            z97FDREMCO00000HJ.bat.exeGet hashmaliciousRemcos, PrivateLoaderBrowse
                              VNNctWOjel.exeGet hashmaliciousRemcosBrowse
                                0876543456700076.xlam.xlsxGet hashmaliciousRemcos, DBatLoaderBrowse
                                  178.237.33.50xBkOubR0eL.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  PO#2195112.vbsGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  TT_Payment_Slip.bat.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • geoplugin.net/json.gp
                                  PAYMENT COPY.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • geoplugin.net/json.gp
                                  STATEMENT OF ACCOUNT.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • geoplugin.net/json.gp
                                  Requirement reference for quotation.exeGet hashmaliciousRemcosBrowse
                                  • geoplugin.net/json.gp
                                  STATEMENT OF ACCOUNT.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • geoplugin.net/json.gp
                                  710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                  • geoplugin.net/json.gp
                                  SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • geoplugin.net/json.gp

                                  Domains

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  geoplugin.netxBkOubR0eL.exeGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  PO#2195112.vbsGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  TT_Payment_Slip.bat.exeGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  PAYMENT COPY.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  STATEMENT OF ACCOUNT.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  Requirement reference for quotation.exeGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  STATEMENT OF ACCOUNT.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                  • 178.237.33.50
                                  SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50

                                  ASNs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  AS-COLOCROSSINGUSexecute_and_cleanup.shGet hashmaliciousUnknownBrowse
                                  • 108.174.58.28
                                  4YlwTsmpuZ.rtfGet hashmaliciousUnknownBrowse
                                  • 23.95.235.16
                                  Payment_Advice.xlsGet hashmaliciousUnknownBrowse
                                  • 192.3.179.150
                                  DHL_AWB 98776013276.xlsGet hashmaliciousFormBookBrowse
                                  • 23.95.235.16
                                  Scan-Payment-Advice.xlsGet hashmaliciousLokibotBrowse
                                  • 198.46.178.137
                                  orden de compra.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                  • 192.3.243.156
                                  ORDER-7019-2024.jsGet hashmaliciousAgentTeslaBrowse
                                  • 192.210.215.11
                                  PO-24701248890.jsGet hashmaliciousWSHRatBrowse
                                  • 192.210.215.11
                                  FedEx Receipt_53065724643.xlsGet hashmaliciousFormBookBrowse
                                  • 23.95.235.16
                                  statement .xlsGet hashmaliciousUnknownBrowse
                                  • 23.95.235.16
                                  ATOM86-ASATOM86NLxBkOubR0eL.exeGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  PO#2195112.vbsGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  TT_Payment_Slip.bat.exeGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  PAYMENT COPY.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  STATEMENT OF ACCOUNT.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  Requirement reference for quotation.exeGet hashmaliciousRemcosBrowse
                                  • 178.237.33.50
                                  STATEMENT OF ACCOUNT.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50
                                  710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr.exeGet hashmaliciousDBatLoader, RemcosBrowse
                                  • 178.237.33.50
                                  SOA.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                  • 178.237.33.50

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WER5434.tmp.dmp

                                  Download File
                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                  File Type:Mini DuMP crash report, 14 streams, Wed Jul 3 12:50:58 2024, 0x1205a4 type
                                  Category:dropped
                                  Size (bytes):136134
                                  Entropy (8bit):1.758150023465077
                                  Encrypted:false
                                  SSDEEP:384:N2ySTSo9/jW5/0lr8GUifalODe2gui/xF38ccidja7H7Iad2+3xXxV:IzfxjW50SiZDvE98edja7bC+1
                                  MD5:5B9C30C5D5E086087CCB9AB8A04ADF83
                                  SHA1:62A5C240F14AEA2F8A63EB99C8D68A0EA29EEEB3
                                  SHA-256:61F846A2085653BA12EC3CEE9A38691BA0A6FC4BDEE6A41A0F5877094D3EC25A
                                  SHA-512:86B8F05DDC1B6B79010EF4D4098A3AD06035178E159D76EF0EDC90ACE5E33801234D7764E156E0AE9A8D44CD7E122975432590FFF5C1135C35B4AE1977868860
                                  Malicious:false
                                  Reputation:low
                                  Preview:MDMP..a..... .......2I.f........................`................R..........T.......8...........T...........87............... ...........!..............................................................................eJ......."......GenuineIntel............T...........-I.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WER559C.tmp.WERInternalMetadata.xml

                                  Download File
                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):8270
                                  Entropy (8bit):3.691040266903646
                                  Encrypted:false
                                  SSDEEP:192:R6l7wVeJzw6l6Y+n6G8bgmfpnEuZuprw89b5ksfmzm:R6lXJE6l6YO6hgmfpnEuZ25XfD
                                  MD5:E8EF4A1B2E4D62808527EDF85F8C7AFA
                                  SHA1:B6CCFA77CEA7A6BFD6C3B274DD017BF972A1820C
                                  SHA-256:AA43E00D7DEAA619FB10FAD1548492613082419CBD99109FE93F04582C9987F6
                                  SHA-512:7F0523E4780A8AEC56B2ECE728AAAB531617E4F6DBD0D21E2A90CB56749A74C5C54B9C2CEB8CD129E22AE8663FC096333A173445F5EAC352DC4384F4D0B1147E
                                  Malicious:false
                                  Reputation:low
                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.8.4.<./.P.i.

                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WER55CC.tmp.xml

                                  Download File
                                  Process:C:\Windows\SysWOW64\WerFault.exe
                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):4655
                                  Entropy (8bit):4.45073607594719
                                  Encrypted:false
                                  SSDEEP:48:cvIwWl8zsnJg77aI9lGnWpW8VYj3mYm8M4JCFLFN+q8+L/D0Dd:uIjfJI7/GW7VsPJC5vD0Dd
                                  MD5:CD525189B8258D49BDCFF228305EECEE
                                  SHA1:5E0A4FD2F42A8E52A055A904E21F04A642E43BA9
                                  SHA-256:A51D2918E644AF973E4627993F1075CDB5F78465006D80119AE040087205C477
                                  SHA-512:53FF3EE6E3EFC6F1B6888F7697FBD893DA240977BE50AAC8DD21934D730164BE3B7D4169236D71F9B190C7ABC3B17E7A142023420182922E43B03714251DCD05
                                  Malicious:false
                                  Reputation:low
                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="394793" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

                                  Download File
                                  Process:C:\Windows\SysWOW64\svchost.exe
                                  File Type:JSON data
                                  Category:dropped
                                  Size (bytes):962
                                  Entropy (8bit):5.013811273052389
                                  Encrypted:false
                                  SSDEEP:12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
                                  MD5:18BC6D34FABB00C1E30D98E8DAEC814A
                                  SHA1:D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
                                  SHA-256:862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
                                  SHA-512:8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
                                  Malicious:false
                                  Reputation:moderate, very likely benign file
                                  Preview:{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                  C:\Users\user\AppData\Local\Temp\aut4129.tmp

                                  Download File
                                  Process:C:\Users\user\AppData\Local\directory\name.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):427908
                                  Entropy (8bit):7.986103438642409
                                  Encrypted:false
                                  SSDEEP:12288:rTiI6RPFmNCjr9bILlTFrr0bR3VAdhnLTiTiJD94gHKvW:ncFmN4RbILlTJGVAjLW6IW
                                  MD5:186D4D6B81F5F8D23AB819A0D71F859E
                                  SHA1:CC3BE8C4D83C7C1422CD2173D4AE303AE4A7CF3E
                                  SHA-256:C628D0E71D3B24B1C81098C642C6025268A1E6BA165C2BAAC0F1D00EBB2C3DB1
                                  SHA-512:A41703C9805F81938F14B4BA59E1337B4E077525D5410E61ACED96C6B28E597BFA743C58F8E5664C5755B4BEF589177C2467B19F2193733BE7EFB3F68D60DA6B
                                  Malicious:false
                                  Reputation:low
                                  Preview:EA06.....@..z.j.8..(t....P.Q.:...D...J...0.P....\...~.%J.A......c........8.I.rI..G5......[..F$3[..C=.J&.H.6.v...k|.kI..*f......,$.....z.,.Q5.O.[..M0.K....;.%..:.4....az........\,..k..K .d.E..JiZ...I...'Z...%.....=....-.y..N/....M.."z.l.o..S.;.,.+=.O!:<.....A+4H]..V..4.`.]l.:.>.L.U.UJE..2...q....T..8.....0.T..J.N.D..@I.."....=r.T....uQ.p.3.E..@..j5.%\...0.^.uT..z..*t....,....Q*...R...W...O.!..V.....%6.@....Pm(.9.m.g1....I..V.P@.J...P...|6:..m.M$...R...?19.L'.Z.......#....b.*D#...J.V.W.........N*8.l.K..k....B.U..M......V....K(.....(....Q(.`.6....A(.(..".H..K.`.T...5.p.IR...|..-..(..'.......4.:.R...C+.*..N.A..z|`a?@......b.ML..G.L..x.#W....p...Q...v?.*.}*.Chz..>.P..=.......T.Uj.6o...!.J.B=...51k......#........y..W...*.Z.Z..P........X.uIM.w..l..."5...!.z...C.Pf09.....Y.t8.....E.....Y.E....C;~.Pm?.MC.'..T...A...~.`..i...5...j}]..u....}S..b.:>..`.Td....q..Y..HV_.!..([-..H..)....Aq.../.R...o.u.E.S.......T.f.....3...2.I..W........D.`f.l.&1...0wj.B_..Dh;

                                  C:\Users\user\AppData\Local\Temp\aut4188.tmp

                                  Download File
                                  Process:C:\Users\user\AppData\Local\directory\name.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):9932
                                  Entropy (8bit):7.595448806331314
                                  Encrypted:false
                                  SSDEEP:192:uitokLqcFEelaNFMKlGvYHbfqPK30zBh0qdYEf9UGCsdQbciHRLmgECq8:uiikLqcCelamQwK30zBIGLYFmgEp8
                                  MD5:E322D9C1E6723E07B9A8E60CE57CAE89
                                  SHA1:838EEED2BAF4E8EF013A4F73B1374FDC2C15C059
                                  SHA-256:A5486CDC1FCC8CFA321599381BF74E08F39B4E06F3F84AAB2A6F36219AE753F8
                                  SHA-512:202860CC2C4D2503B980287429AB036FDB5F68A0832EACDBB4EEB8D631ADB4475370C40D453ED85998DC3324DC127D2E706FEBF7317ABE621F69383F36AFCD9F
                                  Malicious:false
                                  Reputation:low
                                  Preview:EA06..t4..t...e4.L..9...8....)..E.P....aA..f.I..C..'3i..e1../.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,S....f.I...a..-vk5.........6.l,`........fs;....`....g.I......l..]..f.`...9|....p.1..... ..$h.c.....#@...H,....`..k0.H.f. ...<zk5....!9.B...3p.n.f.I..q7.t.,. ....4....`....8.........c....P....0.... ..Y@....../Z..-zs5...jq7...zl........V....#.p..N&...M.^.9.....7.:..w.......7...}3p#..oc...f.P./....J.v.5..@{...........a..f.....`.Y..`...&.......x...u| .....Y,@=.%.d....&.)...,S`./..8....@..%....Y@..;...#.Y,s ./.k5...4.;...K.4|.;..g.c....c..&.i....x.&.k...c.Y'3Y...@}.4..3.....33...se.M'.@C`..s....e.,..h........Y.......Y.$.p.Y...f.e...8.....2...@.;1.X.`..L' ..........@.37.Ll.K.......9d..,vd.....i2........#. ....3a..g.`j.....Bvf.....@R...m8.4@9..NL..;3.X.l.:M. ..........c.@.......d.... ......8.a...f.X.B)..'f......j.a...0..s5..Bvj........;...N..;6.X...Cv }.....'.<..L..8.....f.L..@....`...f..!...&s...j...B;7.X...c

                                  C:\Users\user\AppData\Local\Temp\aut708F.tmp

                                  Download File
                                  Process:C:\Users\user\Desktop\cnaniAxghZ.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):427908
                                  Entropy (8bit):7.986103438642409
                                  Encrypted:false
                                  SSDEEP:12288:rTiI6RPFmNCjr9bILlTFrr0bR3VAdhnLTiTiJD94gHKvW:ncFmN4RbILlTJGVAjLW6IW
                                  MD5:186D4D6B81F5F8D23AB819A0D71F859E
                                  SHA1:CC3BE8C4D83C7C1422CD2173D4AE303AE4A7CF3E
                                  SHA-256:C628D0E71D3B24B1C81098C642C6025268A1E6BA165C2BAAC0F1D00EBB2C3DB1
                                  SHA-512:A41703C9805F81938F14B4BA59E1337B4E077525D5410E61ACED96C6B28E597BFA743C58F8E5664C5755B4BEF589177C2467B19F2193733BE7EFB3F68D60DA6B
                                  Malicious:false
                                  Reputation:low
                                  Preview:EA06.....@..z.j.8..(t....P.Q.:...D...J...0.P....\...~.%J.A......c........8.I.rI..G5......[..F$3[..C=.J&.H.6.v...k|.kI..*f......,$.....z.,.Q5.O.[..M0.K....;.%..:.4....az........\,..k..K .d.E..JiZ...I...'Z...%.....=....-.y..N/....M.."z.l.o..S.;.,.+=.O!:<.....A+4H]..V..4.`.]l.:.>.L.U.UJE..2...q....T..8.....0.T..J.N.D..@I.."....=r.T....uQ.p.3.E..@..j5.%\...0.^.uT..z..*t....,....Q*...R...W...O.!..V.....%6.@....Pm(.9.m.g1....I..V.P@.J...P...|6:..m.M$...R...?19.L'.Z.......#....b.*D#...J.V.W.........N*8.l.K..k....B.U..M......V....K(.....(....Q(.`.6....A(.(..".H..K.`.T...5.p.IR...|..-..(..'.......4.:.R...C+.*..N.A..z|`a?@......b.ML..G.L..x.#W....p...Q...v?.*.}*.Chz..>.P..=.......T.Uj.6o...!.J.B=...51k......#........y..W...*.Z.Z..P........X.uIM.w..l..."5...!.z...C.Pf09.....Y.t8.....E.....Y.E....C;~.Pm?.MC.'..T...A...~.`..i...5...j}]..u....}S..b.:>..`.Td....q..Y..HV_.!..([-..H..)....Aq.../.R...o.u.E.S.......T.f.....3...2.I..W........D.`f.l.&1...0wj.B_..Dh;

                                  C:\Users\user\AppData\Local\Temp\aut70DE.tmp

                                  Download File
                                  Process:C:\Users\user\Desktop\cnaniAxghZ.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):9932
                                  Entropy (8bit):7.595448806331314
                                  Encrypted:false
                                  SSDEEP:192:uitokLqcFEelaNFMKlGvYHbfqPK30zBh0qdYEf9UGCsdQbciHRLmgECq8:uiikLqcCelamQwK30zBIGLYFmgEp8
                                  MD5:E322D9C1E6723E07B9A8E60CE57CAE89
                                  SHA1:838EEED2BAF4E8EF013A4F73B1374FDC2C15C059
                                  SHA-256:A5486CDC1FCC8CFA321599381BF74E08F39B4E06F3F84AAB2A6F36219AE753F8
                                  SHA-512:202860CC2C4D2503B980287429AB036FDB5F68A0832EACDBB4EEB8D631ADB4475370C40D453ED85998DC3324DC127D2E706FEBF7317ABE621F69383F36AFCD9F
                                  Malicious:false
                                  Reputation:low
                                  Preview:EA06..t4..t...e4.L..9...8....)..E.P....aA..f.I..C..'3i..e1../.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,S....f.I...a..-vk5.........6.l,`........fs;....`....g.I......l..]..f.`...9|....p.1..... ..$h.c.....#@...H,....`..k0.H.f. ...<zk5....!9.B...3p.n.f.I..q7.t.,. ....4....`....8.........c....P....0.... ..Y@....../Z..-zs5...jq7...zl........V....#.p..N&...M.^.9.....7.:..w.......7...}3p#..oc...f.P./....J.v.5..@{...........a..f.....`.Y..`...&.......x...u| .....Y,@=.%.d....&.)...,S`./..8....@..%....Y@..;...#.Y,s ./.k5...4.;...K.4|.;..g.c....c..&.i....x.&.k...c.Y'3Y...@}.4..3.....33...se.M'.@C`..s....e.,..h........Y.......Y.$.p.Y...f.e...8.....2...@.;1.X.`..L' ..........@.37.Ll.K.......9d..,vd.....i2........#. ....3a..g.`j.....Bvf.....@R...m8.4@9..NL..;3.X.l.:M. ..........c.@.......d.... ......8.a...f.X.B)..'f......j.a...0..s5..Bvj........;...N..;6.X...Cv }.....'.<..L..8.....f.L..@....`...f..!...&s...j...B;7.X...c

                                  C:\Users\user\AppData\Local\Temp\bhv5230.tmp

                                  Download File
                                  Process:C:\Windows\SysWOW64\svchost.exe
                                  File Type:Extensible storage engine DataBase, version 0x620, checksum 0x1c4d7e57, page size 32768, DirtyShutdown, Windows version 10.0
                                  Category:dropped
                                  Size (bytes):20447232
                                  Entropy (8bit):1.2830233246655096
                                  Encrypted:false
                                  SSDEEP:12288:BJSPOhijljKhBfvUDv22+555ckQB8WBbXnE:2ii9JDZ+
                                  MD5:DD73B6F11CF4D24150010822306129D1
                                  SHA1:9A1063BFEFA6C672634DCD61830644A9A1A70947
                                  SHA-256:36EF53DA18DDAEA5DDA608DAF0629738EF482ABB6471D5FA5DEA04D1E2F8B8EB
                                  SHA-512:36A461B57F90E8696D873B6840D7FB0EF104AC0F3353630FD4E71613E521C43B1363186F88DE3704263FBEE80FB2021785393B986A2C8E3D41E295A8F9DBEFAF
                                  Malicious:false
                                  Preview:.M~W... ........=......J}...0...{........................"..........{i......{..h.$..........................3.s.0...{..............................................................................................c...........eJ......n........................................................................................................... ............{...................................................................................................................................................................................................{;.................................'.[L.....{....................U......{...........................#......h.$.....................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\differences

                                  Download File
                                  Process:C:\Users\user\Desktop\cnaniAxghZ.exe
                                  File Type:ASCII text, with very long lines (29748), with no line terminators
                                  Category:dropped
                                  Size (bytes):29748
                                  Entropy (8bit):3.5540950742492776
                                  Encrypted:false
                                  SSDEEP:768:+iTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbYE+I3Oib4vfF3if6gyY:+iTZ+2QoioGRk6ZklputwjpjBkCiw2RD
                                  MD5:51E0AB199327273ADD3BFD656C34C6CF
                                  SHA1:0C7254BD8478DBD1734270DAFAE940D6B0CF5F89
                                  SHA-256:B1AE5302E6F6F9ACA842B7970A08BB5D552166B4E52755B44A80ECC33B368F2B
                                  SHA-512:BA49BEFC03BA3DCCE299FCD7A1A53B32427092275E11F85B4167C362CDD57CC5BED3E1A060875391A38AC59E7602C580EE46903A260EAEEBC01CC375E3859225
                                  Malicious:false
                                  Preview:163AC42442F39BB8E63A241CE8BF9A50A5A6D78EC74962A21C0x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c0000006689957cffffffb86c0000

                                  C:\Users\user\AppData\Local\Temp\ncqkhweaghcgworcchyfyhlbjpqn

                                  Download File
                                  Process:C:\Windows\SysWOW64\svchost.exe
                                  File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                  Category:dropped
                                  Size (bytes):2
                                  Entropy (8bit):1.0
                                  Encrypted:false
                                  SSDEEP:3:Qn:Qn
                                  MD5:F3B25701FE362EC84616A93A45CE9998
                                  SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                  SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                  SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                  Malicious:false
                                  Preview:..

                                  C:\Users\user\AppData\Local\Temp\semispinalis

                                  Download File
                                  Process:C:\Users\user\Desktop\cnaniAxghZ.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):494080
                                  Entropy (8bit):7.64534429396745
                                  Encrypted:false
                                  SSDEEP:12288:Z1pAok+T2grcAzEAF53Klvp3Ku373t2mXeLXXj:Wok+aHSEWg6SgXj
                                  MD5:213529D027991B34EBDA0D39BE4B21B0
                                  SHA1:AE5CF13BD9040E882A31B530919B745544AA781B
                                  SHA-256:BC8E2CA93AAAC34D8CEBD37458AB7C4BC94C3CB0D0164BBAD39EEA5101474052
                                  SHA-512:405804CD6AFECD9EC0A056DF4F8BC3B2D8DB44580081E54173AAE0D17F3C550A4AA66C2AC0B4567D12ABE640731D120C4B56F5A52007E31A4F97128A23A8E1FA
                                  Malicious:false
                                  Preview:...GAZV8UHCA..CP.GTSTAYD.BZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGDRTAW[.LZ.1.i.@|.b.8.'s$36#5#7v[0&-.D.!5p5!=t(7d...vU>,&o=5ItPGTSTAYH..w..6...F...9.5p?...<.0./...N.%w....*...9...F..Q?z....,...:..)J..=...<:..*...'...$..66..F..8x..?..m<.../..Oq....=0<...9BZV8QHCA08CPPGTS..YD.C]Vc`.&A08CPPGT.TCXOFLZVJTHCU28CPPG..WAYTGBZ.=QHC.08SPPGVSTDYEGBZV8THBA08CPPg\STEYDGBZV:QH.A0(CP@GTSTQYDWBZV8QHSA08CPPGTSTA.AB^W8QH.F0..PPGTSTAYDGBZV8QHCA0.DP.|TS.._D.BZV8QHCA08CPPGTSTAY..DZN8QH;.68.PPGTSTAYDGBZ.=Q.GA08CPPGTSTAYDGBZV8QHCA08CP~31+ AYD23_V8AHCAB=CPTGTSTAYDGBZV8QHcA0Xm"4& 2TA.=FBZ.=QH9@085UPGTSTAYDGBZV8.HC..\"$1GTS..YDGR]V8_HCA.>CPPGTSTAYDGBZ.8Q.m5\KCPPG]STAY4@BZT8QH.G08CPPGTSTAYDG.ZV../%(TKCP`ETST.^DGFZV8QOCA08CPPGTSTAY.GB.xJ": A08c.PGT.SAY.GBZR?QHCA08CPPGTST.YD.l(3T>+CA..CPP.SST}YDG.]V8QHCA08CPPGT.TA.DGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA08CPPGTSTAYDGBZV8QHCA0

                                  C:\Users\user\AppData\Local\directory\name.exe

                                  Download File
                                  Process:C:\Users\user\Desktop\cnaniAxghZ.exe
                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):106213376
                                  Entropy (8bit):7.999578812473445
                                  Encrypted:true
                                  SSDEEP:393216:o63GS6ANDQqmNsDO5JNUrjV1DrFB1hHlFp1zpj0kT77GMlnR6CelByBkTozgh96D:73GSXOKDUu1Dr37Ftf1nFR
                                  MD5:60C09330C233F3B7A6759B8A719245CA
                                  SHA1:9D391DE921942A341AB52447593DF8A5F92D39B8
                                  SHA-256:89C1BC0357A6002E303799507E9DC9D8784253AD440D03A2101033274D3F87BC
                                  SHA-512:22AC3D02FE52B9FD52F5E0D0A0BAE93B3D919A2C4D3A518C78AA953F8EF2208DA77341FD02B26F348CA344F734B94004968766B14E5267D4E3C87EC22060F30A
                                  Malicious:true
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r...........#.S..._@'.S...R.k.S....".S...RichR...................PE..L.....=f.........."...............................@.................................4O....@...@.......@.........................|...............................4q...+..............................PK..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc................4..............@..@.reloc..4q.......r...>..............@..B........................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

                                  Download File
                                  Process:C:\Users\user\AppData\Local\directory\name.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):268
                                  Entropy (8bit):3.4209455304240626
                                  Encrypted:false
                                  SSDEEP:6:DMM8lfm3OOQdUfcloRKUEZ+lX1Al1AE6nriIM8lfQVn:DsO+vNloRKQ1A1z4mA2n
                                  MD5:D3A871A22DFC23DD6763F6002299B13A
                                  SHA1:B7934BFD389FE7FBDC08710EDABA4C16D3EED618
                                  SHA-256:FEA868420602CDAF96C19BE169F6BA44178494DB3B8F6292DCD7B8A8BB194F66
                                  SHA-512:6166B8A0DED88F7C8F3CC1D92A44A0A112B4CFCBEEB3934005E89B32614C79BB7F7ABDBF8CF84D90D4864C425460673739935562B344AE14FFE1076F5D0F7CA9
                                  Malicious:true
                                  Preview:S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.d.i.r.e.c.t.o.r.y.\.n.a.m.e...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Entropy (8bit):7.29971460744594
                                  TrID:
                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                  • DOS Executable Generic (2002/1) 0.02%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:cnaniAxghZ.exe
                                  File size:1'355'776 bytes
                                  MD5:0f85ff8e8caa7715b1ed7243ebbfcf9a
                                  SHA1:5a600b6b969e4071d37936acf40cd3e2ba934262
                                  SHA256:9993b780d61a1d757de704d2b6459cbac20803e5e2a2374cbea719aaadbb1344
                                  SHA512:897ac6a505330167480da72feef5c383a864e50cc9fa0eabf97f61b4468e588caa17c319c400279e1676091fb5f308200cc523167c209685d914eafdf4f0b3db
                                  SSDEEP:24576:yAHnh+eWsN3skA4RV1Hom2KXMmHauzTyk3Ez/i0Y+ZsH7IA9H/4NZTMFd39T5:1h+ZkldoPK8YauzTykR++HcA9H/uMFdn
                                  TLSH:1C55CF0273D5C036FFABA2739B6AF60156BD79254133852F13982DB9BD701B1223E663
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

                                  File Icon

                                  Icon Hash:aaf3e3e3938382a0

                                  Static PE Info

                                  General

                                  Entrypoint:0x42800a
                                  Entrypoint Section:.text
                                  Digitally signed:false
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                  DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                  Time Stamp:0x663DACFD [Fri May 10 05:13:33 2024 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:5
                                  OS Version Minor:1
                                  File Version Major:5
                                  File Version Minor:1
                                  Subsystem Version Major:5
                                  Subsystem Version Minor:1
                                  Import Hash:afcdf79be1557326c854b6e20cb900a7

                                  Entrypoint Preview

                                  Instruction
                                  call 00007F0610CD522Dh
                                  jmp 00007F0610CC7FE4h
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  push edi
                                  push esi
                                  mov esi, dword ptr [esp+10h]
                                  mov ecx, dword ptr [esp+14h]
                                  mov edi, dword ptr [esp+0Ch]
                                  mov eax, ecx
                                  mov edx, ecx
                                  add eax, esi
                                  cmp edi, esi
                                  jbe 00007F0610CC816Ah
                                  cmp edi, eax
                                  jc 00007F0610CC84CEh
                                  bt dword ptr [004C41FCh], 01h
                                  jnc 00007F0610CC8169h
                                  rep movsb
                                  jmp 00007F0610CC847Ch
                                  cmp ecx, 00000080h
                                  jc 00007F0610CC8334h
                                  mov eax, edi
                                  xor eax, esi
                                  test eax, 0000000Fh
                                  jne 00007F0610CC8170h
                                  bt dword ptr [004BF324h], 01h
                                  jc 00007F0610CC8640h
                                  bt dword ptr [004C41FCh], 00000000h
                                  jnc 00007F0610CC830Dh
                                  test edi, 00000003h
                                  jne 00007F0610CC831Eh
                                  test esi, 00000003h
                                  jne 00007F0610CC82FDh
                                  bt edi, 02h
                                  jnc 00007F0610CC816Fh
                                  mov eax, dword ptr [esi]
                                  sub ecx, 04h
                                  lea esi, dword ptr [esi+04h]
                                  mov dword ptr [edi], eax
                                  lea edi, dword ptr [edi+04h]
                                  bt edi, 03h
                                  jnc 00007F0610CC8173h
                                  movq xmm1, qword ptr [esi]
                                  sub ecx, 08h
                                  lea esi, dword ptr [esi+08h]
                                  movq qword ptr [edi], xmm1
                                  lea edi, dword ptr [edi+08h]
                                  test esi, 00000007h
                                  je 00007F0610CC81C5h
                                  bt esi, 03h

                                  Rich Headers

                                  Programming Language:
                                  • [ASM] VS2013 build 21005
                                  • [ C ] VS2013 build 21005
                                  • [C++] VS2013 build 21005
                                  • [ C ] VS2008 SP1 build 30729
                                  • [IMP] VS2008 SP1 build 30729
                                  • [ASM] VS2013 UPD5 build 40629
                                  • [RES] VS2013 build 21005
                                  • [LNK] VS2013 UPD5 build 40629

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xbc0cc0x17c.rdata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xc80000x80900.rsrc
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x1490000x7134.reloc
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x92bc00x1c.rdata
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa4b500x40.rdata
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x8f0000x884.rdata
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  .text0x10000x8dfdd0x8e000310e36668512d53489c005622bb1b4a9False0.5735602580325704data6.675248351711057IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  .rdata0x8f0000x2fd8e0x2fe00748cf1ab2605ce1fd72d53d912abb68fFalse0.32828818537859006data5.763244005758284IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .data0xbf0000x8f740x5200aae9601d920f07080bdfadf43dfeff12False0.1017530487804878data1.1963819235530628IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .rsrc0xc80000x809000x80a0057558a9a495231a7952b9cb771ec0574False0.9489093628522838data7.937521312683499IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .reloc0x1490000x71340x7200f04128ad0f87f42830e4a6cdbc38c719False0.7617530153508771data6.783955557128661IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                  Resources

                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                  RT_ICON0xc85a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                  RT_ICON0xc86d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                  RT_ICON0xc87f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                  RT_ICON0xc89200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                  RT_ICON0xc8c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                  RT_ICON0xc8d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                  RT_ICON0xc9bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                  RT_ICON0xca4800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                  RT_ICON0xca9e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                  RT_ICON0xccf900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                  RT_ICON0xce0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                  RT_MENU0xce4a00x50dataEnglishGreat Britain0.9
                                  RT_STRING0xce4f00x594dataEnglishGreat Britain0.3333333333333333
                                  RT_STRING0xcea840x68adataEnglishGreat Britain0.2747909199522103
                                  RT_STRING0xcf1100x490dataEnglishGreat Britain0.3715753424657534
                                  RT_STRING0xcf5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                  RT_STRING0xcfb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                  RT_STRING0xd01f80x466dataEnglishGreat Britain0.3605683836589698
                                  RT_STRING0xd06600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                  RT_RCDATA0xd07b80x77b98data1.0003181128566534
                                  RT_GROUP_ICON0x1483500x76dataEnglishGreat Britain0.6610169491525424
                                  RT_GROUP_ICON0x1483c80x14dataEnglishGreat Britain1.25
                                  RT_GROUP_ICON0x1483dc0x14dataEnglishGreat Britain1.15
                                  RT_GROUP_ICON0x1483f00x14dataEnglishGreat Britain1.25
                                  RT_VERSION0x1484040x10cdataEnglishGreat Britain0.5970149253731343
                                  RT_MANIFEST0x1485100x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                  Imports

                                  DLLImport
                                  WSOCK32.dllWSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
                                  VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                  WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                  COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                  MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                  WININET.dllInternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
                                  PSAPI.DLLGetProcessMemoryInfo
                                  IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                  USERENV.dllDestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
                                  UxTheme.dllIsThemeActive
                                  KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
                                  USER32.dllAdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
                                  GDI32.dllStrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
                                  COMDLG32.dllGetOpenFileNameW, GetSaveFileNameW
                                  ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
                                  SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                  ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
                                  OLEAUT32.dllLoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

                                  Possible Origin

                                  Language of compilation systemCountry where language is spokenMap
                                  EnglishGreat Britain

                                  Network Behavior

                                  Snort IDS Alerts

                                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                  07/03/24-14:50:54.905973TCP2032776ET TROJAN Remcos 3.x Unencrypted Checkin497378087192.168.2.4107.175.229.139
                                  07/03/24-14:50:55.983200TCP2032777ET TROJAN Remcos 3.x Unencrypted Server Response808749737107.175.229.139192.168.2.4

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Jul 3, 2024 14:50:54.899487972 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:54.904473066 CEST808749737107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:54.904659986 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:54.905972958 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:54.911597013 CEST808749737107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:55.983200073 CEST808749737107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:55.985121012 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:55.990083933 CEST808749737107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.093238115 CEST808749737107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.095649004 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.100626945 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.102797985 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.102871895 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.108067989 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.140104055 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.157850981 CEST4973980192.168.2.4178.237.33.50
                                  Jul 3, 2024 14:50:56.162822008 CEST8049739178.237.33.50192.168.2.4
                                  Jul 3, 2024 14:50:56.162909031 CEST4973980192.168.2.4178.237.33.50
                                  Jul 3, 2024 14:50:56.163086891 CEST4973980192.168.2.4178.237.33.50
                                  Jul 3, 2024 14:50:56.168320894 CEST8049739178.237.33.50192.168.2.4
                                  Jul 3, 2024 14:50:56.700468063 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700500011 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700512886 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700584888 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.700640917 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700653076 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700664997 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700676918 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700684071 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.700707912 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.700825930 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700839043 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700850010 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.700875998 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.700901985 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.705534935 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.705601931 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.705658913 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.770365000 CEST8049739178.237.33.50192.168.2.4
                                  Jul 3, 2024 14:50:56.770447969 CEST4973980192.168.2.4178.237.33.50
                                  Jul 3, 2024 14:50:56.784698009 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.787683010 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.787704945 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.787722111 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.787760019 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.787831068 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.787842989 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.787874937 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.788146019 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.788156033 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.788192987 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.788243055 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.788254023 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.788265944 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.788295031 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.788330078 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.789211035 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.789222002 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.789233923 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.789263964 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.789349079 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.789369106 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.789391994 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.790581942 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.790628910 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.790631056 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.790642977 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.790697098 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.790749073 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.790760040 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.790791988 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.792432070 CEST808749737107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.793868065 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.796819925 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.796865940 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.827790022 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.827821016 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.827878952 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.875650883 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.875685930 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.875718117 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.875729084 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.875730038 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.875766993 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.875838995 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876121998 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876133919 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876168013 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876171112 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.876179934 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876205921 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.876576900 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876588106 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876599073 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876641035 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.876641035 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.876684904 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876698017 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.876725912 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.877360106 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.877418995 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.877429962 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.877456903 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.877521038 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.877532005 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.877558947 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.878253937 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.878293991 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.878303051 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.878319025 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.878353119 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.878607988 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.878618956 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.878655910 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.879312992 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.879410028 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.879420042 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.879456043 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.879470110 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.879481077 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.879512072 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.879877090 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.879894972 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.879915953 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.892039061 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892059088 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892070055 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892097950 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.892121077 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.892209053 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892220974 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892230988 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892244101 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892251968 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.892292976 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.892505884 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892524004 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892638922 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892642975 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.892651081 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892663002 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.892700911 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.956149101 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.956171989 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.956182957 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.956264973 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.963121891 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963172913 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963176966 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.963184118 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963242054 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.963331938 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963345051 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963392019 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.963395119 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963407040 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963453054 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.963521957 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963583946 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963594913 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963625908 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.963713884 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963726044 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963737011 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.963757992 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.963794947 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.964184046 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964286089 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964298010 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964339018 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.964371920 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964503050 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.964534044 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964637995 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964648962 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964698076 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.964726925 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964739084 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964750051 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964761972 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964767933 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.964804888 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.964921951 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964932919 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.964962959 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.965620995 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.965666056 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.965688944 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.965702057 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.965745926 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.965836048 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.965847969 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.965859890 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.965871096 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.965888977 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.965910912 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.966191053 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.966274977 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.966289043 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.966319084 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.966387033 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.966398954 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.966409922 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.966475010 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.967766047 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.967895985 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.967907906 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.967942953 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.967951059 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.967966080 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.967987061 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.968054056 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.968065023 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.968075991 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.968127012 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.968127012 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.968138933 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.968501091 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.968544960 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.968571901 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.968583107 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.968622923 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.979782104 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.979813099 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.979825020 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.979856968 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.979928017 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.979939938 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.979979038 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.980053902 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980066061 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980093956 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.980144978 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980156898 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980168104 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980180025 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980192900 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.980233908 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.980300903 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980350018 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.980400085 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980412006 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980448961 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.980479002 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980496883 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980536938 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.980716944 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980729103 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.980772972 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.981049061 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.981066942 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.981080055 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.981091976 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.981102943 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.981112957 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.981118917 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:56.981125116 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:56.981151104 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.030760050 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.044047117 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.044060946 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.044071913 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.044150114 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.044166088 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.044177055 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.044214010 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051070929 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051083088 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051094055 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051124096 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051156044 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051158905 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051170111 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051189899 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051255941 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051345110 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051356077 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051367044 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051378965 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051414967 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051414967 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051585913 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051597118 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051606894 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051618099 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051628113 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051640034 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051641941 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051641941 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051670074 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051827908 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051878929 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.051891088 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051906109 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.051970005 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052000046 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052011013 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052057981 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052081108 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052167892 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052179098 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052220106 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052310944 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052321911 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052334070 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052357912 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052438021 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052540064 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052551985 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052562952 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052635908 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052709103 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052721024 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052731991 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052743912 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052755117 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052763939 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052769899 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052782059 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.052791119 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052812099 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.052839041 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.053024054 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053035021 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053045034 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053091049 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.053468943 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053508043 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053522110 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053546906 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.053564072 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.053669930 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053682089 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053692102 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053703070 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053730965 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.053754091 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.053914070 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053925991 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053936958 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053951979 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053963900 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053975105 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.053989887 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.054012060 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.054044008 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.054424047 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054480076 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054491997 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054544926 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.054615021 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054626942 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054637909 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054651022 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054655075 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.054677010 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.054860115 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054876089 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054887056 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054898024 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054908991 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054915905 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.054924011 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.054949045 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.055413008 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.055459023 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.055509090 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.055521011 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.055561066 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.056080103 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056099892 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056111097 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056143045 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.056260109 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056271076 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056281090 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056293964 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056302071 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.056349039 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.056458950 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056469917 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056493044 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056503057 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056504965 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.056514025 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056525946 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056545973 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.056559086 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.056633949 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.056718111 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.067440987 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067749977 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067760944 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067771912 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067783117 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067800045 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.067812920 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067820072 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.067823887 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067837954 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067848921 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067848921 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.067859888 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.067877054 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.067903996 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.068160057 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068170071 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068181992 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068192959 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068203926 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068214893 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068222046 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.068253040 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.068435907 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068447113 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068458080 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068468094 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068485022 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.068480015 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068500042 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.068520069 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.068547964 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.131690979 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.131712914 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.131722927 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.131793022 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.131850958 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.131861925 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.131871939 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.131894112 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.131903887 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.131933928 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.139153004 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139192104 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139203072 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139224052 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.139251947 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.139343023 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139353037 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139367104 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139379025 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139396906 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.139415979 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.139585018 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139595985 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139605999 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139616013 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139626026 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139636040 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139647007 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139647007 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.139676094 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.139883041 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.139930964 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140006065 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140017033 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140029907 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140041113 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140050888 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140079975 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140261889 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140273094 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140324116 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140331030 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140342951 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140352964 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140364885 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140364885 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140371084 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140379906 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140407085 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140839100 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140849113 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140858889 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140868902 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140880108 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140883923 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140885115 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140891075 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140899897 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140908003 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140911102 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140921116 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140932083 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.140939951 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140961885 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.140978098 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.141287088 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141297102 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141307116 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141318083 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141331911 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.141362906 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.141370058 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141381025 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141386032 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141395092 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141401052 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141411066 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141421080 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141432047 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141432047 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.141443014 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141453981 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.141458988 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.141473055 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.141504049 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.142113924 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142124891 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142137051 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142147064 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142158031 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142167091 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142183065 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142193079 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142195940 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.142195940 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.142205000 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142215967 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142226934 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142235994 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142239094 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.142242908 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142254114 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142258883 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142260075 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.142270088 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142280102 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.142308950 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.142339945 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.143673897 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.143723011 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.143755913 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.143767118 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.143802881 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.143811941 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.143822908 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.143858910 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.143933058 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.143944025 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.143984079 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.144058943 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.144069910 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.144081116 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.144092083 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.144098997 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.144105911 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.144125938 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.144318104 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.144329071 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.144360065 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.155400991 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155411959 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155421972 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155472040 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.155488968 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155489922 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.155527115 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155536890 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155564070 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.155680895 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155690908 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155699015 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155723095 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.155731916 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.155925035 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155935049 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155944109 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155952930 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155961990 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155966043 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.155972004 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.155982018 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.156006098 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.156232119 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.156240940 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.156250954 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.156260014 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.156270027 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.156378031 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.219360113 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219392061 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219403028 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219491005 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.219511986 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219525099 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219569921 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.219589949 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219600916 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219624043 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.219640017 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.219665051 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227024078 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227077007 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227087975 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227138996 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227226973 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227241993 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227252960 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227267027 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227277994 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227298021 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227487087 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227503061 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227514982 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227524996 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227535963 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227545977 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227556944 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227556944 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227567911 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227569103 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227579117 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.227606058 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227626085 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.227869987 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228056908 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228071928 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228081942 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228092909 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228104115 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228110075 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228115082 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228125095 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228130102 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228137016 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228147984 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228148937 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228163004 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228168011 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228178978 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228189945 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228193045 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228200912 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228218079 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228244066 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228684902 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228697062 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228708029 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228718996 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228730917 CEST808749738107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:57.228739977 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.228775024 CEST497388087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:57.768867016 CEST8049739178.237.33.50192.168.2.4
                                  Jul 3, 2024 14:50:57.772344112 CEST4973980192.168.2.4178.237.33.50
                                  Jul 3, 2024 14:50:58.084810019 CEST808749737107.175.229.139192.168.2.4
                                  Jul 3, 2024 14:50:58.140093088 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:58.247493029 CEST497378087192.168.2.4107.175.229.139
                                  Jul 3, 2024 14:50:58.252459049 CEST808749737107.175.229.139192.168.2.4

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Jul 3, 2024 14:50:56.142766953 CEST6183353192.168.2.41.1.1.1
                                  Jul 3, 2024 14:50:56.151134968 CEST53618331.1.1.1192.168.2.4

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Jul 3, 2024 14:50:56.142766953 CEST192.168.2.41.1.1.10x143aStandard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Jul 3, 2024 14:50:56.151134968 CEST1.1.1.1192.168.2.40x143aNo error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                  HTTP Request Dependency Graph

                                  • geoplugin.net

                                  HTTP Packets

                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                  0192.168.2.449739178.237.33.50808084C:\Windows\SysWOW64\svchost.exe
                                  TimestampBytes transferredDirectionData
                                  Jul 3, 2024 14:50:56.163086891 CEST71OUTGET /json.gp HTTP/1.1
                                  Host: geoplugin.net
                                  Cache-Control: no-cache
                                  Jul 3, 2024 14:50:56.770365000 CEST1170INHTTP/1.1 200 OK
                                  date: Wed, 03 Jul 2024 12:50:56 GMT
                                  server: Apache
                                  content-length: 962
                                  content-type: application/json; charset=utf-8
                                  cache-control: public, max-age=300
                                  access-control-allow-origin: *
                                  Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED]
                                  Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:08:48:54
                                  Start date:03/07/2024
                                  Path:C:\Users\user\Desktop\cnaniAxghZ.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\cnaniAxghZ.exe"
                                  Imagebase:0x10000
                                  File size:1'355'776 bytes
                                  MD5 hash:0F85FF8E8CAA7715B1ED7243EBBFCF9A
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:5
                                  Start time:08:50:52
                                  Start date:03/07/2024
                                  Path:C:\Users\user\AppData\Local\directory\name.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\cnaniAxghZ.exe"
                                  Imagebase:0xa0000
                                  File size:106'213'376 bytes
                                  MD5 hash:60C09330C233F3B7A6759B8A719245CA
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000005.00000002.2821566748.0000000003F20000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:6
                                  Start time:08:50:53
                                  Start date:03/07/2024
                                  Path:C:\Windows\SysWOW64\svchost.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\cnaniAxghZ.exe"
                                  Imagebase:0xea0000
                                  File size:46'504 bytes
                                  MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.2877207597.0000000003000000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000006.00000002.2876639458.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.2877257882.0000000003012000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:moderate
                                  Has exited:false

                                  General

                                  Target ID:7
                                  Start time:08:50:56
                                  Start date:03/07/2024
                                  Path:C:\Windows\SysWOW64\svchost.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\ncqkhweaghcgworcchyfyhlbjpqn"
                                  Imagebase:0xea0000
                                  File size:46'504 bytes
                                  MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:moderate
                                  Has exited:true

                                  General

                                  Target ID:8
                                  Start time:08:50:56
                                  Start date:03/07/2024
                                  Path:C:\Windows\SysWOW64\svchost.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\qwvdipptuputyufolskgjmgkrwiwkdi"
                                  Imagebase:0xea0000
                                  File size:46'504 bytes
                                  MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:moderate
                                  Has exited:true

                                  General

                                  Target ID:9
                                  Start time:08:50:56
                                  Start date:03/07/2024
                                  Path:C:\Windows\SysWOW64\svchost.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\aybv"
                                  Imagebase:0xea0000
                                  File size:46'504 bytes
                                  MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:moderate
                                  Has exited:true

                                  General

                                  Target ID:12
                                  Start time:08:50:57
                                  Start date:03/07/2024
                                  Path:C:\Windows\SysWOW64\WerFault.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 8084 -s 1288
                                  Imagebase:0x150000
                                  File size:483'680 bytes
                                  MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:false

                                  Disassembly

                                  Reset < >

                                    Execution Graph

                                    Execution Coverage:3.7%
                                    Dynamic/Decrypted Code Coverage:0.4%
                                    Signature Coverage:6%
                                    Total number of Nodes:2000
                                    Total number of Limit Nodes:182
                                    execution_graph 97556 37e93 97557 37e9f _raise 97556->97557 97593 3a048 GetStartupInfoW 97557->97593 97559 37ea4 97595 38dbc GetProcessHeap 97559->97595 97561 37efc 97562 37f07 97561->97562 97678 37fe3 58 API calls 3 library calls 97561->97678 97596 39d26 97562->97596 97565 37f0d 97566 37f18 __RTC_Initialize 97565->97566 97679 37fe3 58 API calls 3 library calls 97565->97679 97617 3d812 97566->97617 97569 37f27 97570 37f33 GetCommandLineW 97569->97570 97680 37fe3 58 API calls 3 library calls 97569->97680 97636 45173 GetEnvironmentStringsW 97570->97636 97574 37f32 97574->97570 97576 37f4d 97577 37f58 97576->97577 97681 332f5 58 API calls 3 library calls 97576->97681 97646 44fa8 97577->97646 97580 37f5e 97581 37f69 97580->97581 97682 332f5 58 API calls 3 library calls 97580->97682 97660 3332f 97581->97660 97584 37f71 97585 37f7c __wwincmdln 97584->97585 97683 332f5 58 API calls 3 library calls 97584->97683 97666 1492e 97585->97666 97588 37f90 97589 37f9f 97588->97589 97684 33598 58 API calls _doexit 97588->97684 97685 33320 58 API calls _doexit 97589->97685 97592 37fa4 _raise 97594 3a05e 97593->97594 97594->97559 97595->97561 97686 333c7 36 API calls 2 library calls 97596->97686 97598 39d2b 97687 39f7c InitializeCriticalSectionAndSpinCount __mtinitlocknum 97598->97687 97600 39d30 97601 39d34 97600->97601 97689 39fca TlsAlloc 97600->97689 97688 39d9c 61 API calls 2 library calls 97601->97688 97604 39d39 97604->97565 97605 39d46 97605->97601 97606 39d51 97605->97606 97690 38a15 97606->97690 97609 39d93 97698 39d9c 61 API calls 2 library calls 97609->97698 97612 39d98 97612->97565 97613 39d72 97613->97609 97614 39d78 97613->97614 97697 39c73 58 API calls 4 library calls 97614->97697 97616 39d80 GetCurrentThreadId 97616->97565 97618 3d81e _raise 97617->97618 97710 39e4b 97618->97710 97620 3d825 97621 38a15 __calloc_crt 58 API calls 97620->97621 97623 3d836 97621->97623 97622 3d8a1 GetStartupInfoW 97624 3d8b6 97622->97624 97633 3d9e5 97622->97633 97623->97622 97625 3d841 _raise @_EH4_CallFilterFunc@8 97623->97625 97628 38a15 __calloc_crt 58 API calls 97624->97628 97631 3d904 97624->97631 97624->97633 97625->97569 97626 3daad 97719 3dabd LeaveCriticalSection _doexit 97626->97719 97628->97624 97629 3da32 GetStdHandle 97629->97633 97630 3da45 GetFileType 97630->97633 97632 3d938 GetFileType 97631->97632 97631->97633 97717 3a06b InitializeCriticalSectionAndSpinCount 97631->97717 97632->97631 97633->97626 97633->97629 97633->97630 97718 3a06b InitializeCriticalSectionAndSpinCount 97633->97718 97637 45184 97636->97637 97638 37f43 97636->97638 97759 38a5d 58 API calls 2 library calls 97637->97759 97642 44d6b GetModuleFileNameW 97638->97642 97640 451aa _memmove 97641 451c0 FreeEnvironmentStringsW 97640->97641 97641->97638 97643 44d9f _wparse_cmdline 97642->97643 97645 44ddf _wparse_cmdline 97643->97645 97760 38a5d 58 API calls 2 library calls 97643->97760 97645->97576 97647 44fc1 __NMSG_WRITE 97646->97647 97651 44fb9 97646->97651 97648 38a15 __calloc_crt 58 API calls 97647->97648 97656 44fea __NMSG_WRITE 97648->97656 97649 45041 97650 32f95 _free 58 API calls 97649->97650 97650->97651 97651->97580 97652 38a15 __calloc_crt 58 API calls 97652->97656 97653 45066 97655 32f95 _free 58 API calls 97653->97655 97655->97651 97656->97649 97656->97651 97656->97652 97656->97653 97657 4507d 97656->97657 97761 44857 58 API calls 2 library calls 97656->97761 97762 39006 IsProcessorFeaturePresent 97657->97762 97659 45089 97659->97580 97661 3333b __IsNonwritableInCurrentImage 97660->97661 97785 3a711 97661->97785 97663 33359 __initterm_e 97665 33378 _doexit __IsNonwritableInCurrentImage 97663->97665 97788 32f80 97663->97788 97665->97584 97667 14948 97666->97667 97677 149e7 97666->97677 97668 14982 IsThemeActive 97667->97668 97823 335ac 97668->97823 97672 149ae 97835 14a5b SystemParametersInfoW SystemParametersInfoW 97672->97835 97674 149ba 97836 13b4c 97674->97836 97676 149c2 SystemParametersInfoW 97676->97677 97677->97588 97678->97562 97679->97566 97680->97574 97684->97589 97685->97592 97686->97598 97687->97600 97688->97604 97689->97605 97692 38a1c 97690->97692 97693 38a57 97692->97693 97695 38a3a 97692->97695 97699 45446 97692->97699 97693->97609 97696 3a026 TlsSetValue 97693->97696 97695->97692 97695->97693 97707 3a372 Sleep 97695->97707 97696->97613 97697->97616 97698->97612 97700 45451 97699->97700 97706 4546c 97699->97706 97701 4545d 97700->97701 97700->97706 97708 38d68 58 API calls __getptd_noexit 97701->97708 97703 4547c HeapAlloc 97704 45462 97703->97704 97703->97706 97704->97692 97706->97703 97706->97704 97709 335e1 DecodePointer 97706->97709 97707->97695 97708->97704 97709->97706 97711 39e6f EnterCriticalSection 97710->97711 97712 39e5c 97710->97712 97711->97620 97720 39ed3 97712->97720 97714 39e62 97714->97711 97744 332f5 58 API calls 3 library calls 97714->97744 97717->97631 97718->97633 97719->97625 97721 39edf _raise 97720->97721 97722 39f00 97721->97722 97723 39ee8 97721->97723 97736 39f21 _raise 97722->97736 97748 38a5d 58 API calls 2 library calls 97722->97748 97745 3a3ab 58 API calls __NMSG_WRITE 97723->97745 97726 39eed 97746 3a408 58 API calls 5 library calls 97726->97746 97727 39f15 97729 39f2b 97727->97729 97730 39f1c 97727->97730 97733 39e4b __lock 58 API calls 97729->97733 97749 38d68 58 API calls __getptd_noexit 97730->97749 97731 39ef4 97747 332df GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 97731->97747 97737 39f32 97733->97737 97736->97714 97738 39f57 97737->97738 97739 39f3f 97737->97739 97751 32f95 97738->97751 97750 3a06b InitializeCriticalSectionAndSpinCount 97739->97750 97742 39f4b 97757 39f73 LeaveCriticalSection _doexit 97742->97757 97745->97726 97746->97731 97748->97727 97749->97736 97750->97742 97752 32fc7 _free 97751->97752 97753 32f9e RtlFreeHeap 97751->97753 97752->97742 97753->97752 97754 32fb3 97753->97754 97758 38d68 58 API calls __getptd_noexit 97754->97758 97756 32fb9 GetLastError 97756->97752 97757->97736 97758->97756 97759->97640 97760->97645 97761->97656 97763 39011 97762->97763 97768 38e99 97763->97768 97767 3902c 97767->97659 97769 38eb3 _memset ___raise_securityfailure 97768->97769 97770 38ed3 IsDebuggerPresent 97769->97770 97776 3a395 SetUnhandledExceptionFilter UnhandledExceptionFilter 97770->97776 97773 38f97 ___raise_securityfailure 97777 3c836 97773->97777 97774 38fba 97775 3a380 GetCurrentProcess TerminateProcess 97774->97775 97775->97767 97776->97773 97778 3c840 IsProcessorFeaturePresent 97777->97778 97779 3c83e 97777->97779 97781 45b5a 97778->97781 97779->97774 97784 45b09 5 API calls ___raise_securityfailure 97781->97784 97783 45c3d 97783->97774 97784->97783 97786 3a714 EncodePointer 97785->97786 97786->97786 97787 3a72e 97786->97787 97787->97663 97791 32e84 97788->97791 97790 32f8b 97790->97665 97792 32e90 _raise 97791->97792 97799 33457 97792->97799 97798 32eb7 _raise 97798->97790 97800 39e4b __lock 58 API calls 97799->97800 97801 32e99 97800->97801 97802 32ec8 DecodePointer DecodePointer 97801->97802 97803 32ea5 97802->97803 97804 32ef5 97802->97804 97813 32ec2 97803->97813 97804->97803 97816 389e4 59 API calls 2 library calls 97804->97816 97806 32f58 EncodePointer EncodePointer 97806->97803 97807 32f2c 97807->97803 97811 32f46 EncodePointer 97807->97811 97818 38aa4 61 API calls __realloc_crt 97807->97818 97808 32f07 97808->97806 97808->97807 97817 38aa4 61 API calls __realloc_crt 97808->97817 97811->97806 97812 32f40 97812->97803 97812->97811 97819 33460 97813->97819 97816->97808 97817->97807 97818->97812 97822 39fb5 LeaveCriticalSection 97819->97822 97821 32ec7 97821->97798 97822->97821 97824 39e4b __lock 58 API calls 97823->97824 97825 335b7 DecodePointer EncodePointer 97824->97825 97888 39fb5 LeaveCriticalSection 97825->97888 97827 149a7 97828 33614 97827->97828 97829 33638 97828->97829 97830 3361e 97828->97830 97829->97672 97830->97829 97889 38d68 58 API calls __getptd_noexit 97830->97889 97832 33628 97890 38ff6 9 API calls _raise 97832->97890 97834 33633 97834->97672 97835->97674 97837 13b59 __write_nolock 97836->97837 97891 177c7 97837->97891 97841 13b8c IsDebuggerPresent 97842 4d4ad MessageBoxA 97841->97842 97843 13b9a 97841->97843 97846 4d4c7 97842->97846 97844 13c73 97843->97844 97843->97846 97847 13bb7 97843->97847 97845 13c7a SetCurrentDirectoryW 97844->97845 97850 13c87 Mailbox 97845->97850 98115 17373 59 API calls Mailbox 97846->98115 97977 173e5 97847->97977 97850->97676 97851 4d4d7 97856 4d4ed SetCurrentDirectoryW 97851->97856 97853 13bd5 GetFullPathNameW 97993 17d2c 97853->97993 97855 13c10 98002 20a8d 97855->98002 97856->97850 97859 13c2e 97860 13c38 97859->97860 98116 74c03 AllocateAndInitializeSid CheckTokenMembership FreeSid 97859->98116 98018 13a58 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 97860->98018 97864 4d50a 97864->97860 97867 4d51b 97864->97867 97866 13c42 97869 13c55 97866->97869 98026 143db 97866->98026 98117 14864 97867->98117 97888->97827 97889->97832 97890->97834 98144 30ff6 97891->98144 97893 177e8 97894 30ff6 Mailbox 59 API calls 97893->97894 97895 13b63 GetCurrentDirectoryW 97894->97895 97896 13778 97895->97896 97897 177c7 59 API calls 97896->97897 97898 1378e 97897->97898 98182 13d43 97898->98182 97900 137ac 97901 14864 61 API calls 97900->97901 97902 137c0 97901->97902 97903 17f41 59 API calls 97902->97903 97904 137cd 97903->97904 98196 14f3d 97904->98196 97907 4d3ae 98267 797e5 97907->98267 97908 137ee Mailbox 98220 181a7 97908->98220 97911 4d3cd 97914 32f95 _free 58 API calls 97911->97914 97916 4d3da 97914->97916 97918 14faa 84 API calls 97916->97918 97920 4d3e3 97918->97920 97924 13ee2 59 API calls 97920->97924 97921 17f41 59 API calls 97922 1381a 97921->97922 98227 18620 97922->98227 97926 4d3fe 97924->97926 97925 1382c Mailbox 97927 17f41 59 API calls 97925->97927 97928 13ee2 59 API calls 97926->97928 97929 13852 97927->97929 97930 4d41a 97928->97930 97931 18620 69 API calls 97929->97931 97932 14864 61 API calls 97930->97932 97934 13861 Mailbox 97931->97934 97933 4d43f 97932->97933 97935 13ee2 59 API calls 97933->97935 97937 177c7 59 API calls 97934->97937 97936 4d44b 97935->97936 97938 181a7 59 API calls 97936->97938 97939 1387f 97937->97939 97940 4d459 97938->97940 98231 13ee2 97939->98231 97942 13ee2 59 API calls 97940->97942 97944 4d468 97942->97944 97950 181a7 59 API calls 97944->97950 97946 13899 97946->97920 97947 138a3 97946->97947 97948 3313d _W_store_winword 60 API calls 97947->97948 97949 138ae 97948->97949 97949->97926 97951 138b8 97949->97951 97952 4d48a 97950->97952 97953 3313d _W_store_winword 60 API calls 97951->97953 97954 13ee2 59 API calls 97952->97954 97955 138c3 97953->97955 97956 4d497 97954->97956 97955->97930 97957 138cd 97955->97957 97956->97956 97958 3313d _W_store_winword 60 API calls 97957->97958 97961 138d8 97958->97961 97959 13919 97959->97944 97960 13926 97959->97960 98247 1942e 97960->98247 97961->97944 97961->97959 97962 13ee2 59 API calls 97961->97962 97964 138fc 97962->97964 97966 181a7 59 API calls 97964->97966 97968 1390a 97966->97968 97970 13ee2 59 API calls 97968->97970 97970->97959 97972 193ea 59 API calls 97974 13961 97972->97974 97973 19040 60 API calls 97973->97974 97974->97972 97974->97973 97975 13ee2 59 API calls 97974->97975 97976 139a7 Mailbox 97974->97976 97975->97974 97976->97841 97978 173f2 __write_nolock 97977->97978 97979 1740b 97978->97979 97980 4ee4b _memset 97978->97980 99126 148ae 97979->99126 97982 4ee67 GetOpenFileNameW 97980->97982 97984 4eeb6 97982->97984 97986 17d2c 59 API calls 97984->97986 97988 4eecb 97986->97988 97988->97988 97990 17429 99154 169ca 97990->99154 97994 17da5 97993->97994 97995 17d38 __NMSG_WRITE 97993->97995 97996 17e8c 59 API calls 97994->97996 97997 17d73 97995->97997 97998 17d4e 97995->97998 98001 17d56 _memmove 97996->98001 98000 18189 59 API calls 97997->98000 99483 18087 59 API calls Mailbox 97998->99483 98000->98001 98001->97855 98003 20a9a __write_nolock 98002->98003 99484 16ee0 98003->99484 98005 20a9f 98017 13c26 98005->98017 99495 212fe 89 API calls 98005->99495 98007 20aac 98007->98017 99496 24047 91 API calls Mailbox 98007->99496 98009 20ab5 98010 20ab9 GetFullPathNameW 98009->98010 98009->98017 98011 17d2c 59 API calls 98010->98011 98012 20ae5 98011->98012 98013 17d2c 59 API calls 98012->98013 98014 20af2 98013->98014 98016 550d5 _wcscat 98014->98016 98017->97851 98017->97859 98019 13ac2 LoadImageW RegisterClassExW 98018->98019 98020 4d49c 98018->98020 99499 13041 7 API calls 98019->99499 99500 148fe LoadImageW EnumResourceNamesW 98020->99500 98023 13b46 98025 139e7 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 98023->98025 98024 4d4a5 98025->97866 98115->97851 98116->97864 98118 41b90 __write_nolock 98117->98118 98119 14871 GetModuleFileNameW 98118->98119 98120 17f41 59 API calls 98119->98120 98121 14897 98120->98121 98147 30ffe 98144->98147 98146 31018 98146->97893 98147->98146 98149 3101c std::exception::exception 98147->98149 98154 3594c 98147->98154 98171 335e1 DecodePointer 98147->98171 98172 387db RaiseException 98149->98172 98151 31046 98173 38711 58 API calls _free 98151->98173 98153 31058 98153->97893 98155 359c7 98154->98155 98164 35958 98154->98164 98180 335e1 DecodePointer 98155->98180 98157 359cd 98181 38d68 58 API calls __getptd_noexit 98157->98181 98160 3598b RtlAllocateHeap 98161 359bf 98160->98161 98160->98164 98161->98147 98163 359b3 98178 38d68 58 API calls __getptd_noexit 98163->98178 98164->98160 98164->98163 98165 35963 98164->98165 98169 359b1 98164->98169 98177 335e1 DecodePointer 98164->98177 98165->98164 98174 3a3ab 58 API calls __NMSG_WRITE 98165->98174 98175 3a408 58 API calls 5 library calls 98165->98175 98176 332df GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 98165->98176 98179 38d68 58 API calls __getptd_noexit 98169->98179 98171->98147 98172->98151 98173->98153 98174->98165 98175->98165 98177->98164 98178->98169 98179->98161 98180->98157 98181->98161 98183 13d50 __write_nolock 98182->98183 98184 17d2c 59 API calls 98183->98184 98189 13eb6 Mailbox 98183->98189 98186 13d82 98184->98186 98194 13db8 Mailbox 98186->98194 98308 17b52 98186->98308 98187 17b52 59 API calls 98187->98194 98188 13e89 98188->98189 98190 17f41 59 API calls 98188->98190 98189->97900 98192 13eaa 98190->98192 98191 17f41 59 API calls 98191->98194 98193 13f84 59 API calls 98192->98193 98193->98189 98194->98187 98194->98188 98194->98189 98194->98191 98311 13f84 98194->98311 98321 14d13 98196->98321 98201 14f68 LoadLibraryExW 98331 14cc8 98201->98331 98202 4dd0f 98203 14faa 84 API calls 98202->98203 98205 4dd16 98203->98205 98207 14cc8 3 API calls 98205->98207 98209 4dd1e 98207->98209 98357 1506b 98209->98357 98210 14f8f 98210->98209 98211 14f9b 98210->98211 98212 14faa 84 API calls 98211->98212 98214 137e6 98212->98214 98214->97907 98214->97908 98217 4dd45 98363 15027 98217->98363 98219 4dd52 98221 181b2 98220->98221 98222 13801 98220->98222 98788 180d7 59 API calls 2 library calls 98221->98788 98224 193ea 98222->98224 98225 30ff6 Mailbox 59 API calls 98224->98225 98226 1380d 98225->98226 98226->97921 98228 1862b 98227->98228 98230 18652 98228->98230 98789 18b13 69 API calls Mailbox 98228->98789 98230->97925 98232 13f05 98231->98232 98233 13eec 98231->98233 98235 17d2c 59 API calls 98232->98235 98234 181a7 59 API calls 98233->98234 98236 1388b 98234->98236 98235->98236 98237 3313d 98236->98237 98238 33149 98237->98238 98239 331be 98237->98239 98242 3316e 98238->98242 98790 38d68 58 API calls __getptd_noexit 98238->98790 98792 331d0 60 API calls 4 library calls 98239->98792 98241 331cb 98241->97946 98242->97946 98244 33155 98791 38ff6 9 API calls _raise 98244->98791 98246 33160 98246->97946 98248 19436 98247->98248 98249 30ff6 Mailbox 59 API calls 98248->98249 98250 19444 98249->98250 98251 13936 98250->98251 98793 1935c 59 API calls Mailbox 98250->98793 98253 191b0 98251->98253 98794 192c0 98253->98794 98255 191bf 98256 30ff6 Mailbox 59 API calls 98255->98256 98257 13944 98255->98257 98256->98257 98258 19040 98257->98258 98259 4f5a5 98258->98259 98261 19057 98258->98261 98259->98261 98804 18d3b 59 API calls Mailbox 98259->98804 98262 191a0 98261->98262 98263 19158 98261->98263 98266 1915f 98261->98266 98803 19e9c 60 API calls Mailbox 98262->98803 98265 30ff6 Mailbox 59 API calls 98263->98265 98265->98266 98266->97974 98268 15045 85 API calls 98267->98268 98269 79854 98268->98269 98805 799be 96 API calls 2 library calls 98269->98805 98271 79866 98272 1506b 74 API calls 98271->98272 98300 4d3c1 98271->98300 98273 79881 98272->98273 98274 1506b 74 API calls 98273->98274 98275 79891 98274->98275 98276 1506b 74 API calls 98275->98276 98277 798ac 98276->98277 98278 1506b 74 API calls 98277->98278 98279 798c7 98278->98279 98280 15045 85 API calls 98279->98280 98281 798de 98280->98281 98282 3594c __crtGetStringTypeA_stat 58 API calls 98281->98282 98283 798e5 98282->98283 98284 3594c __crtGetStringTypeA_stat 58 API calls 98283->98284 98285 798ef 98284->98285 98286 1506b 74 API calls 98285->98286 98287 79903 98286->98287 98806 79393 GetSystemTimeAsFileTime 98287->98806 98289 79916 98290 79940 98289->98290 98291 7992b 98289->98291 98293 79946 98290->98293 98294 799a5 98290->98294 98292 32f95 _free 58 API calls 98291->98292 98296 79931 98292->98296 98807 78d90 98293->98807 98295 32f95 _free 58 API calls 98294->98295 98295->98300 98298 32f95 _free 58 API calls 98296->98298 98298->98300 98300->97911 98302 14faa 98300->98302 98301 32f95 _free 58 API calls 98301->98300 98303 14fb4 98302->98303 98307 14fbb 98302->98307 98304 355d6 __fcloseall 83 API calls 98303->98304 98304->98307 98305 14fdb FreeLibrary 98306 14fca 98305->98306 98306->97911 98307->98305 98307->98306 98317 17faf 98308->98317 98310 17b5d 98310->98186 98312 13f92 98311->98312 98316 13fb4 _memmove 98311->98316 98314 30ff6 Mailbox 59 API calls 98312->98314 98313 30ff6 Mailbox 59 API calls 98315 13fc8 98313->98315 98314->98316 98315->98194 98316->98313 98318 17fc2 98317->98318 98320 17fbf _memmove 98317->98320 98319 30ff6 Mailbox 59 API calls 98318->98319 98319->98320 98320->98310 98368 14d61 98321->98368 98324 14d3a 98326 14d53 98324->98326 98327 14d4a FreeLibrary 98324->98327 98325 14d61 2 API calls 98325->98324 98328 3548b 98326->98328 98327->98326 98372 354a0 98328->98372 98330 14f5c 98330->98201 98330->98202 98530 14d94 98331->98530 98334 14ced 98336 14d08 98334->98336 98337 14cff FreeLibrary 98334->98337 98335 14d94 2 API calls 98335->98334 98338 14dd0 98336->98338 98337->98336 98339 30ff6 Mailbox 59 API calls 98338->98339 98340 14de5 98339->98340 98534 1538e 98340->98534 98342 14df1 _memmove 98343 14f21 98342->98343 98344 14ee9 98342->98344 98348 14e2c 98342->98348 98548 79ba5 95 API calls 98343->98548 98537 14fe9 CreateStreamOnHGlobal 98344->98537 98345 15027 69 API calls 98354 14e35 98345->98354 98348->98345 98349 1506b 74 API calls 98349->98354 98350 14ec9 98350->98210 98352 4dcd0 98353 15045 85 API calls 98352->98353 98355 4dce4 98353->98355 98354->98349 98354->98350 98354->98352 98543 15045 98354->98543 98356 1506b 74 API calls 98355->98356 98356->98350 98358 4ddf6 98357->98358 98359 1507d 98357->98359 98572 35812 98359->98572 98362 79393 GetSystemTimeAsFileTime 98362->98217 98364 15036 98363->98364 98365 4ddb9 98363->98365 98770 35e90 98364->98770 98367 1503e 98367->98219 98369 14d2e 98368->98369 98370 14d6a LoadLibraryA 98368->98370 98369->98324 98369->98325 98370->98369 98371 14d7b GetProcAddress 98370->98371 98371->98369 98375 354ac _raise 98372->98375 98373 354bf 98421 38d68 58 API calls __getptd_noexit 98373->98421 98375->98373 98377 354f0 98375->98377 98376 354c4 98422 38ff6 9 API calls _raise 98376->98422 98391 40738 98377->98391 98380 354f5 98381 3550b 98380->98381 98382 354fe 98380->98382 98383 35535 98381->98383 98384 35515 98381->98384 98423 38d68 58 API calls __getptd_noexit 98382->98423 98406 40857 98383->98406 98424 38d68 58 API calls __getptd_noexit 98384->98424 98390 354cf _raise @_EH4_CallFilterFunc@8 98390->98330 98392 40744 _raise 98391->98392 98393 39e4b __lock 58 API calls 98392->98393 98404 40752 98393->98404 98394 407c6 98426 4084e 98394->98426 98395 407cd 98431 38a5d 58 API calls 2 library calls 98395->98431 98398 407d4 98398->98394 98432 3a06b InitializeCriticalSectionAndSpinCount 98398->98432 98399 40843 _raise 98399->98380 98401 39ed3 __mtinitlocknum 58 API calls 98401->98404 98403 407fa EnterCriticalSection 98403->98394 98404->98394 98404->98395 98404->98401 98429 36e8d 59 API calls __lock 98404->98429 98430 36ef7 LeaveCriticalSection LeaveCriticalSection _doexit 98404->98430 98407 40877 __wopenfile 98406->98407 98408 40891 98407->98408 98420 40a4c 98407->98420 98439 33a0b 60 API calls 3 library calls 98407->98439 98437 38d68 58 API calls __getptd_noexit 98408->98437 98410 40896 98438 38ff6 9 API calls _raise 98410->98438 98412 35540 98425 35562 LeaveCriticalSection LeaveCriticalSection _fprintf 98412->98425 98413 40aaf 98434 487f1 98413->98434 98416 40a45 98416->98420 98440 33a0b 60 API calls 3 library calls 98416->98440 98418 40a64 98418->98420 98441 33a0b 60 API calls 3 library calls 98418->98441 98420->98408 98420->98413 98421->98376 98422->98390 98423->98390 98424->98390 98425->98390 98433 39fb5 LeaveCriticalSection 98426->98433 98428 40855 98428->98399 98429->98404 98430->98404 98431->98398 98432->98403 98433->98428 98442 47fd5 98434->98442 98436 4880a 98436->98412 98437->98410 98438->98412 98439->98416 98440->98418 98441->98420 98443 47fe1 _raise 98442->98443 98444 47ff7 98443->98444 98447 4802d 98443->98447 98527 38d68 58 API calls __getptd_noexit 98444->98527 98446 47ffc 98528 38ff6 9 API calls _raise 98446->98528 98453 4809e 98447->98453 98450 48049 98529 48072 LeaveCriticalSection __unlock_fhandle 98450->98529 98451 48006 _raise 98451->98436 98454 480be 98453->98454 98455 3471a __wsopen_nolock 58 API calls 98454->98455 98457 480da 98455->98457 98456 39006 __invoke_watson 8 API calls 98458 487f0 98456->98458 98459 48114 98457->98459 98466 48137 98457->98466 98475 48211 98457->98475 98460 47fd5 __wsopen_helper 103 API calls 98458->98460 98461 38d34 __chsize_nolock 58 API calls 98459->98461 98462 4880a 98460->98462 98463 48119 98461->98463 98462->98450 98464 38d68 _free 58 API calls 98463->98464 98465 48126 98464->98465 98468 38ff6 _raise 9 API calls 98465->98468 98467 481f5 98466->98467 98476 481d3 98466->98476 98469 38d34 __chsize_nolock 58 API calls 98467->98469 98470 48130 98468->98470 98471 481fa 98469->98471 98470->98450 98472 38d68 _free 58 API calls 98471->98472 98473 48207 98472->98473 98474 38ff6 _raise 9 API calls 98473->98474 98474->98475 98475->98456 98477 3d4d4 __alloc_osfhnd 61 API calls 98476->98477 98478 482a1 98477->98478 98479 482ce 98478->98479 98480 482ab 98478->98480 98482 47f4d ___createFile GetModuleHandleW GetProcAddress CreateFileW 98479->98482 98481 38d34 __chsize_nolock 58 API calls 98480->98481 98483 482b0 98481->98483 98490 482f0 98482->98490 98484 38d68 _free 58 API calls 98483->98484 98487 482ba 98484->98487 98485 4836e GetFileType 98488 48379 GetLastError 98485->98488 98489 483bb 98485->98489 98486 4833c GetLastError 98491 38d47 __dosmaperr 58 API calls 98486->98491 98492 38d68 _free 58 API calls 98487->98492 98493 38d47 __dosmaperr 58 API calls 98488->98493 98498 3d76a __set_osfhnd 59 API calls 98489->98498 98490->98485 98490->98486 98494 47f4d ___createFile GetModuleHandleW GetProcAddress CreateFileW 98490->98494 98495 48361 98491->98495 98492->98470 98496 483a0 CloseHandle 98493->98496 98497 48331 98494->98497 98500 38d68 _free 58 API calls 98495->98500 98496->98495 98499 483ae 98496->98499 98497->98485 98497->98486 98504 483d9 98498->98504 98501 38d68 _free 58 API calls 98499->98501 98500->98475 98502 483b3 98501->98502 98502->98495 98503 48594 98503->98475 98506 48767 CloseHandle 98503->98506 98504->98503 98505 41b11 __lseeki64_nolock 60 API calls 98504->98505 98514 4845a 98504->98514 98507 48443 98505->98507 98508 47f4d ___createFile GetModuleHandleW GetProcAddress CreateFileW 98506->98508 98511 38d34 __chsize_nolock 58 API calls 98507->98511 98507->98514 98510 4878e 98508->98510 98509 410ab 70 API calls __read_nolock 98509->98514 98512 48796 GetLastError 98510->98512 98513 487c2 98510->98513 98511->98514 98515 38d47 __dosmaperr 58 API calls 98512->98515 98513->98475 98514->98503 98514->98509 98516 40d2d __close_nolock 61 API calls 98514->98516 98517 4848c 98514->98517 98518 41b11 60 API calls __lseeki64_nolock 98514->98518 98522 3dac6 __write 78 API calls 98514->98522 98523 48611 98514->98523 98519 487a2 98515->98519 98516->98514 98517->98514 98521 499f2 __chsize_nolock 82 API calls 98517->98521 98518->98514 98520 3d67d __free_osfhnd 59 API calls 98519->98520 98520->98513 98521->98517 98522->98514 98524 40d2d __close_nolock 61 API calls 98523->98524 98525 48618 98524->98525 98526 38d68 _free 58 API calls 98525->98526 98526->98475 98527->98446 98528->98451 98529->98451 98531 14ce1 98530->98531 98532 14d9d LoadLibraryA 98530->98532 98531->98334 98531->98335 98532->98531 98533 14dae GetProcAddress 98532->98533 98533->98531 98535 30ff6 Mailbox 59 API calls 98534->98535 98536 153a0 98535->98536 98536->98342 98538 15003 FindResourceExW 98537->98538 98542 15020 98537->98542 98539 4dd5c LoadResource 98538->98539 98538->98542 98540 4dd71 SizeofResource 98539->98540 98539->98542 98541 4dd85 LockResource 98540->98541 98540->98542 98541->98542 98542->98348 98544 4ddd4 98543->98544 98545 15054 98543->98545 98549 35a7d 98545->98549 98547 15062 98547->98354 98548->98348 98550 35a89 _raise 98549->98550 98551 35a9b 98550->98551 98553 35ac1 98550->98553 98562 38d68 58 API calls __getptd_noexit 98551->98562 98564 36e4e 98553->98564 98555 35aa0 98563 38ff6 9 API calls _raise 98555->98563 98556 35ac7 98570 359ee 83 API calls 5 library calls 98556->98570 98559 35ad6 98571 35af8 LeaveCriticalSection LeaveCriticalSection _fprintf 98559->98571 98561 35aab _raise 98561->98547 98562->98555 98563->98561 98565 36e80 EnterCriticalSection 98564->98565 98566 36e5e 98564->98566 98567 36e76 98565->98567 98566->98565 98568 36e66 98566->98568 98567->98556 98569 39e4b __lock 58 API calls 98568->98569 98569->98567 98570->98559 98571->98561 98575 3582d 98572->98575 98574 1508e 98574->98362 98576 35839 _raise 98575->98576 98577 3587c 98576->98577 98578 35874 _raise 98576->98578 98580 3584f _memset 98576->98580 98579 36e4e __lock_file 59 API calls 98577->98579 98578->98574 98581 35882 98579->98581 98602 38d68 58 API calls __getptd_noexit 98580->98602 98588 3564d 98581->98588 98584 35869 98603 38ff6 9 API calls _raise 98584->98603 98592 35668 _memset 98588->98592 98594 35683 98588->98594 98589 35673 98700 38d68 58 API calls __getptd_noexit 98589->98700 98591 35678 98701 38ff6 9 API calls _raise 98591->98701 98592->98589 98592->98594 98597 356c3 98592->98597 98604 358b6 LeaveCriticalSection LeaveCriticalSection _fprintf 98594->98604 98596 357d4 _memset 98703 38d68 58 API calls __getptd_noexit 98596->98703 98597->98594 98597->98596 98605 34916 98597->98605 98612 410ab 98597->98612 98680 40df7 98597->98680 98702 40f18 58 API calls 4 library calls 98597->98702 98602->98584 98603->98578 98604->98578 98606 34920 98605->98606 98607 34935 98605->98607 98704 38d68 58 API calls __getptd_noexit 98606->98704 98607->98597 98609 34925 98705 38ff6 9 API calls _raise 98609->98705 98611 34930 98611->98597 98613 410e3 98612->98613 98614 410cc 98612->98614 98616 4181b 98613->98616 98620 4111d 98613->98620 98715 38d34 58 API calls __getptd_noexit 98614->98715 98731 38d34 58 API calls __getptd_noexit 98616->98731 98617 410d1 98716 38d68 58 API calls __getptd_noexit 98617->98716 98623 41125 98620->98623 98630 4113c 98620->98630 98621 41820 98732 38d68 58 API calls __getptd_noexit 98621->98732 98717 38d34 58 API calls __getptd_noexit 98623->98717 98624 41131 98733 38ff6 9 API calls _raise 98624->98733 98625 410d8 98625->98597 98627 4112a 98718 38d68 58 API calls __getptd_noexit 98627->98718 98629 41151 98719 38d34 58 API calls __getptd_noexit 98629->98719 98630->98625 98630->98629 98632 4116b 98630->98632 98634 41189 98630->98634 98632->98629 98638 41176 98632->98638 98720 38a5d 58 API calls 2 library calls 98634->98720 98636 41199 98639 411a1 98636->98639 98640 411bc 98636->98640 98706 45ebb 98638->98706 98721 38d68 58 API calls __getptd_noexit 98639->98721 98723 41b11 60 API calls 3 library calls 98640->98723 98641 4128a 98643 41303 ReadFile 98641->98643 98648 412a0 GetConsoleMode 98641->98648 98646 41325 98643->98646 98647 417e3 GetLastError 98643->98647 98645 411a6 98722 38d34 58 API calls __getptd_noexit 98645->98722 98646->98647 98654 412f5 98646->98654 98650 412e3 98647->98650 98651 417f0 98647->98651 98652 412b4 98648->98652 98653 41300 98648->98653 98662 412e9 98650->98662 98724 38d47 58 API calls 2 library calls 98650->98724 98729 38d68 58 API calls __getptd_noexit 98651->98729 98652->98653 98656 412ba ReadConsoleW 98652->98656 98653->98643 98654->98662 98665 4135a 98654->98665 98669 415c7 98654->98669 98656->98654 98658 412dd GetLastError 98656->98658 98657 417f5 98730 38d34 58 API calls __getptd_noexit 98657->98730 98658->98650 98661 32f95 _free 58 API calls 98661->98625 98662->98625 98662->98661 98664 413c6 ReadFile 98666 413e7 GetLastError 98664->98666 98678 413f1 98664->98678 98665->98664 98671 41447 98665->98671 98666->98678 98667 41504 98674 414b4 MultiByteToWideChar 98667->98674 98727 41b11 60 API calls 3 library calls 98667->98727 98668 414f4 98726 38d68 58 API calls __getptd_noexit 98668->98726 98669->98662 98670 416cd ReadFile 98669->98670 98673 416f0 GetLastError 98670->98673 98679 416fe 98670->98679 98671->98662 98671->98667 98671->98668 98671->98674 98673->98679 98674->98658 98674->98662 98678->98665 98725 41b11 60 API calls 3 library calls 98678->98725 98679->98669 98728 41b11 60 API calls 3 library calls 98679->98728 98681 40e02 98680->98681 98685 40e17 98680->98685 98767 38d68 58 API calls __getptd_noexit 98681->98767 98683 40e07 98768 38ff6 9 API calls _raise 98683->98768 98687 40e4c 98685->98687 98692 40e12 98685->98692 98769 46234 58 API calls __malloc_crt 98685->98769 98688 34916 __fflush_nolock 58 API calls 98687->98688 98689 40e60 98688->98689 98734 40f97 98689->98734 98691 40e67 98691->98692 98693 34916 __fflush_nolock 58 API calls 98691->98693 98692->98597 98694 40e8a 98693->98694 98694->98692 98695 34916 __fflush_nolock 58 API calls 98694->98695 98696 40e96 98695->98696 98696->98692 98697 34916 __fflush_nolock 58 API calls 98696->98697 98698 40ea3 98697->98698 98699 34916 __fflush_nolock 58 API calls 98698->98699 98699->98692 98700->98591 98701->98594 98702->98597 98703->98591 98704->98609 98705->98611 98707 45ec6 98706->98707 98708 45ed3 98706->98708 98709 38d68 _free 58 API calls 98707->98709 98710 38d68 _free 58 API calls 98708->98710 98712 45edf 98708->98712 98711 45ecb 98709->98711 98713 45f00 98710->98713 98711->98641 98712->98641 98714 38ff6 _raise 9 API calls 98713->98714 98714->98711 98715->98617 98716->98625 98717->98627 98718->98624 98719->98627 98720->98636 98721->98645 98722->98625 98723->98638 98724->98662 98725->98678 98726->98662 98727->98674 98728->98679 98729->98657 98730->98662 98731->98621 98732->98624 98733->98625 98735 40fa3 _raise 98734->98735 98736 40fc7 98735->98736 98737 40fb0 98735->98737 98739 4108b 98736->98739 98742 40fdb 98736->98742 98738 38d34 __chsize_nolock 58 API calls 98737->98738 98741 40fb5 98738->98741 98740 38d34 __chsize_nolock 58 API calls 98739->98740 98745 40ffe 98740->98745 98746 38d68 _free 58 API calls 98741->98746 98743 41006 98742->98743 98744 40ff9 98742->98744 98748 41013 98743->98748 98749 41028 98743->98749 98747 38d34 __chsize_nolock 58 API calls 98744->98747 98753 38d68 _free 58 API calls 98745->98753 98750 40fbc _raise 98746->98750 98747->98745 98751 38d34 __chsize_nolock 58 API calls 98748->98751 98752 3d446 ___lock_fhandle 59 API calls 98749->98752 98750->98691 98754 41018 98751->98754 98755 4102e 98752->98755 98756 41020 98753->98756 98757 38d68 _free 58 API calls 98754->98757 98758 41054 98755->98758 98759 41041 98755->98759 98762 38ff6 _raise 9 API calls 98756->98762 98757->98756 98760 38d68 _free 58 API calls 98758->98760 98761 410ab __read_nolock 70 API calls 98759->98761 98763 41059 98760->98763 98764 4104d 98761->98764 98762->98750 98765 38d34 __chsize_nolock 58 API calls 98763->98765 98766 41083 __read LeaveCriticalSection 98764->98766 98765->98764 98766->98750 98767->98683 98768->98692 98769->98687 98771 35e9c _raise 98770->98771 98772 35ec3 98771->98772 98773 35eae 98771->98773 98775 36e4e __lock_file 59 API calls 98772->98775 98784 38d68 58 API calls __getptd_noexit 98773->98784 98777 35ec9 98775->98777 98776 35eb3 98785 38ff6 9 API calls _raise 98776->98785 98786 35b00 67 API calls 7 library calls 98777->98786 98780 35ebe _raise 98780->98367 98781 35ed4 98787 35ef4 LeaveCriticalSection LeaveCriticalSection _fprintf 98781->98787 98783 35ee6 98783->98780 98784->98776 98785->98780 98786->98781 98787->98783 98788->98222 98789->98230 98790->98244 98791->98246 98792->98241 98793->98251 98795 192c9 Mailbox 98794->98795 98796 4f5c8 98795->98796 98801 192d3 98795->98801 98797 30ff6 Mailbox 59 API calls 98796->98797 98798 4f5d4 98797->98798 98799 192da 98799->98255 98801->98799 98802 19df0 59 API calls Mailbox 98801->98802 98802->98801 98803->98266 98804->98261 98805->98271 98806->98289 98808 78d9b 98807->98808 98809 78da9 98807->98809 98810 3548b 115 API calls 98808->98810 98811 78dee 98809->98811 98812 3548b 115 API calls 98809->98812 98834 78db2 98809->98834 98810->98809 98838 7901b 98811->98838 98814 78dd3 98812->98814 98814->98811 98816 78ddc 98814->98816 98815 78e32 98817 78e57 98815->98817 98818 78e36 98815->98818 98819 355d6 __fcloseall 83 API calls 98816->98819 98816->98834 98842 78c33 98817->98842 98821 78e43 98818->98821 98823 355d6 __fcloseall 83 API calls 98818->98823 98819->98834 98826 355d6 __fcloseall 83 API calls 98821->98826 98821->98834 98823->98821 98824 78e85 98851 78eb5 98824->98851 98825 78e65 98827 78e72 98825->98827 98829 355d6 __fcloseall 83 API calls 98825->98829 98826->98834 98832 355d6 __fcloseall 83 API calls 98827->98832 98827->98834 98829->98827 98832->98834 98834->98301 98835 78ea0 98835->98834 98837 355d6 __fcloseall 83 API calls 98835->98837 98837->98834 98839 79040 98838->98839 98841 79029 __tzset_nolock _memmove 98838->98841 98840 35812 __fread_nolock 74 API calls 98839->98840 98840->98841 98841->98815 98843 3594c __crtGetStringTypeA_stat 58 API calls 98842->98843 98844 78c42 98843->98844 98845 3594c __crtGetStringTypeA_stat 58 API calls 98844->98845 98846 78c56 98845->98846 98847 3594c __crtGetStringTypeA_stat 58 API calls 98846->98847 98848 78c6a 98847->98848 98849 78f97 58 API calls 98848->98849 98850 78c7d 98848->98850 98849->98850 98850->98824 98850->98825 98852 78eca 98851->98852 98853 78f82 98852->98853 98855 78e8c 98852->98855 98856 78c8f 74 API calls 98852->98856 98880 7909c 98852->98880 98888 78d2b 74 API calls 98852->98888 98884 791bf 98853->98884 98859 78f97 98855->98859 98856->98852 98860 78fa4 98859->98860 98862 78faa 98859->98862 98861 32f95 _free 58 API calls 98860->98861 98861->98862 98863 78fbb 98862->98863 98865 32f95 _free 58 API calls 98862->98865 98864 78e93 98863->98864 98866 32f95 _free 58 API calls 98863->98866 98864->98835 98867 355d6 98864->98867 98865->98863 98866->98864 98868 355e2 _raise 98867->98868 98869 355f6 98868->98869 98870 3560e 98868->98870 98937 38d68 58 API calls __getptd_noexit 98869->98937 98872 36e4e __lock_file 59 API calls 98870->98872 98876 35606 _raise 98870->98876 98874 35620 98872->98874 98873 355fb 98938 38ff6 9 API calls _raise 98873->98938 98921 3556a 98874->98921 98876->98835 98881 790eb 98880->98881 98882 790ab 98880->98882 98881->98882 98889 79172 98881->98889 98882->98852 98885 791cc 98884->98885 98887 791dd 98884->98887 98886 34a93 80 API calls 98885->98886 98886->98887 98887->98855 98888->98852 98890 7919e 98889->98890 98891 791af 98889->98891 98893 34a93 98890->98893 98891->98881 98894 34a9f _raise 98893->98894 98895 34ad5 98894->98895 98896 34abd 98894->98896 98898 34acd _raise 98894->98898 98899 36e4e __lock_file 59 API calls 98895->98899 98918 38d68 58 API calls __getptd_noexit 98896->98918 98898->98891 98900 34adb 98899->98900 98906 3493a 98900->98906 98901 34ac2 98919 38ff6 9 API calls _raise 98901->98919 98909 34949 98906->98909 98914 34967 98906->98914 98907 34957 98908 38d68 _free 58 API calls 98907->98908 98910 3495c 98908->98910 98909->98907 98912 34981 _memmove 98909->98912 98909->98914 98911 38ff6 _raise 9 API calls 98910->98911 98911->98914 98913 3b05e __flsbuf 78 API calls 98912->98913 98912->98914 98915 34c6d __flush 78 API calls 98912->98915 98916 34916 __fflush_nolock 58 API calls 98912->98916 98917 3dac6 __write 78 API calls 98912->98917 98913->98912 98920 34b0d LeaveCriticalSection LeaveCriticalSection _fprintf 98914->98920 98915->98912 98916->98912 98917->98912 98918->98901 98919->98898 98920->98898 98922 35579 98921->98922 98923 3558d 98921->98923 98976 38d68 58 API calls __getptd_noexit 98922->98976 98924 35589 98923->98924 98940 34c6d 98923->98940 98939 35645 LeaveCriticalSection LeaveCriticalSection _fprintf 98924->98939 98927 3557e 98977 38ff6 9 API calls _raise 98927->98977 98932 34916 __fflush_nolock 58 API calls 98933 355a7 98932->98933 98950 40c52 98933->98950 98935 355ad 98935->98924 98936 32f95 _free 58 API calls 98935->98936 98936->98924 98937->98873 98938->98876 98939->98876 98941 34c80 98940->98941 98945 34ca4 98940->98945 98942 34916 __fflush_nolock 58 API calls 98941->98942 98941->98945 98943 34c9d 98942->98943 98978 3dac6 98943->98978 98946 40dc7 98945->98946 98947 40dd4 98946->98947 98949 355a1 98946->98949 98948 32f95 _free 58 API calls 98947->98948 98947->98949 98948->98949 98949->98932 98951 40c5e _raise 98950->98951 98952 40c82 98951->98952 98953 40c6b 98951->98953 98955 40d0d 98952->98955 98957 40c92 98952->98957 99103 38d34 58 API calls __getptd_noexit 98953->99103 99108 38d34 58 API calls __getptd_noexit 98955->99108 98956 40c70 99104 38d68 58 API calls __getptd_noexit 98956->99104 98960 40cb0 98957->98960 98961 40cba 98957->98961 99105 38d34 58 API calls __getptd_noexit 98960->99105 98964 3d446 ___lock_fhandle 59 API calls 98961->98964 98962 40cb5 99109 38d68 58 API calls __getptd_noexit 98962->99109 98965 40cc0 98964->98965 98967 40cd3 98965->98967 98968 40cde 98965->98968 99088 40d2d 98967->99088 99106 38d68 58 API calls __getptd_noexit 98968->99106 98969 40d19 99110 38ff6 9 API calls _raise 98969->99110 98972 40c77 _raise 98972->98935 98974 40cd9 99107 40d05 LeaveCriticalSection __unlock_fhandle 98974->99107 98976->98927 98977->98924 98979 3dad2 _raise 98978->98979 98980 3daf6 98979->98980 98981 3dadf 98979->98981 98983 3db95 98980->98983 98985 3db0a 98980->98985 99079 38d34 58 API calls __getptd_noexit 98981->99079 99085 38d34 58 API calls __getptd_noexit 98983->99085 98984 3dae4 99080 38d68 58 API calls __getptd_noexit 98984->99080 98988 3db32 98985->98988 98989 3db28 98985->98989 99006 3d446 98988->99006 99081 38d34 58 API calls __getptd_noexit 98989->99081 98993 3db38 98996 3db4b 98993->98996 98997 3db5e 98993->98997 98994 3db2d 99086 38d68 58 API calls __getptd_noexit 98994->99086 98995 3dba1 99087 38ff6 9 API calls _raise 98995->99087 99015 3dbb5 98996->99015 99082 38d68 58 API calls __getptd_noexit 98997->99082 99001 3db57 99084 3db8d LeaveCriticalSection __unlock_fhandle 99001->99084 99002 3db63 99083 38d34 58 API calls __getptd_noexit 99002->99083 99003 3daeb _raise 99003->98945 99007 3d452 _raise 99006->99007 99008 3d4a1 EnterCriticalSection 99007->99008 99009 39e4b __lock 58 API calls 99007->99009 99010 3d4c7 _raise 99008->99010 99011 3d477 99009->99011 99010->98993 99012 3a06b __mtinitlocknum InitializeCriticalSectionAndSpinCount 99011->99012 99014 3d48f 99011->99014 99012->99014 99013 3d4cb ___lock_fhandle LeaveCriticalSection 99013->99008 99014->99013 99016 3dbc2 __write_nolock 99015->99016 99017 3dc01 99016->99017 99018 3dc20 99016->99018 99049 3dbf6 99016->99049 99020 38d34 __chsize_nolock 58 API calls 99017->99020 99023 3dc78 99018->99023 99024 3dc5c 99018->99024 99019 3c836 __crtGetStringTypeA_stat 6 API calls 99021 3e416 99019->99021 99022 3dc06 99020->99022 99021->99001 99025 38d68 _free 58 API calls 99022->99025 99026 3dc91 99023->99026 99029 41b11 __lseeki64_nolock 60 API calls 99023->99029 99027 38d34 __chsize_nolock 58 API calls 99024->99027 99028 3dc0d 99025->99028 99030 45ebb __write_nolock 58 API calls 99026->99030 99031 3dc61 99027->99031 99032 38ff6 _raise 9 API calls 99028->99032 99029->99026 99033 3dc9f 99030->99033 99034 38d68 _free 58 API calls 99031->99034 99032->99049 99036 3dff8 99033->99036 99040 39bec _wcstok 58 API calls 99033->99040 99035 3dc68 99034->99035 99037 38ff6 _raise 9 API calls 99035->99037 99038 3e016 99036->99038 99039 3e38b WriteFile 99036->99039 99037->99049 99041 3e13a 99038->99041 99047 3e02c 99038->99047 99042 3dfeb GetLastError 99039->99042 99051 3dfb8 99039->99051 99044 3dccb GetConsoleMode 99040->99044 99052 3e22f 99041->99052 99054 3e145 99041->99054 99042->99051 99043 3e3c4 99043->99049 99050 38d68 _free 58 API calls 99043->99050 99044->99036 99045 3dd0a 99044->99045 99045->99036 99046 3dd1a GetConsoleCP 99045->99046 99046->99043 99076 3dd49 99046->99076 99047->99043 99048 3e09b WriteFile 99047->99048 99048->99042 99053 3e0d8 99048->99053 99049->99019 99055 3e3f2 99050->99055 99051->99043 99051->99049 99056 3e118 99051->99056 99052->99043 99057 3e2a4 WideCharToMultiByte 99052->99057 99053->99047 99058 3e0fc 99053->99058 99054->99043 99059 3e1aa WriteFile 99054->99059 99060 38d34 __chsize_nolock 58 API calls 99055->99060 99061 3e123 99056->99061 99062 3e3bb 99056->99062 99057->99042 99072 3e2eb 99057->99072 99058->99051 99059->99042 99064 3e1f9 99059->99064 99060->99049 99065 38d68 _free 58 API calls 99061->99065 99063 38d47 __dosmaperr 58 API calls 99062->99063 99063->99049 99064->99051 99064->99054 99064->99058 99067 3e128 99065->99067 99066 3e2f3 WriteFile 99070 3e346 GetLastError 99066->99070 99066->99072 99068 38d34 __chsize_nolock 58 API calls 99067->99068 99068->99049 99069 33835 __write_nolock 58 API calls 99069->99076 99070->99072 99071 4650a 60 API calls __write_nolock 99071->99076 99072->99051 99072->99052 99072->99058 99072->99066 99073 47cae WriteConsoleW CreateFileW __putwch_nolock 99077 3de9f 99073->99077 99074 3de32 WideCharToMultiByte 99074->99051 99075 3de6d WriteFile 99074->99075 99075->99042 99075->99077 99076->99051 99076->99069 99076->99071 99076->99074 99076->99077 99077->99042 99077->99051 99077->99073 99077->99076 99078 3dec7 WriteFile 99077->99078 99078->99042 99078->99077 99079->98984 99080->99003 99081->98994 99082->99002 99083->99001 99084->99003 99085->98994 99086->98995 99087->99003 99111 3d703 99088->99111 99090 40d91 99124 3d67d 59 API calls 2 library calls 99090->99124 99092 40d3b 99092->99090 99093 40d6f 99092->99093 99095 3d703 __chsize_nolock 58 API calls 99092->99095 99093->99090 99096 3d703 __chsize_nolock 58 API calls 99093->99096 99094 40d99 99098 40dbb 99094->99098 99125 38d47 58 API calls 2 library calls 99094->99125 99099 40d66 99095->99099 99097 40d7b FindCloseChangeNotification 99096->99097 99097->99090 99100 40d87 GetLastError 99097->99100 99098->98974 99102 3d703 __chsize_nolock 58 API calls 99099->99102 99100->99090 99102->99093 99103->98956 99104->98972 99105->98962 99106->98974 99107->98972 99108->98962 99109->98969 99110->98972 99112 3d723 99111->99112 99113 3d70e 99111->99113 99116 38d34 __chsize_nolock 58 API calls 99112->99116 99119 3d748 99112->99119 99114 38d34 __chsize_nolock 58 API calls 99113->99114 99115 3d713 99114->99115 99118 38d68 _free 58 API calls 99115->99118 99117 3d752 99116->99117 99120 38d68 _free 58 API calls 99117->99120 99121 3d71b 99118->99121 99119->99092 99122 3d75a 99120->99122 99121->99092 99123 38ff6 _raise 9 API calls 99122->99123 99123->99121 99124->99094 99125->99098 99188 41b90 99126->99188 99129 148f7 99194 17eec 99129->99194 99130 148da 99132 17d2c 59 API calls 99130->99132 99133 148e6 99132->99133 99190 17886 99133->99190 99136 309d5 99137 41b90 __write_nolock 99136->99137 99138 309e2 GetLongPathNameW 99137->99138 99139 17d2c 59 API calls 99138->99139 99140 1741d 99139->99140 99141 1716b 99140->99141 99142 177c7 59 API calls 99141->99142 99143 1717d 99142->99143 99144 148ae 60 API calls 99143->99144 99145 17188 99144->99145 99146 17193 99145->99146 99147 4ecae 99145->99147 99148 13f84 59 API calls 99146->99148 99151 4ecc8 99147->99151 99208 17a68 61 API calls 99147->99208 99150 1719f 99148->99150 99202 134c2 99150->99202 99153 171b2 Mailbox 99153->97990 99155 14f3d 136 API calls 99154->99155 99156 169ef 99155->99156 99157 4e45a 99156->99157 99159 14f3d 136 API calls 99156->99159 99158 797e5 122 API calls 99157->99158 99160 4e46f 99158->99160 99161 16a03 99159->99161 99162 4e490 99160->99162 99163 4e473 99160->99163 99161->99157 99164 16a0b 99161->99164 99166 30ff6 Mailbox 59 API calls 99162->99166 99165 14faa 84 API calls 99163->99165 99167 16a17 99164->99167 99168 4e47b 99164->99168 99165->99168 99187 4e4d5 Mailbox 99166->99187 99209 16bec 99167->99209 99316 74534 90 API calls _wprintf 99168->99316 99172 4e489 99172->99162 99173 4e689 99174 32f95 _free 58 API calls 99173->99174 99175 4e691 99174->99175 99176 14faa 84 API calls 99175->99176 99181 4e69a 99176->99181 99180 32f95 _free 58 API calls 99180->99181 99181->99180 99182 14faa 84 API calls 99181->99182 99320 6fcb1 89 API calls 4 library calls 99181->99320 99182->99181 99184 17f41 59 API calls 99184->99187 99187->99173 99187->99181 99187->99184 99302 1766f 99187->99302 99310 174bd 99187->99310 99317 6fc4d 59 API calls 2 library calls 99187->99317 99318 6fb6e 61 API calls 2 library calls 99187->99318 99319 77621 59 API calls Mailbox 99187->99319 99189 148bb GetFullPathNameW 99188->99189 99189->99129 99189->99130 99191 17894 99190->99191 99198 17e8c 99191->99198 99193 148f2 99193->99136 99195 17f06 99194->99195 99197 17ef9 99194->99197 99196 30ff6 Mailbox 59 API calls 99195->99196 99196->99197 99197->99133 99199 17e9a 99198->99199 99201 17ea3 _memmove 99198->99201 99200 17faf 59 API calls 99199->99200 99199->99201 99200->99201 99201->99193 99203 134f3 _memmove 99202->99203 99204 134d4 99202->99204 99205 30ff6 Mailbox 59 API calls 99203->99205 99206 30ff6 Mailbox 59 API calls 99204->99206 99207 1350a 99205->99207 99206->99203 99207->99153 99208->99147 99210 4e847 99209->99210 99211 16c15 99209->99211 99412 6fcb1 89 API calls 4 library calls 99210->99412 99326 15906 60 API calls Mailbox 99211->99326 99214 16c37 99327 15956 99214->99327 99215 4e85a 99413 6fcb1 89 API calls 4 library calls 99215->99413 99218 16c54 99220 177c7 59 API calls 99218->99220 99222 16c60 99220->99222 99221 4e876 99224 16cc1 99221->99224 99340 30b9b 60 API calls __write_nolock 99222->99340 99226 4e889 99224->99226 99227 16ccf 99224->99227 99225 16c6c 99229 177c7 59 API calls 99225->99229 99230 15dcf CloseHandle 99226->99230 99228 177c7 59 API calls 99227->99228 99231 16cd8 99228->99231 99232 16c78 99229->99232 99233 4e895 99230->99233 99235 177c7 59 API calls 99231->99235 99236 148ae 60 API calls 99232->99236 99234 14f3d 136 API calls 99233->99234 99237 4e8b1 99234->99237 99238 16ce1 99235->99238 99239 16c86 99236->99239 99240 4e8da 99237->99240 99243 797e5 122 API calls 99237->99243 99350 146f9 99238->99350 99341 159b0 ReadFile SetFilePointerEx 99239->99341 99414 6fcb1 89 API calls 4 library calls 99240->99414 99247 4e8cd 99243->99247 99244 16cf8 99248 17c8e 59 API calls 99244->99248 99246 16cb2 99342 15c4e 99246->99342 99251 4e8d5 99247->99251 99252 4e8f6 99247->99252 99253 16d09 SetCurrentDirectoryW 99248->99253 99249 4e8f1 99281 16e6c Mailbox 99249->99281 99254 14faa 84 API calls 99251->99254 99255 14faa 84 API calls 99252->99255 99258 16d1c Mailbox 99253->99258 99254->99240 99256 4e8fb 99255->99256 99257 30ff6 Mailbox 59 API calls 99256->99257 99263 4e92f 99257->99263 99260 30ff6 Mailbox 59 API calls 99258->99260 99262 16d2f 99260->99262 99261 13bcd 99261->97844 99261->97853 99265 1766f 59 API calls 99263->99265 99299 4e978 Mailbox 99265->99299 99269 4eb69 99419 77581 59 API calls Mailbox 99269->99419 99273 4eb8b 99420 7f835 59 API calls 2 library calls 99273->99420 99276 4eb98 99278 32f95 _free 58 API calls 99276->99278 99278->99281 99321 15934 99281->99321 99283 1766f 59 API calls 99283->99299 99292 17f41 59 API calls 99292->99299 99295 4ebbb 99421 6fcb1 89 API calls 4 library calls 99295->99421 99298 4ebd4 99300 32f95 _free 58 API calls 99298->99300 99299->99269 99299->99283 99299->99292 99299->99295 99415 6fc4d 59 API calls 2 library calls 99299->99415 99416 6fb6e 61 API calls 2 library calls 99299->99416 99417 77621 59 API calls Mailbox 99299->99417 99418 17373 59 API calls Mailbox 99299->99418 99301 4ebe7 99300->99301 99301->99281 99303 1770f 99302->99303 99307 17682 _memmove 99302->99307 99305 30ff6 Mailbox 59 API calls 99303->99305 99304 30ff6 Mailbox 59 API calls 99306 17689 99304->99306 99305->99307 99308 30ff6 Mailbox 59 API calls 99306->99308 99309 176b2 99306->99309 99307->99304 99308->99309 99309->99187 99311 174d0 99310->99311 99313 1757e 99310->99313 99312 30ff6 Mailbox 59 API calls 99311->99312 99315 17502 99311->99315 99312->99315 99313->99187 99314 30ff6 59 API calls Mailbox 99314->99315 99315->99313 99315->99314 99316->99172 99317->99187 99318->99187 99319->99187 99320->99181 99322 15dcf CloseHandle 99321->99322 99323 1593c Mailbox 99322->99323 99324 15dcf CloseHandle 99323->99324 99325 1594b 99324->99325 99325->99261 99326->99214 99328 15dcf CloseHandle 99327->99328 99329 15962 99328->99329 99424 15df9 99329->99424 99331 15981 99332 159a4 99331->99332 99432 15770 99331->99432 99332->99215 99332->99218 99334 15993 99449 153db SetFilePointerEx SetFilePointerEx 99334->99449 99336 4e030 99450 73696 SetFilePointerEx SetFilePointerEx WriteFile 99336->99450 99337 1599a 99337->99332 99337->99336 99339 4e060 99339->99332 99340->99225 99341->99246 99349 15c68 99342->99349 99343 4e151 99464 15dae SetFilePointerEx 99343->99464 99344 15cef SetFilePointerEx 99463 15dae SetFilePointerEx 99344->99463 99347 15cc3 99347->99224 99348 4e16b 99349->99343 99349->99344 99349->99347 99351 177c7 59 API calls 99350->99351 99352 1470f 99351->99352 99353 177c7 59 API calls 99352->99353 99354 14717 99353->99354 99355 177c7 59 API calls 99354->99355 99356 1471f 99355->99356 99357 177c7 59 API calls 99356->99357 99358 14727 99357->99358 99359 1475b 99358->99359 99360 4d8fb 99358->99360 99361 179ab 59 API calls 99359->99361 99362 181a7 59 API calls 99360->99362 99363 14769 99361->99363 99364 4d904 99362->99364 99365 17e8c 59 API calls 99363->99365 99366 17eec 59 API calls 99364->99366 99367 14773 99365->99367 99369 1479e 99366->99369 99368 179ab 59 API calls 99367->99368 99367->99369 99371 14794 99368->99371 99372 4d924 99369->99372 99373 147bd 99369->99373 99387 147de 99369->99387 99375 17e8c 59 API calls 99371->99375 99376 4d9f4 99372->99376 99384 4d9dd 99372->99384 99395 4d95b 99372->99395 99377 17b52 59 API calls 99373->99377 99374 147ef 99379 181a7 59 API calls 99374->99379 99381 14801 99374->99381 99375->99369 99378 17d2c 59 API calls 99376->99378 99382 147c7 99377->99382 99396 4d9b1 99378->99396 99379->99381 99380 14811 99385 14818 99380->99385 99388 181a7 59 API calls 99380->99388 99381->99380 99383 181a7 59 API calls 99381->99383 99386 179ab 59 API calls 99382->99386 99382->99387 99383->99380 99384->99376 99390 4d9c8 99384->99390 99389 181a7 59 API calls 99385->99389 99398 1481f Mailbox 99385->99398 99386->99387 99465 179ab 99387->99465 99388->99385 99389->99398 99393 17d2c 59 API calls 99390->99393 99391 4d9b9 99392 17d2c 59 API calls 99391->99392 99392->99396 99393->99396 99394 17b52 59 API calls 99394->99396 99395->99391 99399 4d9a4 99395->99399 99396->99387 99396->99394 99478 17a84 59 API calls 2 library calls 99396->99478 99398->99244 99400 17d2c 59 API calls 99399->99400 99400->99396 99412->99215 99413->99221 99414->99249 99415->99299 99416->99299 99417->99299 99418->99299 99419->99273 99420->99276 99421->99298 99425 15e12 CreateFileW 99424->99425 99426 4e181 99424->99426 99429 15e34 99425->99429 99427 4e187 CreateFileW 99426->99427 99426->99429 99428 4e1ad 99427->99428 99427->99429 99430 15c4e 2 API calls 99428->99430 99429->99331 99431 4e1b8 99430->99431 99431->99429 99433 4dfce 99432->99433 99434 1578b 99432->99434 99444 1581a 99433->99444 99457 15e3f 99433->99457 99435 15c4e 2 API calls 99434->99435 99434->99444 99436 157ad 99435->99436 99438 1538e 59 API calls 99436->99438 99439 157b7 99438->99439 99439->99433 99440 157c4 99439->99440 99441 30ff6 Mailbox 59 API calls 99440->99441 99442 157cf 99441->99442 99443 1538e 59 API calls 99442->99443 99445 157da 99443->99445 99444->99334 99451 15d20 99445->99451 99448 15c4e 2 API calls 99448->99444 99449->99337 99450->99339 99452 15d93 99451->99452 99456 15d2e 99451->99456 99462 15dae SetFilePointerEx 99452->99462 99453 15807 99453->99448 99455 15d66 ReadFile 99455->99453 99455->99456 99456->99453 99456->99455 99458 15c4e 2 API calls 99457->99458 99459 15e60 99458->99459 99460 15c4e 2 API calls 99459->99460 99461 15e74 99460->99461 99461->99444 99462->99456 99463->99347 99464->99348 99466 17a17 99465->99466 99467 179ba 99465->99467 99468 17e8c 59 API calls 99466->99468 99467->99466 99470 179c5 99467->99470 99469 179e8 _memmove 99468->99469 99469->99374 99471 179e0 99470->99471 99472 4ef32 99470->99472 99479 18087 59 API calls Mailbox 99471->99479 99480 18189 99472->99480 99475 4ef3c 99476 30ff6 Mailbox 59 API calls 99475->99476 99477 4ef5c 99476->99477 99478->99396 99479->99469 99481 30ff6 Mailbox 59 API calls 99480->99481 99482 18193 99481->99482 99482->99475 99483->98001 99485 16ef5 99484->99485 99489 17009 99484->99489 99486 30ff6 Mailbox 59 API calls 99485->99486 99485->99489 99488 16f1c 99486->99488 99487 30ff6 Mailbox 59 API calls 99494 16f91 99487->99494 99488->99487 99489->98005 99492 174bd 59 API calls 99492->99494 99493 1766f 59 API calls 99493->99494 99494->99489 99494->99492 99494->99493 99497 163a0 94 API calls 2 library calls 99494->99497 99498 66ac9 59 API calls Mailbox 99494->99498 99495->98007 99496->98009 99497->99494 99498->99494 99499->98023 99500->98024 100043 13633 100044 1366a 100043->100044 100045 136e7 100044->100045 100046 13688 100044->100046 100082 136e5 100044->100082 100050 4d31c 100045->100050 100051 136ed 100045->100051 100047 13695 100046->100047 100048 1375d PostQuitMessage 100046->100048 100052 136a0 100047->100052 100053 4d38f 100047->100053 100085 136d8 100048->100085 100049 136ca DefWindowProcW 100049->100085 100093 211d0 10 API calls Mailbox 100050->100093 100055 136f2 100051->100055 100056 13715 SetTimer RegisterWindowMessageW 100051->100056 100057 13767 100052->100057 100058 136a8 100052->100058 100097 72a16 71 API calls _memset 100053->100097 100062 136f9 KillTimer 100055->100062 100063 4d2bf 100055->100063 100059 1373e CreatePopupMenu 100056->100059 100056->100085 100091 14531 64 API calls _memset 100057->100091 100064 136b3 100058->100064 100077 4d374 100058->100077 100059->100085 100061 4d343 100094 211f3 341 API calls Mailbox 100061->100094 100088 144cb Shell_NotifyIconW _memset 100062->100088 100067 4d2c4 100063->100067 100068 4d2f8 MoveWindow 100063->100068 100070 1374b 100064->100070 100071 136be 100064->100071 100074 4d2e7 SetFocus 100067->100074 100075 4d2c8 100067->100075 100068->100085 100090 145df 81 API calls _memset 100070->100090 100071->100049 100095 144cb Shell_NotifyIconW _memset 100071->100095 100072 4d3a1 100072->100049 100072->100085 100073 1375b 100073->100085 100074->100085 100075->100071 100080 4d2d1 100075->100080 100076 1370c 100089 13114 DeleteObject DestroyWindow Mailbox 100076->100089 100077->100049 100096 6817e 59 API calls Mailbox 100077->100096 100092 211d0 10 API calls Mailbox 100080->100092 100082->100049 100086 4d368 100087 143db 68 API calls 100086->100087 100087->100082 100088->100076 100089->100085 100090->100073 100091->100073 100092->100085 100093->100061 100094->100071 100095->100086 100096->100082 100097->100072 100098 4ff06 100099 4ff10 100098->100099 100133 1ac90 Mailbox _memmove 100098->100133 100343 18e34 59 API calls Mailbox 100099->100343 100103 30ff6 59 API calls Mailbox 100125 1a097 Mailbox 100103->100125 100107 1b5d5 100108 181a7 59 API calls 100107->100108 100119 1a1b7 100108->100119 100109 5047f 100347 7a0b5 89 API calls 4 library calls 100109->100347 100110 1b5da 100353 7a0b5 89 API calls 4 library calls 100110->100353 100113 177c7 59 API calls 100113->100125 100115 181a7 59 API calls 100115->100125 100116 17f41 59 API calls 100116->100133 100117 67405 59 API calls 100117->100125 100118 5048e 100121 32f80 67 API calls __cinit 100121->100125 100122 666f4 Mailbox 59 API calls 100122->100119 100123 50e00 100352 7a0b5 89 API calls 4 library calls 100123->100352 100125->100103 100125->100107 100125->100109 100125->100110 100125->100113 100125->100115 100125->100117 100125->100119 100125->100121 100125->100123 100127 1a6ba 100125->100127 100337 1ca20 341 API calls 2 library calls 100125->100337 100338 1ba60 60 API calls Mailbox 100125->100338 100126 8bf80 341 API calls 100126->100133 100351 7a0b5 89 API calls 4 library calls 100127->100351 100129 1b416 100342 1f803 341 API calls 100129->100342 100131 1a000 341 API calls 100131->100133 100132 50c94 100349 19df0 59 API calls Mailbox 100132->100349 100133->100116 100133->100119 100133->100125 100133->100126 100133->100129 100133->100131 100133->100132 100135 50ca2 100133->100135 100138 1b37c 100133->100138 100140 30ff6 59 API calls Mailbox 100133->100140 100144 1b685 100133->100144 100147 1ade2 Mailbox 100133->100147 100296 8c5f4 100133->100296 100328 77be0 100133->100328 100334 666f4 100133->100334 100344 67405 59 API calls 100133->100344 100345 8c4a7 85 API calls 2 library calls 100133->100345 100350 7a0b5 89 API calls 4 library calls 100135->100350 100137 50c86 100137->100119 100137->100122 100340 19e9c 60 API calls Mailbox 100138->100340 100140->100133 100141 1b38d 100341 19e9c 60 API calls Mailbox 100141->100341 100348 7a0b5 89 API calls 4 library calls 100144->100348 100147->100119 100147->100137 100147->100144 100148 500e0 VariantClear 100147->100148 100154 7d2e6 100147->100154 100201 7d2e5 100147->100201 100248 22123 100147->100248 100288 8e237 100147->100288 100291 9251d 100147->100291 100339 19df0 59 API calls Mailbox 100147->100339 100346 67405 59 API calls 100147->100346 100148->100147 100155 7d310 100154->100155 100156 7d305 100154->100156 100160 177c7 59 API calls 100155->100160 100199 7d3ea Mailbox 100155->100199 100354 19c9c 59 API calls 100156->100354 100158 30ff6 Mailbox 59 API calls 100159 7d433 100158->100159 100161 7d43f 100159->100161 100357 15906 60 API calls Mailbox 100159->100357 100162 7d334 100160->100162 100165 19997 84 API calls 100161->100165 100164 177c7 59 API calls 100162->100164 100166 7d33d 100164->100166 100167 7d457 100165->100167 100168 19997 84 API calls 100166->100168 100170 15956 67 API calls 100167->100170 100169 7d349 100168->100169 100171 146f9 59 API calls 100169->100171 100172 7d466 100170->100172 100174 7d35e 100171->100174 100173 7d46a GetLastError 100172->100173 100177 7d49e 100172->100177 100175 7d483 100173->100175 100176 17c8e 59 API calls 100174->100176 100196 7d3f3 Mailbox 100175->100196 100358 15a1a CloseHandle 100175->100358 100178 7d391 100176->100178 100179 7d500 100177->100179 100180 7d4c9 100177->100180 100181 7d3e3 100178->100181 100186 73e73 3 API calls 100178->100186 100182 30ff6 Mailbox 59 API calls 100179->100182 100183 30ff6 Mailbox 59 API calls 100180->100183 100356 19c9c 59 API calls 100181->100356 100187 7d505 100182->100187 100188 7d4ce 100183->100188 100190 7d3a1 100186->100190 100193 177c7 59 API calls 100187->100193 100187->100196 100189 7d4df 100188->100189 100191 177c7 59 API calls 100188->100191 100359 7f835 59 API calls 2 library calls 100189->100359 100190->100181 100192 7d3a5 100190->100192 100191->100189 100195 17f41 59 API calls 100192->100195 100193->100196 100197 7d3b2 100195->100197 100196->100147 100355 73c66 63 API calls Mailbox 100197->100355 100199->100158 100199->100196 100200 7d3bb Mailbox 100200->100181 100202 7d310 100201->100202 100203 7d305 100201->100203 100207 177c7 59 API calls 100202->100207 100246 7d3ea Mailbox 100202->100246 100360 19c9c 59 API calls 100203->100360 100205 30ff6 Mailbox 59 API calls 100206 7d433 100205->100206 100208 7d43f 100206->100208 100363 15906 60 API calls Mailbox 100206->100363 100209 7d334 100207->100209 100212 19997 84 API calls 100208->100212 100211 177c7 59 API calls 100209->100211 100213 7d33d 100211->100213 100214 7d457 100212->100214 100215 19997 84 API calls 100213->100215 100217 15956 67 API calls 100214->100217 100216 7d349 100215->100216 100218 146f9 59 API calls 100216->100218 100219 7d466 100217->100219 100221 7d35e 100218->100221 100220 7d46a GetLastError 100219->100220 100229 7d49e 100219->100229 100222 7d483 100220->100222 100223 17c8e 59 API calls 100221->100223 100244 7d3f3 Mailbox 100222->100244 100364 15a1a CloseHandle 100222->100364 100224 7d391 100223->100224 100227 7d3e3 100224->100227 100233 73e73 3 API calls 100224->100233 100225 7d500 100228 30ff6 Mailbox 59 API calls 100225->100228 100226 7d4c9 100230 30ff6 Mailbox 59 API calls 100226->100230 100362 19c9c 59 API calls 100227->100362 100234 7d505 100228->100234 100229->100225 100229->100226 100235 7d4ce 100230->100235 100237 7d3a1 100233->100237 100240 177c7 59 API calls 100234->100240 100234->100244 100236 7d4df 100235->100236 100238 177c7 59 API calls 100235->100238 100365 7f835 59 API calls 2 library calls 100236->100365 100237->100227 100239 7d3a5 100237->100239 100238->100236 100242 17f41 59 API calls 100239->100242 100240->100244 100243 7d3b2 100242->100243 100361 73c66 63 API calls Mailbox 100243->100361 100244->100147 100246->100205 100246->100244 100247 7d3bb Mailbox 100247->100227 100366 19bf8 100248->100366 100252 30ff6 Mailbox 59 API calls 100253 22154 100252->100253 100256 22164 100253->100256 100394 15906 60 API calls Mailbox 100253->100394 100254 22189 100264 22196 100254->100264 100399 19c9c 59 API calls 100254->100399 100255 569af 100255->100254 100398 7f7df 59 API calls 100255->100398 100258 19997 84 API calls 100256->100258 100259 22172 100258->100259 100261 15956 67 API calls 100259->100261 100263 22181 100261->100263 100262 569f7 100262->100264 100265 569ff 100262->100265 100263->100254 100263->100255 100397 15a1a CloseHandle 100263->100397 100266 15e3f 2 API calls 100264->100266 100400 19c9c 59 API calls 100265->100400 100269 2219d 100266->100269 100270 56a11 100269->100270 100271 221b7 100269->100271 100272 30ff6 Mailbox 59 API calls 100270->100272 100273 177c7 59 API calls 100271->100273 100274 56a17 100272->100274 100275 221bf 100273->100275 100280 56a2b 100274->100280 100401 159b0 ReadFile SetFilePointerEx 100274->100401 100379 156d2 100275->100379 100279 221ce 100282 56a2f _memmove 100279->100282 100395 19b9c 59 API calls Mailbox 100279->100395 100280->100282 100402 7794e 59 API calls 2 library calls 100280->100402 100283 221e2 Mailbox 100284 2221c 100283->100284 100285 15dcf CloseHandle 100283->100285 100284->100147 100286 22210 100285->100286 100286->100284 100396 15a1a CloseHandle 100286->100396 100289 8cdf1 130 API calls 100288->100289 100290 8e247 100289->100290 100290->100147 100426 6f8f2 100291->100426 100293 92529 100445 19b9c 59 API calls Mailbox 100293->100445 100295 92545 Mailbox 100295->100147 100297 177c7 59 API calls 100296->100297 100298 8c608 100297->100298 100299 177c7 59 API calls 100298->100299 100300 8c610 100299->100300 100301 177c7 59 API calls 100300->100301 100302 8c618 100301->100302 100303 19997 84 API calls 100302->100303 100324 8c626 100303->100324 100304 17d2c 59 API calls 100304->100324 100305 8c80f 100306 8c83c Mailbox 100305->100306 100449 19b9c 59 API calls Mailbox 100305->100449 100306->100133 100308 8c7f6 100309 17e0b 59 API calls 100308->100309 100311 8c803 100309->100311 100310 8c811 100313 17e0b 59 API calls 100310->100313 100316 17c8e 59 API calls 100311->100316 100312 17a84 59 API calls 100312->100324 100317 8c820 100313->100317 100314 181a7 59 API calls 100314->100324 100315 17faf 59 API calls 100318 8c6bd CharUpperBuffW 100315->100318 100316->100305 100319 17c8e 59 API calls 100317->100319 100447 1859a 68 API calls 100318->100447 100319->100305 100320 17faf 59 API calls 100321 8c77d CharUpperBuffW 100320->100321 100448 1c707 69 API calls 2 library calls 100321->100448 100324->100304 100324->100305 100324->100306 100324->100308 100324->100310 100324->100312 100324->100314 100324->100315 100324->100320 100325 19997 84 API calls 100324->100325 100326 17c8e 59 API calls 100324->100326 100327 17e0b 59 API calls 100324->100327 100325->100324 100326->100324 100327->100324 100329 77bec 100328->100329 100330 30ff6 Mailbox 59 API calls 100329->100330 100331 77bfa 100330->100331 100332 77c08 100331->100332 100333 177c7 59 API calls 100331->100333 100332->100133 100333->100332 100450 66636 100334->100450 100336 66702 100336->100133 100337->100125 100338->100125 100339->100147 100340->100141 100341->100129 100342->100144 100343->100133 100344->100133 100345->100133 100346->100147 100347->100118 100348->100137 100349->100137 100350->100137 100351->100119 100352->100110 100353->100119 100354->100155 100355->100200 100356->100199 100357->100161 100358->100196 100359->100196 100360->100202 100361->100247 100362->100246 100363->100208 100364->100244 100365->100244 100367 19c08 100366->100367 100369 4fbff 100366->100369 100373 30ff6 Mailbox 59 API calls 100367->100373 100368 4fc10 100370 17eec 59 API calls 100368->100370 100369->100368 100371 17d2c 59 API calls 100369->100371 100372 4fc1a 100370->100372 100371->100368 100376 19c34 100372->100376 100377 177c7 59 API calls 100372->100377 100374 19c1b 100373->100374 100374->100372 100375 19c26 100374->100375 100375->100376 100378 17f41 59 API calls 100375->100378 100376->100252 100376->100255 100377->100376 100378->100376 100380 15702 100379->100380 100381 156dd 100379->100381 100382 17eec 59 API calls 100380->100382 100381->100380 100384 156ec 100381->100384 100386 7349a 100382->100386 100383 734c9 100383->100279 100405 15c18 100384->100405 100386->100383 100403 73436 ReadFile SetFilePointerEx 100386->100403 100404 17a84 59 API calls 2 library calls 100386->100404 100393 735d8 Mailbox 100393->100279 100394->100256 100395->100283 100396->100284 100397->100255 100398->100255 100399->100262 100400->100269 100401->100280 100402->100282 100403->100386 100404->100386 100406 30ff6 Mailbox 59 API calls 100405->100406 100407 15c2b 100406->100407 100408 30ff6 Mailbox 59 API calls 100407->100408 100409 15c37 100408->100409 100410 15632 100409->100410 100417 15a2f 100410->100417 100412 15643 100413 15d20 2 API calls 100412->100413 100414 15674 100412->100414 100424 15bda 59 API calls 2 library calls 100412->100424 100413->100412 100414->100393 100416 1793a 61 API calls Mailbox 100414->100416 100416->100393 100418 4e065 100417->100418 100419 15a40 100417->100419 100425 66443 59 API calls Mailbox 100418->100425 100419->100412 100421 4e06f 100422 30ff6 Mailbox 59 API calls 100421->100422 100423 4e07b 100422->100423 100424->100412 100425->100421 100427 177c7 59 API calls 100426->100427 100428 6f905 100427->100428 100429 17b76 59 API calls 100428->100429 100430 6f919 100429->100430 100431 6f658 61 API calls 100430->100431 100438 6f93b 100430->100438 100433 6f935 100431->100433 100432 6f658 61 API calls 100432->100438 100435 179ab 59 API calls 100433->100435 100433->100438 100434 6f9b5 100437 179ab 59 API calls 100434->100437 100435->100438 100436 179ab 59 API calls 100436->100438 100439 6f9ce 100437->100439 100438->100432 100438->100434 100438->100436 100440 17c8e 59 API calls 100438->100440 100441 17c8e 59 API calls 100439->100441 100440->100438 100442 6f9da 100441->100442 100444 6f9e9 Mailbox 100442->100444 100446 180d7 59 API calls 2 library calls 100442->100446 100444->100293 100445->100295 100446->100444 100447->100324 100448->100324 100449->100306 100451 6665e 100450->100451 100452 66641 100450->100452 100451->100336 100452->100451 100454 66621 59 API calls Mailbox 100452->100454 100454->100452 100455 50226 100464 1ade2 Mailbox 100455->100464 100457 50c86 100458 666f4 Mailbox 59 API calls 100457->100458 100459 50c8f 100458->100459 100461 500e0 VariantClear 100461->100464 100462 1b6c1 100472 7a0b5 89 API calls 4 library calls 100462->100472 100464->100457 100464->100459 100464->100461 100464->100462 100465 7d2e6 101 API calls 100464->100465 100466 22123 95 API calls 100464->100466 100467 7d2e5 101 API calls 100464->100467 100468 9251d 62 API calls 100464->100468 100469 8e237 130 API calls 100464->100469 100470 19df0 59 API calls Mailbox 100464->100470 100471 67405 59 API calls 100464->100471 100465->100464 100466->100464 100467->100464 100468->100464 100469->100464 100470->100464 100471->100464 100472->100457 100473 11055 100478 12649 100473->100478 100476 32f80 __cinit 67 API calls 100477 11064 100476->100477 100479 177c7 59 API calls 100478->100479 100480 126b7 100479->100480 100485 13582 100480->100485 100483 12754 100484 1105a 100483->100484 100488 13416 59 API calls 2 library calls 100483->100488 100484->100476 100489 135b0 100485->100489 100488->100483 100490 135bd 100489->100490 100491 135a1 100489->100491 100490->100491 100492 135c4 RegOpenKeyExW 100490->100492 100491->100483 100492->100491 100493 135de RegQueryValueExW 100492->100493 100494 13614 RegCloseKey 100493->100494 100495 135ff 100493->100495 100494->100491 100495->100494 100496 11016 100501 14ad2 100496->100501 100499 32f80 __cinit 67 API calls 100500 11025 100499->100500 100502 30ff6 Mailbox 59 API calls 100501->100502 100503 14ada 100502->100503 100504 1101b 100503->100504 100508 14a94 100503->100508 100504->100499 100509 14aaf 100508->100509 100510 14a9d 100508->100510 100512 14afe 100509->100512 100511 32f80 __cinit 67 API calls 100510->100511 100511->100509 100513 177c7 59 API calls 100512->100513 100514 14b16 GetVersionExW 100513->100514 100515 17d2c 59 API calls 100514->100515 100516 14b59 100515->100516 100517 17e8c 59 API calls 100516->100517 100523 14b86 100516->100523 100518 14b7a 100517->100518 100519 17886 59 API calls 100518->100519 100519->100523 100520 14bf1 GetCurrentProcess IsWow64Process 100522 14c0a 100520->100522 100521 4dc8d 100524 14c20 100522->100524 100525 14c89 GetSystemInfo 100522->100525 100523->100520 100523->100521 100536 14c95 100524->100536 100526 14c56 100525->100526 100526->100504 100529 14c32 100532 14c95 2 API calls 100529->100532 100530 14c7d GetSystemInfo 100531 14c47 100530->100531 100531->100526 100534 14c4d FreeLibrary 100531->100534 100533 14c3a GetNativeSystemInfo 100532->100533 100533->100531 100534->100526 100537 14c2e 100536->100537 100538 14c9e LoadLibraryA 100536->100538 100537->100529 100537->100530 100538->100537 100539 14caf GetProcAddress 100538->100539 100539->100537 100540 11066 100545 1f8cf 100540->100545 100542 1106c 100543 32f80 __cinit 67 API calls 100542->100543 100544 11076 100543->100544 100546 1f8f0 100545->100546 100578 30143 100546->100578 100550 1f937 100551 177c7 59 API calls 100550->100551 100552 1f941 100551->100552 100553 177c7 59 API calls 100552->100553 100554 1f94b 100553->100554 100555 177c7 59 API calls 100554->100555 100556 1f955 100555->100556 100557 177c7 59 API calls 100556->100557 100558 1f993 100557->100558 100559 177c7 59 API calls 100558->100559 100560 1fa5e 100559->100560 100588 260e7 100560->100588 100564 1fa90 100565 177c7 59 API calls 100564->100565 100566 1fa9a 100565->100566 100616 2ffde 100566->100616 100568 1fae1 100569 1faf1 GetStdHandle 100568->100569 100570 549d5 100569->100570 100571 1fb3d 100569->100571 100570->100571 100573 549de 100570->100573 100572 1fb45 OleInitialize 100571->100572 100572->100542 100623 76dda 64 API calls Mailbox 100573->100623 100575 549e5 100624 774a9 CreateThread 100575->100624 100577 549f1 CloseHandle 100577->100572 100625 3021c 100578->100625 100581 3021c 59 API calls 100582 30185 100581->100582 100583 177c7 59 API calls 100582->100583 100584 30191 100583->100584 100585 17d2c 59 API calls 100584->100585 100586 1f8f6 100585->100586 100587 303a2 6 API calls 100586->100587 100587->100550 100589 177c7 59 API calls 100588->100589 100590 260f7 100589->100590 100591 177c7 59 API calls 100590->100591 100592 260ff 100591->100592 100632 25bfd 100592->100632 100595 25bfd 59 API calls 100596 2610f 100595->100596 100597 177c7 59 API calls 100596->100597 100598 2611a 100597->100598 100599 30ff6 Mailbox 59 API calls 100598->100599 100600 1fa68 100599->100600 100601 26259 100600->100601 100602 26267 100601->100602 100603 177c7 59 API calls 100602->100603 100604 26272 100603->100604 100605 177c7 59 API calls 100604->100605 100606 2627d 100605->100606 100607 177c7 59 API calls 100606->100607 100608 26288 100607->100608 100609 177c7 59 API calls 100608->100609 100610 26293 100609->100610 100611 25bfd 59 API calls 100610->100611 100612 2629e 100611->100612 100613 30ff6 Mailbox 59 API calls 100612->100613 100614 262a5 RegisterWindowMessageW 100613->100614 100614->100564 100617 65cc3 100616->100617 100618 2ffee 100616->100618 100635 79d71 60 API calls 100617->100635 100619 30ff6 Mailbox 59 API calls 100618->100619 100621 2fff6 100619->100621 100621->100568 100622 65cce 100623->100575 100624->100577 100636 7748f 65 API calls 100624->100636 100626 177c7 59 API calls 100625->100626 100627 30227 100626->100627 100628 177c7 59 API calls 100627->100628 100629 3022f 100628->100629 100630 177c7 59 API calls 100629->100630 100631 3017b 100630->100631 100631->100581 100633 177c7 59 API calls 100632->100633 100634 25c05 100633->100634 100634->100595 100635->100622 100637 1e72410 100651 1e70000 100637->100651 100639 1e724f4 100654 1e72300 100639->100654 100657 1e73540 GetPEB 100651->100657 100653 1e7068b 100653->100639 100655 1e72309 Sleep 100654->100655 100656 1e72317 100655->100656 100658 1e7356a 100657->100658 100658->100653 100659 1e70b 100662 1d260 100659->100662 100661 1e719 100663 1d27d 100662->100663 100690 1d4dd 100662->100690 100664 52abb 100663->100664 100665 52b0a 100663->100665 100688 1d2a4 100663->100688 100668 52abe 100664->100668 100673 52ad9 100664->100673 100706 8a6fb 341 API calls __cinit 100665->100706 100669 52aca 100668->100669 100668->100688 100704 8ad0f 341 API calls 100669->100704 100670 32f80 __cinit 67 API calls 100670->100688 100673->100690 100705 8b1b7 341 API calls 3 library calls 100673->100705 100674 1d594 100698 18bb2 68 API calls 100674->100698 100675 52cdf 100675->100675 100676 1d6ab 100676->100661 100680 1d5a3 100680->100661 100681 52c26 100710 8aa66 89 API calls 100681->100710 100685 18620 69 API calls 100685->100688 100688->100670 100688->100674 100688->100676 100688->100681 100688->100685 100688->100690 100693 1a000 341 API calls 100688->100693 100694 181a7 59 API calls 100688->100694 100696 188a0 68 API calls __cinit 100688->100696 100697 186a2 68 API calls 100688->100697 100699 1859a 68 API calls 100688->100699 100700 1d0dc 341 API calls 100688->100700 100701 19f3a 59 API calls Mailbox 100688->100701 100702 1d060 89 API calls 100688->100702 100703 1cedd 341 API calls 100688->100703 100707 18bb2 68 API calls 100688->100707 100708 19e9c 60 API calls Mailbox 100688->100708 100709 66d03 60 API calls 100688->100709 100690->100676 100711 7a0b5 89 API calls 4 library calls 100690->100711 100693->100688 100694->100688 100696->100688 100697->100688 100698->100680 100699->100688 100700->100688 100701->100688 100702->100688 100703->100688 100704->100676 100705->100690 100706->100688 100707->100688 100708->100688 100709->100688 100710->100690 100711->100675 100712 1568a 100713 15c18 59 API calls 100712->100713 100714 1569c 100713->100714 100715 15632 61 API calls 100714->100715 100716 156aa 100715->100716 100717 156ba Mailbox 100716->100717 100719 181c1 61 API calls Mailbox 100716->100719 100719->100717 100720 1107d 100725 171eb 100720->100725 100722 1108c 100723 32f80 __cinit 67 API calls 100722->100723 100724 11096 100723->100724 100726 171fb __write_nolock 100725->100726 100727 177c7 59 API calls 100726->100727 100728 172b1 100727->100728 100729 14864 61 API calls 100728->100729 100730 172ba 100729->100730 100756 3074f 100730->100756 100733 17e0b 59 API calls 100734 172d3 100733->100734 100735 13f84 59 API calls 100734->100735 100736 172e2 100735->100736 100737 177c7 59 API calls 100736->100737 100738 172eb 100737->100738 100739 17eec 59 API calls 100738->100739 100740 172f4 RegOpenKeyExW 100739->100740 100741 4ecda RegQueryValueExW 100740->100741 100745 17316 Mailbox 100740->100745 100742 4ecf7 100741->100742 100743 4ed6c RegCloseKey 100741->100743 100744 30ff6 Mailbox 59 API calls 100742->100744 100743->100745 100749 4ed7e _wcscat Mailbox __NMSG_WRITE 100743->100749 100746 4ed10 100744->100746 100745->100722 100748 1538e 59 API calls 100746->100748 100747 17b52 59 API calls 100747->100749 100750 4ed1b RegQueryValueExW 100748->100750 100749->100745 100749->100747 100754 17f41 59 API calls 100749->100754 100755 13f84 59 API calls 100749->100755 100751 4ed38 100750->100751 100753 4ed52 100750->100753 100752 17d2c 59 API calls 100751->100752 100752->100753 100753->100743 100754->100749 100755->100749 100757 41b90 __write_nolock 100756->100757 100758 3075c GetFullPathNameW 100757->100758 100759 3077e 100758->100759 100760 17d2c 59 API calls 100759->100760 100761 172c5 100760->100761 100761->100733

                                    Executed Functions

                                    Function 00013B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00013B7A
                                    • IsDebuggerPresent.KERNEL32 ref: 00013B8C
                                    • GetFullPathNameW.KERNEL32(00007FFF,?,?,000D62F8,000D62E0,?,?), ref: 00013BFD
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                      • Part of subcall function 00020A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00013C26,000D62F8,?,?,?), ref: 00020ACE
                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00013C81
                                    • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,000C93F0,00000010), ref: 0004D4BC
                                    • SetCurrentDirectoryW.KERNEL32(?,000D62F8,?,?,?), ref: 0004D4F4
                                    • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,000C5D40,000D62F8,?,?,?), ref: 0004D57A
                                    • ShellExecuteW.SHELL32(00000000,?,?), ref: 0004D581
                                      • Part of subcall function 00013A58: GetSysColorBrush.USER32(0000000F), ref: 00013A62
                                      • Part of subcall function 00013A58: LoadCursorW.USER32(00000000,00007F00), ref: 00013A71
                                      • Part of subcall function 00013A58: LoadIconW.USER32(00000063), ref: 00013A88
                                      • Part of subcall function 00013A58: LoadIconW.USER32(000000A4), ref: 00013A9A
                                      • Part of subcall function 00013A58: LoadIconW.USER32(000000A2), ref: 00013AAC
                                      • Part of subcall function 00013A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00013AD2
                                      • Part of subcall function 00013A58: RegisterClassExW.USER32(?), ref: 00013B28
                                      • Part of subcall function 000139E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00013A15
                                      • Part of subcall function 000139E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00013A36
                                      • Part of subcall function 000139E7: ShowWindow.USER32(00000000,?,?), ref: 00013A4A
                                      • Part of subcall function 000139E7: ShowWindow.USER32(00000000,?,?), ref: 00013A53
                                      • Part of subcall function 000143DB: _memset.LIBCMT ref: 00014401
                                      • Part of subcall function 000143DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 000144A6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                    • String ID: This is a third-party compiled AutoIt script.$runas$%
                                    • API String ID: 529118366-1217669611
                                    • Opcode ID: 392ea80214ab825edcc21007cf4afd788a0c25f8659a09c8964e62912af185ee
                                    • Instruction ID: f6e3f55a4379a6bf1a156f76d6075983ecfe6aaebbdf30fc90c5f4a0593b50d0
                                    • Opcode Fuzzy Hash: 392ea80214ab825edcc21007cf4afd788a0c25f8659a09c8964e62912af185ee
                                    • Instruction Fuzzy Hash: 4151F570909249ABDF11ABB4DC06EFD7BB4AF04300F04417BF955A62A3DB794685CB71
                                    Function 00014AFE Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 983 14afe-14b5e call 177c7 GetVersionExW call 17d2c 988 14b64 983->988 989 14c69-14c6b 983->989 991 14b67-14b6c 988->991 990 4db90-4db9c 989->990 992 4db9d-4dba1 990->992 993 14c70-14c71 991->993 994 14b72 991->994 996 4dba4-4dbb0 992->996 997 4dba3 992->997 995 14b73-14baa call 17e8c call 17886 993->995 994->995 1005 14bb0-14bb1 995->1005 1006 4dc8d-4dc90 995->1006 996->992 999 4dbb2-4dbb7 996->999 997->996 999->991 1001 4dbbd-4dbc4 999->1001 1001->990 1003 4dbc6 1001->1003 1007 4dbcb-4dbce 1003->1007 1005->1007 1008 14bb7-14bc2 1005->1008 1009 4dc92 1006->1009 1010 4dca9-4dcad 1006->1010 1011 14bf1-14c08 GetCurrentProcess IsWow64Process 1007->1011 1012 4dbd4-4dbf2 1007->1012 1017 4dc13-4dc19 1008->1017 1018 14bc8-14bca 1008->1018 1019 4dc95 1009->1019 1013 4dcaf-4dcb8 1010->1013 1014 4dc98-4dca1 1010->1014 1015 14c0a 1011->1015 1016 14c0d-14c1e 1011->1016 1012->1011 1020 4dbf8-4dbfe 1012->1020 1013->1019 1027 4dcba-4dcbd 1013->1027 1014->1010 1015->1016 1028 14c20-14c30 call 14c95 1016->1028 1029 14c89-14c93 GetSystemInfo 1016->1029 1025 4dc23-4dc29 1017->1025 1026 4dc1b-4dc1e 1017->1026 1021 14bd0-14bd3 1018->1021 1022 4dc2e-4dc3a 1018->1022 1019->1014 1023 4dc00-4dc03 1020->1023 1024 4dc08-4dc0e 1020->1024 1030 14bd9-14be8 1021->1030 1031 4dc5a-4dc5d 1021->1031 1033 4dc44-4dc4a 1022->1033 1034 4dc3c-4dc3f 1022->1034 1023->1011 1024->1011 1025->1011 1026->1011 1027->1014 1040 14c32-14c3f call 14c95 1028->1040 1041 14c7d-14c87 GetSystemInfo 1028->1041 1032 14c56-14c66 1029->1032 1036 4dc4f-4dc55 1030->1036 1037 14bee 1030->1037 1031->1011 1039 4dc63-4dc78 1031->1039 1033->1011 1034->1011 1036->1011 1037->1011 1042 4dc82-4dc88 1039->1042 1043 4dc7a-4dc7d 1039->1043 1048 14c41-14c45 GetNativeSystemInfo 1040->1048 1049 14c76-14c7b 1040->1049 1044 14c47-14c4b 1041->1044 1042->1011 1043->1011 1044->1032 1047 14c4d-14c50 FreeLibrary 1044->1047 1047->1032 1048->1044 1049->1048
                                    APIs
                                    • GetVersionExW.KERNEL32(?), ref: 00014B2B
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    • GetCurrentProcess.KERNEL32(?,0009FAEC,00000000,00000000,?), ref: 00014BF8
                                    • IsWow64Process.KERNEL32(00000000), ref: 00014BFF
                                    • GetNativeSystemInfo.KERNELBASE(00000000), ref: 00014C45
                                    • FreeLibrary.KERNEL32(00000000), ref: 00014C50
                                    • GetSystemInfo.KERNEL32(00000000), ref: 00014C81
                                    • GetSystemInfo.KERNEL32(00000000), ref: 00014C8D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                    • String ID:
                                    • API String ID: 1986165174-0
                                    • Opcode ID: 4cf9f365f6d82a160013ecbde5438761c337522bb5aec5b7390e9415affa1ff4
                                    • Instruction ID: b8d4cd709e918b23fe6128fbfaf2a3e755961a4ba19d9dbd5f95bd112c3ec500
                                    • Opcode Fuzzy Hash: 4cf9f365f6d82a160013ecbde5438761c337522bb5aec5b7390e9415affa1ff4
                                    • Instruction Fuzzy Hash: 7091D57154E7C1DEC771CB6894A11EABFE4AF26300B484DAED0CB83A51D224E988D75D
                                    Function 00014FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1087 14fe9-15001 CreateStreamOnHGlobal 1088 15021-15026 1087->1088 1089 15003-1501a FindResourceExW 1087->1089 1090 15020 1089->1090 1091 4dd5c-4dd6b LoadResource 1089->1091 1090->1088 1091->1090 1092 4dd71-4dd7f SizeofResource 1091->1092 1092->1090 1093 4dd85-4dd90 LockResource 1092->1093 1093->1090 1094 4dd96-4ddb4 1093->1094 1094->1090
                                    APIs
                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00014EEE,?,?,00000000,00000000), ref: 00014FF9
                                    • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00014EEE,?,?,00000000,00000000), ref: 00015010
                                    • LoadResource.KERNEL32(?,00000000,?,?,00014EEE,?,?,00000000,00000000,?,?,?,?,?,?,00014F8F), ref: 0004DD60
                                    • SizeofResource.KERNEL32(?,00000000,?,?,00014EEE,?,?,00000000,00000000,?,?,?,?,?,?,00014F8F), ref: 0004DD75
                                    • LockResource.KERNEL32(00014EEE,?,?,00014EEE,?,?,00000000,00000000,?,?,?,?,?,?,00014F8F,00000000), ref: 0004DD88
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                    • String ID: SCRIPT
                                    • API String ID: 3051347437-3967369404
                                    • Opcode ID: 5ef37e7232d52c6379cea8a8bebe4b34d3b8f7c7c6e54ec9116c1478b6f20485
                                    • Instruction ID: 1e881c757482f20cb9bca6fd5b41969e5b93bcd62e9e7bf2c9ce4bd1a607c962
                                    • Opcode Fuzzy Hash: 5ef37e7232d52c6379cea8a8bebe4b34d3b8f7c7c6e54ec9116c1478b6f20485
                                    • Instruction Fuzzy Hash: D0115A75200701BFE7218B65DC58F677BBAFBC9B52F204169F406CA260DB61E8408660
                                    Function 0001E800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Dt$Dt$Dt$Dt$Variable must be of type 'Object'.
                                    • API String ID: 0-2912874543
                                    • Opcode ID: b4b5a918e46913325a681e16e9386a238558b490fb6ca4a21cb66bd33dfddb2e
                                    • Instruction ID: 09481f70ad859bafa28b88bd0497bcb46554651fe67cac103501b83aaebed654
                                    • Opcode Fuzzy Hash: b4b5a918e46913325a681e16e9386a238558b490fb6ca4a21cb66bd33dfddb2e
                                    • Instruction Fuzzy Hash: E8A26B74A04246CBDB24CF54C880AEEB7F1FF48314F648069ED1AAB352D775AD86CB91
                                    Function 00074696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFileAttributesW.KERNELBASE(?,0004E7C1), ref: 000746A6
                                    • FindFirstFileW.KERNELBASE(?,?), ref: 000746B7
                                    • FindClose.KERNEL32(00000000), ref: 000746C7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FileFind$AttributesCloseFirst
                                    • String ID:
                                    • API String ID: 48322524-0
                                    • Opcode ID: f062f430c51899d4290935f5b344cba8f19b27edbf1e5d63ef59bab9e1e33d18
                                    • Instruction ID: 697f93472a69bec2b00f35ecc4aa9b5c13dfa210b83212911d92d34c761dd2b5
                                    • Opcode Fuzzy Hash: f062f430c51899d4290935f5b344cba8f19b27edbf1e5d63ef59bab9e1e33d18
                                    • Instruction Fuzzy Hash: A7E0D831E104015B56106738EC4D4FA779CAF06335F104716F839C10E0EBB85950859A
                                    Function 00020B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00020BBB
                                    • timeGetTime.WINMM ref: 00020E76
                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00020FB3
                                    • TranslateMessage.USER32(?), ref: 00020FC7
                                    • DispatchMessageW.USER32(?), ref: 00020FD5
                                    • Sleep.KERNEL32(0000000A), ref: 00020FDF
                                    • LockWindowUpdate.USER32(00000000,?,?), ref: 0002105A
                                    • DestroyWindow.USER32 ref: 00021066
                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00021080
                                    • Sleep.KERNEL32(0000000A,?,?), ref: 000552AD
                                    • TranslateMessage.USER32(?), ref: 0005608A
                                    • DispatchMessageW.USER32(?), ref: 00056098
                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000560AC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
                                    • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pr$pr$pr$pr
                                    • API String ID: 4003667617-2235135431
                                    • Opcode ID: 2bfbdbe9fd9a0cb139aec2b2c4964bdf3cf1a0b0f79b926476806baa5cb75e18
                                    • Instruction ID: 552acc8ce29d270b9d16d942c2fad3ee01d15c8c7b72fa81d7b2421f73540bd4
                                    • Opcode Fuzzy Hash: 2bfbdbe9fd9a0cb139aec2b2c4964bdf3cf1a0b0f79b926476806baa5cb75e18
                                    • Instruction Fuzzy Hash: CAB2C270608741DFD724DF24D894BAFB7E5BF84305F14491DE88A872A2DB75E888CB92
                                    Function 000793DF Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 524 793df-7948f call 41b90 call 30ff6 call 1538e call 791e9 call 15045 call 3378c 537 79495-7949c call 799be 524->537 538 79542-79549 call 799be 524->538 543 794a2-79540 call 3432e call 32ffc call 32fcd call 3432e call 32fcd * 2 537->543 544 7954b-7954d 537->544 538->544 545 79552 538->545 548 79555-79611 call 1506b * 8 call 79b6d call 3548b 543->548 547 797b4-797b5 544->547 545->548 549 797d2-797e2 call 15371 547->549 583 79613-79615 548->583 584 7961a-79635 call 7922f 548->584 583->547 587 796c7-796d3 call 355d6 584->587 588 7963b-79643 584->588 595 796d5-796e4 DeleteFileW 587->595 596 796e9-796ed 587->596 589 79645-79649 588->589 590 7964b 588->590 592 79650-7966e call 1506b 589->592 590->592 602 79670-79675 592->602 603 79698-796ae call 78bdd call 34a93 592->603 595->547 598 796f3-7977c call 342ee call 79c74 call 78d90 596->598 599 7978f-797a3 CopyFileW 596->599 600 797b7-797cd DeleteFileW call 79b2c 598->600 620 7977e-7978d DeleteFileW 598->620 599->600 601 797a5-797b2 DeleteFileW 599->601 600->549 601->547 606 79678-7968b call 79367 602->606 615 796b3-796be 603->615 616 7968d-79696 606->616 615->588 618 796c4 615->618 616->603 618->587 620->547
                                    APIs
                                      • Part of subcall function 000791E9: __time64.LIBCMT ref: 000791F3
                                      • Part of subcall function 00015045: _fseek.LIBCMT ref: 0001505D
                                    • __wsplitpath.LIBCMT ref: 000794BE
                                      • Part of subcall function 0003432E: __wsplitpath_helper.LIBCMT ref: 0003436E
                                    • _wcscpy.LIBCMT ref: 000794D1
                                    • _wcscat.LIBCMT ref: 000794E4
                                    • __wsplitpath.LIBCMT ref: 00079509
                                    • _wcscat.LIBCMT ref: 0007951F
                                    • _wcscat.LIBCMT ref: 00079532
                                      • Part of subcall function 0007922F: _memmove.LIBCMT ref: 00079268
                                      • Part of subcall function 0007922F: _memmove.LIBCMT ref: 00079277
                                    • _wcscmp.LIBCMT ref: 00079479
                                      • Part of subcall function 000799BE: _wcscmp.LIBCMT ref: 00079AAE
                                      • Part of subcall function 000799BE: _wcscmp.LIBCMT ref: 00079AC1
                                    • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 000796DC
                                    • _wcsncpy.LIBCMT ref: 0007974F
                                    • DeleteFileW.KERNEL32(?,?), ref: 00079785
                                    • CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0007979B
                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000797AC
                                    • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000797BE
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                    • String ID:
                                    • API String ID: 1500180987-0
                                    • Opcode ID: efa297456b52b37e1fd5b0754f07c54f360d1d2b0761c857585eef228624674d
                                    • Instruction ID: a5339a8d4dc4064587522461a53371863f26c8f0f48732bacdd2d4305753b2d3
                                    • Opcode Fuzzy Hash: efa297456b52b37e1fd5b0754f07c54f360d1d2b0761c857585eef228624674d
                                    • Instruction Fuzzy Hash: FAC11DB1D00219AEDF21DF95CC85ADEB7BDAF49310F0080AAF609E7152DB749A848F65
                                    Function 00013015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75windowregistryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • GetSysColorBrush.USER32(0000000F), ref: 00013074
                                    • RegisterClassExW.USER32(00000030), ref: 0001309E
                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000130AF
                                    • InitCommonControlsEx.COMCTL32(?), ref: 000130CC
                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000130DC
                                    • LoadIconW.USER32(000000A9), ref: 000130F2
                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00013101
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                    • API String ID: 2914291525-1005189915
                                    • Opcode ID: e7929901d2fd5b297387123b12aceff04df5af8e2f3e5de6f42dcadceb612e33
                                    • Instruction ID: 837909399beae313787691fa01465b1440f1df31f4541e5b655b496846bf07b4
                                    • Opcode Fuzzy Hash: e7929901d2fd5b297387123b12aceff04df5af8e2f3e5de6f42dcadceb612e33
                                    • Instruction Fuzzy Hash: B0316BB1941306EFEB118FE4E884AEDBBF4FB09310F14416AE580E62A1D7BA0585CF61
                                    Function 00013041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • GetSysColorBrush.USER32(0000000F), ref: 00013074
                                    • RegisterClassExW.USER32(00000030), ref: 0001309E
                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000130AF
                                    • InitCommonControlsEx.COMCTL32(?), ref: 000130CC
                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000130DC
                                    • LoadIconW.USER32(000000A9), ref: 000130F2
                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00013101
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                    • API String ID: 2914291525-1005189915
                                    • Opcode ID: 4540505524de95e1c8a1e28eed26220098f9f53ddd962bc4725034bdaeeb3b37
                                    • Instruction ID: d1b5686b7d23238a83adc2a35d0a1c157fda8f7d9c556aace0c764597a04439d
                                    • Opcode Fuzzy Hash: 4540505524de95e1c8a1e28eed26220098f9f53ddd962bc4725034bdaeeb3b37
                                    • Instruction Fuzzy Hash: 2421C8B1901219AFEB00DFD4E849BEDBBF4FB08700F10412BF911E62A0D7BA45549FA1
                                    Function 000171EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                      • Part of subcall function 00014864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,000D62F8,?,000137C0,?), ref: 00014882
                                      • Part of subcall function 0003074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,000172C5), ref: 00030771
                                    • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00017308
                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0004ECF1
                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0004ED32
                                    • RegCloseKey.ADVAPI32(?), ref: 0004ED70
                                    • _wcscat.LIBCMT ref: 0004EDC9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                    • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                    • API String ID: 2673923337-2727554177
                                    • Opcode ID: 2d9f3838fd53c161fa61795d88ae1284634d29b66ba69746b9d80771b7218f37
                                    • Instruction ID: 0e38564dc6e7927bbc88427fb2057cf8a290422ea8bdd1c53b804df7d3ee8b3f
                                    • Opcode Fuzzy Hash: 2d9f3838fd53c161fa61795d88ae1284634d29b66ba69746b9d80771b7218f37
                                    • Instruction Fuzzy Hash: 2D715A715093419ED314EF25DC819EBB7F8FF98340F80052EF949871A1EB749988CBA6
                                    Function 00013633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 760 13633-13681 762 136e1-136e3 760->762 763 13683-13686 760->763 762->763 764 136e5 762->764 765 136e7 763->765 766 13688-1368f 763->766 769 136ca-136d2 DefWindowProcW 764->769 770 4d31c-4d34a call 211d0 call 211f3 765->770 771 136ed-136f0 765->771 767 13695-1369a 766->767 768 1375d-13765 PostQuitMessage 766->768 772 136a0-136a2 767->772 773 4d38f-4d3a3 call 72a16 767->773 776 13711-13713 768->776 775 136d8-136de 769->775 805 4d34f-4d356 770->805 777 136f2-136f3 771->777 778 13715-1373c SetTimer RegisterWindowMessageW 771->778 779 13767-13776 call 14531 772->779 780 136a8-136ad 772->780 773->776 796 4d3a9 773->796 776->775 784 136f9-1370c KillTimer call 144cb call 13114 777->784 785 4d2bf-4d2c2 777->785 778->776 781 1373e-13749 CreatePopupMenu 778->781 779->776 786 4d374-4d37b 780->786 787 136b3-136b8 780->787 781->776 784->776 791 4d2c4-4d2c6 785->791 792 4d2f8-4d317 MoveWindow 785->792 786->769 802 4d381-4d38a call 6817e 786->802 794 1374b-1375b call 145df 787->794 795 136be-136c4 787->795 799 4d2e7-4d2f3 SetFocus 791->799 800 4d2c8-4d2cb 791->800 792->776 794->776 795->769 795->805 796->769 799->776 800->795 806 4d2d1-4d2e2 call 211d0 800->806 802->769 805->769 810 4d35c-4d36f call 144cb call 143db 805->810 806->776 810->769
                                    APIs
                                    • DefWindowProcW.USER32(?,?,?,?), ref: 000136D2
                                    • KillTimer.USER32(?,00000001), ref: 000136FC
                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0001371F
                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0001372A
                                    • CreatePopupMenu.USER32 ref: 0001373E
                                    • PostQuitMessage.USER32(00000000), ref: 0001375F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                    • String ID: TaskbarCreated$%
                                    • API String ID: 129472671-2833896488
                                    • Opcode ID: f3ddf6e72e9cbdedea84eceea9ce833f3f07efb3411f29df0e3e2b08e55196b9
                                    • Instruction ID: 047c6fde248212931e07e970b1ebf2f6420ea909467ebc0ea4822dac1eeab715
                                    • Opcode Fuzzy Hash: f3ddf6e72e9cbdedea84eceea9ce833f3f07efb3411f29df0e3e2b08e55196b9
                                    • Instruction Fuzzy Hash: 6541F5B1209645BBEB745F64EC49BFD37A5EB00300F14022BF902D62E2DA699E90A775
                                    Function 00013A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • GetSysColorBrush.USER32(0000000F), ref: 00013A62
                                    • LoadCursorW.USER32(00000000,00007F00), ref: 00013A71
                                    • LoadIconW.USER32(00000063), ref: 00013A88
                                    • LoadIconW.USER32(000000A4), ref: 00013A9A
                                    • LoadIconW.USER32(000000A2), ref: 00013AAC
                                    • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00013AD2
                                    • RegisterClassExW.USER32(?), ref: 00013B28
                                      • Part of subcall function 00013041: GetSysColorBrush.USER32(0000000F), ref: 00013074
                                      • Part of subcall function 00013041: RegisterClassExW.USER32(00000030), ref: 0001309E
                                      • Part of subcall function 00013041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000130AF
                                      • Part of subcall function 00013041: InitCommonControlsEx.COMCTL32(?), ref: 000130CC
                                      • Part of subcall function 00013041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000130DC
                                      • Part of subcall function 00013041: LoadIconW.USER32(000000A9), ref: 000130F2
                                      • Part of subcall function 00013041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00013101
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                    • String ID: #$0$AutoIt v3
                                    • API String ID: 423443420-4155596026
                                    • Opcode ID: d156a76a511a225b2825772741ebd175be81b67163833e8673f01083b09779d6
                                    • Instruction ID: c5c1e844ed32adb0d53163260e2816d1ba6a773cc038dffd627592264ba1ba9c
                                    • Opcode Fuzzy Hash: d156a76a511a225b2825772741ebd175be81b67163833e8673f01083b09779d6
                                    • Instruction Fuzzy Hash: 3A212B71902305AFFB109FA4EC09BAD7BB5FB08711F10412BF904A62A1D7BE56549FA4
                                    Function 00013778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
                                    • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$b
                                    • API String ID: 1825951767-875263426
                                    • Opcode ID: b3c46acdbb4def19221ceb4ecb5b0eb14e1fdaafe38e9ae8cc5c9a823ebef525
                                    • Instruction ID: 6e0bb26ca493731196181082fc9a626f6cddd29ef358095aa5cd8bad5b688c1b
                                    • Opcode Fuzzy Hash: b3c46acdbb4def19221ceb4ecb5b0eb14e1fdaafe38e9ae8cc5c9a823ebef525
                                    • Instruction Fuzzy Hash: 9AA15F729102299ADF15EFA0CC91EFEB7B9BF14300F44042AF416B7192DF755A89CB61
                                    Function 0001F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168comCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                      • Part of subcall function 000303A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000303D3
                                      • Part of subcall function 000303A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 000303DB
                                      • Part of subcall function 000303A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000303E6
                                      • Part of subcall function 000303A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000303F1
                                      • Part of subcall function 000303A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 000303F9
                                      • Part of subcall function 000303A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00030401
                                      • Part of subcall function 00026259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0001FA90), ref: 000262B4
                                    • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0001FB2D
                                    • OleInitialize.OLE32(00000000), ref: 0001FBAA
                                    • CloseHandle.KERNEL32(00000000), ref: 000549F2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                    • String ID: <g$\d$%$c
                                    • API String ID: 1986988660-870776012
                                    • Opcode ID: d1c721da6725e8932273d6c60c2f551822960d71c82496266d4fb44dc3538dfd
                                    • Instruction ID: 8b1f87354db278ee6df6a9dcea81db7961ed26d538b65b901e82a2ec6203c382
                                    • Opcode Fuzzy Hash: d1c721da6725e8932273d6c60c2f551822960d71c82496266d4fb44dc3538dfd
                                    • Instruction Fuzzy Hash: C98197B090A3418FE384DF69EA506957BE4FB89308B10813BE819C7362EB3F85448F71
                                    Function 01E70920 Relevance: 10.7, APIs: 7, Instructions: 185fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1050 1e70920-1e70972 call 1e70820 CreateFileW 1053 1e70974-1e70976 1050->1053 1054 1e7097b-1e70988 1050->1054 1055 1e70b36-1e70b3a 1053->1055 1057 1e7099b-1e709b5 VirtualAlloc 1054->1057 1058 1e7098a-1e70996 1054->1058 1059 1e709b7-1e709b9 1057->1059 1060 1e709be-1e709e4 CreateFileW 1057->1060 1058->1055 1059->1055 1062 1e709e6-1e70a03 1060->1062 1063 1e70a08-1e70a22 ReadFile 1060->1063 1062->1055 1064 1e70a46-1e70a4a 1063->1064 1065 1e70a24-1e70a41 1063->1065 1066 1e70a6e-1e70a74 1064->1066 1067 1e70a4c-1e70a69 1064->1067 1065->1055 1070 1e70a7f-1e70aa2 1066->1070 1067->1055 1072 1e70ac7-1e70ae1 WriteFile 1070->1072 1073 1e70aa4 1070->1073 1076 1e70ae3-1e70b0a 1072->1076 1077 1e70b0c-1e70b31 FindCloseChangeNotification VirtualFree 1072->1077 1078 1e70aa6-1e70aac 1073->1078 1079 1e70aae-1e70ac5 1073->1079 1076->1055 1077->1055 1078->1072 1078->1079 1079->1070
                                    APIs
                                    • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 01E70965
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateFile
                                    • String ID:
                                    • API String ID: 823142352-0
                                    • Opcode ID: 28aa79915beb11918698720707ebb43b2bda4a086287e743706ae16bd51aa008
                                    • Instruction ID: e73d7b7f333f9d546efa58d06d6582cc3ff5638e8f24ff9f7e8f19ccc20d6b6e
                                    • Opcode Fuzzy Hash: 28aa79915beb11918698720707ebb43b2bda4a086287e743706ae16bd51aa008
                                    • Instruction Fuzzy Hash: AB71CA75A10208EBEF24DFA4CC85FEEB775BF4C704F109558F616AB280DA749A44CB64
                                    Function 000139E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1097 139e7-13a57 CreateWindowExW * 2 ShowWindow * 2
                                    APIs
                                    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00013A15
                                    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00013A36
                                    • ShowWindow.USER32(00000000,?,?), ref: 00013A4A
                                    • ShowWindow.USER32(00000000,?,?), ref: 00013A53
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$CreateShow
                                    • String ID: AutoIt v3$edit
                                    • API String ID: 1584632944-3779509399
                                    • Opcode ID: 4308661d66962059c04accc828f7c8ddacc7ceb790d99c6c18d311a17ff4d0b6
                                    • Instruction ID: c0d37b21f38f9d1908f1a4ea9a6f404d10b7730f192cb0a3a408529356ef7b79
                                    • Opcode Fuzzy Hash: 4308661d66962059c04accc828f7c8ddacc7ceb790d99c6c18d311a17ff4d0b6
                                    • Instruction Fuzzy Hash: 81F0DA716426907EFE311767AC49E776F7DE7C6F50B00412BBD04E6170C6AA1851DAB0
                                    Function 0001410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1098 1410d-14123 1099 14200-14204 1098->1099 1100 14129-1413e call 17b76 1098->1100 1103 14144-14164 call 17d2c 1100->1103 1104 4d5dd-4d5ec LoadStringW 1100->1104 1106 4d5f7-4d60f call 17c8e call 17143 1103->1106 1109 1416a-1416e 1103->1109 1104->1106 1116 1417e-141fb call 33020 call 1463e call 32ffc Shell_NotifyIconW call 15a64 1106->1116 1120 4d615-4d633 call 17e0b call 17143 call 17e0b 1106->1120 1110 14205-1420e call 181a7 1109->1110 1111 14174-14179 call 17c8e 1109->1111 1110->1116 1111->1116 1116->1099 1120->1116
                                    APIs
                                    • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0004D5EC
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    • _memset.LIBCMT ref: 0001418D
                                    • _wcscpy.LIBCMT ref: 000141E1
                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000141F1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
                                    • String ID: Line:
                                    • API String ID: 3942752672-1585850449
                                    • Opcode ID: 5c9bb2c549b029fa445b5b6aba52f43c1f29b315b96e6c9ff1d0cda1287082f7
                                    • Instruction ID: d58e97a6cea1d2d5c9b54a9cb46b1bb4715bbcdf8bd692621b23c8c0dd619759
                                    • Opcode Fuzzy Hash: 5c9bb2c549b029fa445b5b6aba52f43c1f29b315b96e6c9ff1d0cda1287082f7
                                    • Instruction Fuzzy Hash: 8A31A171009304AAE761EB60DC45BEB77ECAF44310F10451FF589930A2DB749688CB93
                                    Function 0003564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1133 3564d-35666 1134 35683 1133->1134 1135 35668-3566d 1133->1135 1136 35685-3568b 1134->1136 1135->1134 1137 3566f-35671 1135->1137 1138 35673-35678 call 38d68 1137->1138 1139 3568c-35691 1137->1139 1151 3567e call 38ff6 1138->1151 1140 35693-3569d 1139->1140 1141 3569f-356a3 1139->1141 1140->1141 1143 356c3-356d2 1140->1143 1144 356b3-356b5 1141->1144 1145 356a5-356b0 call 33020 1141->1145 1149 356d4-356d7 1143->1149 1150 356d9 1143->1150 1144->1138 1148 356b7-356c1 1144->1148 1145->1144 1148->1138 1148->1143 1153 356de-356e3 1149->1153 1150->1153 1151->1134 1155 356e9-356f0 1153->1155 1156 357cc-357cf 1153->1156 1157 356f2-356fa 1155->1157 1158 35731-35733 1155->1158 1156->1136 1157->1158 1161 356fc 1157->1161 1159 35735-35737 1158->1159 1160 3579d-3579e call 40df7 1158->1160 1164 3575b-35766 1159->1164 1165 35739-35741 1159->1165 1172 357a3-357a7 1160->1172 1162 35702-35704 1161->1162 1163 357fa 1161->1163 1167 35706-35708 1162->1167 1168 3570b-35710 1162->1168 1169 357fe-35807 1163->1169 1173 3576a-3576d 1164->1173 1174 35768 1164->1174 1170 35743-3574f 1165->1170 1171 35751-35755 1165->1171 1167->1168 1175 35716-3572f call 40f18 1168->1175 1176 357d4-357d8 1168->1176 1169->1136 1177 35757-35759 1170->1177 1171->1177 1172->1169 1178 357a9-357ae 1172->1178 1173->1176 1179 3576f-3577b call 34916 call 410ab 1173->1179 1174->1173 1193 35792-3579b 1175->1193 1183 357ea-357f5 call 38d68 1176->1183 1184 357da-357e7 call 33020 1176->1184 1177->1173 1178->1176 1182 357b0-357c1 1178->1182 1194 35780-35785 1179->1194 1189 357c4-357c6 1182->1189 1183->1151 1184->1183 1189->1155 1189->1156 1193->1189 1195 3578b-3578e 1194->1195 1196 3580c-35810 1194->1196 1195->1163 1197 35790 1195->1197 1196->1169 1197->1193
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                    • String ID:
                                    • API String ID: 1559183368-0
                                    • Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
                                    • Instruction ID: 87fe83054b6c31414e8598a7ca84e17cc668c04ec4f3cc14349263de76305a4f
                                    • Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
                                    • Instruction Fuzzy Hash: C151A130A04B05DBDB668FB9DC856AEB7F9AF40322F648729F825972E1D7709D508B40
                                    Function 000169CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00014F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,000D62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00014F6F
                                    • _free.LIBCMT ref: 0004E68C
                                    • _free.LIBCMT ref: 0004E6D3
                                      • Part of subcall function 00016BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00016D0D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _free$CurrentDirectoryLibraryLoad
                                    • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                    • API String ID: 2861923089-1757145024
                                    • Opcode ID: 03080801ecf8347d36805236c7e3e0cc94dd05fb09bfaae7c75fa5b1102da97d
                                    • Instruction ID: c84ddb85e6588ea7e7bd02ca63da0e4d1e6d576029ff2e3ffcfc607aad938523
                                    • Opcode Fuzzy Hash: 03080801ecf8347d36805236c7e3e0cc94dd05fb09bfaae7c75fa5b1102da97d
                                    • Instruction Fuzzy Hash: FD916BB1910259EFCF14EFA4CC919EDB7B8FF18314F14446AF815AB2A2DB30A945CB64
                                    Function 01E72410 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 01E72300: Sleep.KERNELBASE(000001F4), ref: 01E72311
                                    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01E72560
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateFileSleep
                                    • String ID: AYDGBZV8QHCA08CPPGTST
                                    • API String ID: 2694422964-203618830
                                    • Opcode ID: b69ae6d3499636bbe93f4e21501964b50d543997bbf4f8544218bcd1f290403b
                                    • Instruction ID: 450281081aab32b44c051b8382f7c5b5884a627101891e75862eb35f5991f8d9
                                    • Opcode Fuzzy Hash: b69ae6d3499636bbe93f4e21501964b50d543997bbf4f8544218bcd1f290403b
                                    • Instruction Fuzzy Hash: 92619130D04289DAEF11DBE4D854BEEBB75AF18304F004199E649BB2C1D6BA1B44CBA6
                                    Function 000173E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 0004EE62
                                    • GetOpenFileNameW.COMDLG32(?), ref: 0004EEAC
                                      • Part of subcall function 000148AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000148A1,?,?,000137C0,?), ref: 000148CE
                                      • Part of subcall function 000309D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000309F4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Name$Path$FileFullLongOpen_memset
                                    • String ID: X$am cannot be run in DOS mode.$
                                    • API String ID: 3777226403-4181034525
                                    • Opcode ID: 62ac42f0ebb2f590f5efd15611c6d7ab8123d0932f26e90d0c4505084c831e15
                                    • Instruction ID: 74c996a07c5b9b771526f4923b440ca62e994c04f928cf85c1999d5d9e473d70
                                    • Opcode Fuzzy Hash: 62ac42f0ebb2f590f5efd15611c6d7ab8123d0932f26e90d0c4505084c831e15
                                    • Instruction Fuzzy Hash: 2921967191025C9BDB51DF94CC45BEE7BFCAF49310F00405AE508E7282DBB8598A8BA1
                                    Function 000135B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,000135A1,SwapMouseButtons,00000004,?), ref: 000135D4
                                    • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,000135A1,SwapMouseButtons,00000004,?,?,?,?,00012754), ref: 000135F5
                                    • RegCloseKey.KERNELBASE(00000000,?,?,000135A1,SwapMouseButtons,00000004,?,?,?,?,00012754), ref: 00013617
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CloseOpenQueryValue
                                    • String ID: Control Panel\Mouse
                                    • API String ID: 3677997916-824357125
                                    • Opcode ID: d6abaa41e62cc98603d4783198e1e09cf425956c6b695b901331795a11f7830e
                                    • Instruction ID: fd4f7bdd20d2bcacbc9fee09d448ebc059ae9052a8db7f7d5656c692069efb2f
                                    • Opcode Fuzzy Hash: d6abaa41e62cc98603d4783198e1e09cf425956c6b695b901331795a11f7830e
                                    • Instruction Fuzzy Hash: 9F1115B5615218BFEB208F64DC84AFFBBBCEF44740F11856AE805D7210E6719E949BA0
                                    Function 0003493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                    • String ID:
                                    • API String ID: 2782032738-0
                                    • Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
                                    • Instruction ID: baadbfbea916bf256f08bfaa0c5f5b1232110c0e500d25efbc9530b71bead1f3
                                    • Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
                                    • Instruction Fuzzy Hash: BB41A571640B059BDB6ACEA9C880AAF7BEDEF84360F24817EE855CF650D770AD408B45
                                    Function 00014DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memmove
                                    • String ID: AU3!P/$EA06
                                    • API String ID: 4104443479-4224917454
                                    • Opcode ID: 83ee2db3c2443152b243a3125c2d25ae830786d3a81ee840d832bb345847d41f
                                    • Instruction ID: 8311df2166e96670c10928f2ba291cac9387431ade46e9fd1e2c499e8a953d0b
                                    • Opcode Fuzzy Hash: 83ee2db3c2443152b243a3125c2d25ae830786d3a81ee840d832bb345847d41f
                                    • Instruction Fuzzy Hash: 5F417D71A045589BCF229F64CC91BFE7FE6AF45300F284075F8829B2A3C6619DC587E1
                                    Function 0007901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __fread_nolock_memmove
                                    • String ID: EA06
                                    • API String ID: 1988441806-3962188686
                                    • Opcode ID: ac3b47d8b795f608918fb550a65678daeb4260ed53bba1d4a34f1ab4c02ae707
                                    • Instruction ID: 6408c571e25fa77c11109bd69ac81434022f56e933bcd6b514739cc529d82d23
                                    • Opcode Fuzzy Hash: ac3b47d8b795f608918fb550a65678daeb4260ed53bba1d4a34f1ab4c02ae707
                                    • Instruction Fuzzy Hash: 2901F971D042586EDB29C7A8CC16FEEBBFC9B05301F00419EF552D2181E5B9A6048BA0
                                    Function 01E71060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 01E710A5
                                    • ExitProcess.KERNEL32(00000000), ref: 01E710C4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Process$CreateExit
                                    • String ID: D
                                    • API String ID: 126409537-2746444292
                                    • Opcode ID: 359d21864460d0aa6716f03c0fb9f93045a71ab212c145842ddc1246808d9d7c
                                    • Instruction ID: 588a72a78960ac4d3e5e3efd8f763a01e7be12ac7a31f1f4db9c05c79c73bd0c
                                    • Opcode Fuzzy Hash: 359d21864460d0aa6716f03c0fb9f93045a71ab212c145842ddc1246808d9d7c
                                    • Instruction Fuzzy Hash: 5BF0FF71A4024DABEB60EFE0CC49FEE777CBF08701F008509FB1A9A180DA7496088B61
                                    Function 00079B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetTempPathW.KERNEL32(00000104,?), ref: 00079B82
                                    • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00079B99
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Temp$FileNamePath
                                    • String ID: aut
                                    • API String ID: 3285503233-3010740371
                                    • Opcode ID: 80cb564ae43de490ad69bc846a66ec039e252c2af0af0fc98476cb4f3a00032c
                                    • Instruction ID: 25e4144e78e65ebb6343eade1979b0f1980b6a57b9a703613b7420e45d8885f5
                                    • Opcode Fuzzy Hash: 80cb564ae43de490ad69bc846a66ec039e252c2af0af0fc98476cb4f3a00032c
                                    • Instruction Fuzzy Hash: C6D05E7954030EABEB109B90DC0EFAA772CE704704F0042A2BF54D50A1DEB455988B95
                                    Function 0008CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3195a5c0aae654b109175472987f24131219b8e6e38bc5575b551872bd9a6b61
                                    • Instruction ID: 9ced1c66487c410bec038ea31af5d023ad82338a128ac64e4c50f3a57c331801
                                    • Opcode Fuzzy Hash: 3195a5c0aae654b109175472987f24131219b8e6e38bc5575b551872bd9a6b61
                                    • Instruction Fuzzy Hash: 30F12A715083059FC714EF28C494AAABBE5FF88314F54892EF8999B292D731E945CF82
                                    Function 000143DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00014401
                                    • Shell_NotifyIconW.SHELL32(00000000,?), ref: 000144A6
                                    • Shell_NotifyIconW.SHELL32(00000001,?), ref: 000144C3
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: IconNotifyShell_$_memset
                                    • String ID:
                                    • API String ID: 1505330794-0
                                    • Opcode ID: 4c8b58930c582207ecf51b34c97a966362fec7555716755d5df0807c53669383
                                    • Instruction ID: 43b1f5dd9f7cbb78d1f84da95b970b44c24eea1d32d2d8bb85091642b372007b
                                    • Opcode Fuzzy Hash: 4c8b58930c582207ecf51b34c97a966362fec7555716755d5df0807c53669383
                                    • Instruction Fuzzy Hash: BD316FB05057019FE761DF64D8847EBBBE8FB48308F00092EF99A83251D775A984CB92
                                    Function 0003594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • __FF_MSGBANNER.LIBCMT ref: 00035963
                                      • Part of subcall function 0003A3AB: __NMSG_WRITE.LIBCMT ref: 0003A3D2
                                      • Part of subcall function 0003A3AB: __NMSG_WRITE.LIBCMT ref: 0003A3DC
                                    • __NMSG_WRITE.LIBCMT ref: 0003596A
                                      • Part of subcall function 0003A408: GetModuleFileNameW.KERNEL32(00000000,000D43BA,00000104,?,00000001,00000000), ref: 0003A49A
                                      • Part of subcall function 0003A408: ___crtMessageBoxW.LIBCMT ref: 0003A548
                                      • Part of subcall function 000332DF: ___crtCorExitProcess.LIBCMT ref: 000332E5
                                      • Part of subcall function 000332DF: ExitProcess.KERNEL32 ref: 000332EE
                                      • Part of subcall function 00038D68: __getptd_noexit.LIBCMT ref: 00038D68
                                    • RtlAllocateHeap.NTDLL(01170000,00000000,00000001,00000000,?,?,?,00031013,?), ref: 0003598F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                    • String ID:
                                    • API String ID: 1372826849-0
                                    • Opcode ID: 0a03a04b1de65a6a1a378f53243902018f5d8cca733f0743a739cced33b4fe79
                                    • Instruction ID: d5c469251dea6cef1f554d6ea18a96b6c17013e45ae07494b6738c72f4012918
                                    • Opcode Fuzzy Hash: 0a03a04b1de65a6a1a378f53243902018f5d8cca733f0743a739cced33b4fe79
                                    • Instruction Fuzzy Hash: 1301B131301B16DFE6237B65EC52BAEB39C9F42772F50012BF941AA1E2EE749D018760
                                    Function 00079B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,000797D2,?,?,?,?,?,00000004), ref: 00079B45
                                    • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,000797D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00079B5B
                                    • CloseHandle.KERNEL32(00000000,?,000797D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00079B62
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: File$CloseCreateHandleTime
                                    • String ID:
                                    • API String ID: 3397143404-0
                                    • Opcode ID: e2fd0f45618c4c4cac98ec7ab57dd8f7df30b4b231cef9b3735e1a4908c64c13
                                    • Instruction ID: 618e9d8422aeb7b3b6276a8f6eaebdc04fd7f6a5f945828cf2ad29fc720ca478
                                    • Opcode Fuzzy Hash: e2fd0f45618c4c4cac98ec7ab57dd8f7df30b4b231cef9b3735e1a4908c64c13
                                    • Instruction Fuzzy Hash: 95E08632580215F7E7211B64EC09FDA7B58FB05761F108121FB14A90E087B5261197DC
                                    Function 00078F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                    Download Yara Rule
                                    APIs
                                    • _free.LIBCMT ref: 00078FA5
                                      • Part of subcall function 00032F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00039C64), ref: 00032FA9
                                      • Part of subcall function 00032F95: GetLastError.KERNEL32(00000000,?,00039C64), ref: 00032FBB
                                    • _free.LIBCMT ref: 00078FB6
                                    • _free.LIBCMT ref: 00078FC8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _free$ErrorFreeHeapLast
                                    • String ID:
                                    • API String ID: 776569668-0
                                    • Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
                                    • Instruction ID: 1db3389624e38ae568d81eabc13c5d322738f741f59c69834dfa6ae3edc158aa
                                    • Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
                                    • Instruction Fuzzy Hash: 67E012B1A097014ECA64A578AD44BE357EE5F48360B18883DF40DDB143DF28E8818238
                                    Function 0001AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: CALL
                                    • API String ID: 0-4196123274
                                    • Opcode ID: 9df59d559a1dc345c2b3ad971573e9ea5bce790bd93df3416469f436bc3e3d14
                                    • Instruction ID: bba5b3eb601b269a193da9147f739949454adb527ff97bb9b1f0f22b6ee5c1cb
                                    • Opcode Fuzzy Hash: 9df59d559a1dc345c2b3ad971573e9ea5bce790bd93df3416469f436bc3e3d14
                                    • Instruction Fuzzy Hash: F4223770609341DFD725DF14C494BAABBE1BF89300F14896DE88A8B362D735ED85CB82
                                    Function 0001492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                    Download Yara Rule
                                    APIs
                                    • IsThemeActive.UXTHEME ref: 00014992
                                      • Part of subcall function 000335AC: __lock.LIBCMT ref: 000335B2
                                      • Part of subcall function 000335AC: DecodePointer.KERNEL32(00000001,?,000149A7,000681BC), ref: 000335BE
                                      • Part of subcall function 000335AC: EncodePointer.KERNEL32(?,?,000149A7,000681BC), ref: 000335C9
                                      • Part of subcall function 00014A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00014A73
                                      • Part of subcall function 00014A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00014A88
                                      • Part of subcall function 00013B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00013B7A
                                      • Part of subcall function 00013B4C: IsDebuggerPresent.KERNEL32 ref: 00013B8C
                                      • Part of subcall function 00013B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,000D62F8,000D62E0,?,?), ref: 00013BFD
                                      • Part of subcall function 00013B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00013C81
                                    • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 000149D2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                    • String ID:
                                    • API String ID: 1438897964-0
                                    • Opcode ID: 5cced5ce8a723dd009cecb3a372e7f230a6088f8bbb517e520c9e1149f0aa4a9
                                    • Instruction ID: 96bc747b58e209ce3956ad0d8eb45b11af9f58f68f930d50053bc7d338ecbbfa
                                    • Opcode Fuzzy Hash: 5cced5ce8a723dd009cecb3a372e7f230a6088f8bbb517e520c9e1149f0aa4a9
                                    • Instruction Fuzzy Hash: 881189719093119BD700EF28EC4599AFFE8EF98710F00851FF845872B2DB759688CBA6
                                    Function 00015DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00015981,?,?,?,?), ref: 00015E27
                                    • CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00015981,?,?,?,?), ref: 0004E19C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateFile
                                    • String ID:
                                    • API String ID: 823142352-0
                                    • Opcode ID: 9caad56aed53af36b2e28e74ca090ee4e0e6866bcbb5b01e8f4b09d458b03718
                                    • Instruction ID: ade432b46661afc4a2addc9c4aa562f6764c2906501dcb33687cade21f3cab92
                                    • Opcode Fuzzy Hash: 9caad56aed53af36b2e28e74ca090ee4e0e6866bcbb5b01e8f4b09d458b03718
                                    • Instruction Fuzzy Hash: 3A019270684708FEF3680E24CC8AFB63ADCBB01769F108319BAE55E1E0C6B41E858B54
                                    Function 00030FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0003594C: __FF_MSGBANNER.LIBCMT ref: 00035963
                                      • Part of subcall function 0003594C: __NMSG_WRITE.LIBCMT ref: 0003596A
                                      • Part of subcall function 0003594C: RtlAllocateHeap.NTDLL(01170000,00000000,00000001,00000000,?,?,?,00031013,?), ref: 0003598F
                                    • std::exception::exception.LIBCMT ref: 0003102C
                                    • __CxxThrowException@8.LIBCMT ref: 00031041
                                      • Part of subcall function 000387DB: RaiseException.KERNEL32(?,?,?,000CBAF8,00000000,?,?,?,?,00031046,?,000CBAF8,?,00000001), ref: 00038830
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                    • String ID:
                                    • API String ID: 3902256705-0
                                    • Opcode ID: 7d3b0e4e142f659d79a15ab62811695d28a33838145c23384825e3249e546994
                                    • Instruction ID: 2865ad06d4cd4e90aa0ac02654202f393fe137f2407fb7d6e5909f3db4b8e24b
                                    • Opcode Fuzzy Hash: 7d3b0e4e142f659d79a15ab62811695d28a33838145c23384825e3249e546994
                                    • Instruction Fuzzy Hash: F2F0A435504319A6CB26AAD8EC06ADF77AC9F05351F104466F804A6993DFB18A948291
                                    Function 0003582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __lock_file_memset
                                    • String ID:
                                    • API String ID: 26237723-0
                                    • Opcode ID: b136ba1206c8ada1ded2cfe09720ee2bd71ff774cc6d056034b12dfa9a3fa782
                                    • Instruction ID: e6fe8ccb477030091b86e8a02377459aac3fa394f6054133a19f79cf4b3ee0a1
                                    • Opcode Fuzzy Hash: b136ba1206c8ada1ded2cfe09720ee2bd71ff774cc6d056034b12dfa9a3fa782
                                    • Instruction Fuzzy Hash: B901A771C00709EBCF23AF698C069DF7BA9AF44361F148255F8146B1B2DF318A11DB91
                                    Function 000355D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00038D68: __getptd_noexit.LIBCMT ref: 00038D68
                                    • __lock_file.LIBCMT ref: 0003561B
                                      • Part of subcall function 00036E4E: __lock.LIBCMT ref: 00036E71
                                    • __fclose_nolock.LIBCMT ref: 00035626
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                    • String ID:
                                    • API String ID: 2800547568-0
                                    • Opcode ID: 4110006fc33acd3b65613dd1507bd7bca4adeb59ec76e8735f28af52be364d98
                                    • Instruction ID: d22de426117d12302f17b34d756f968240e514168b83877fed0d42364a94d642
                                    • Opcode Fuzzy Hash: 4110006fc33acd3b65613dd1507bd7bca4adeb59ec76e8735f28af52be364d98
                                    • Instruction Fuzzy Hash: 77F0B471904B059AD723AF758C037AEB7E96F40336F55C249B814AB1D3CF7C8A019B95
                                    Function 00022123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8d9dac24cd8d3ea57184302851421dec185c3e2a593b4ec6678309387ec81c5b
                                    • Instruction ID: 4b641b37f9d5d7522cb878015888da65ae850a889c0cddd1f19e58f1205f4954
                                    • Opcode Fuzzy Hash: 8d9dac24cd8d3ea57184302851421dec185c3e2a593b4ec6678309387ec81c5b
                                    • Instruction Fuzzy Hash: 28517C34600614EFCF14EBA4D991EEE77EAAF85310F148168F94AAB293CA31ED44CB51
                                    Function 01E710D0 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 01E708E0: GetFileAttributesW.KERNELBASE(?), ref: 01E708EB
                                    • CreateDirectoryW.KERNELBASE(?,00000000), ref: 01E711FF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AttributesCreateDirectoryFile
                                    • String ID:
                                    • API String ID: 3401506121-0
                                    • Opcode ID: 96b0b74a6112d946d410d648ae406f5b63b880fbcc2fbecee08befd60fe6673c
                                    • Instruction ID: 3071db361320b02cdbf6734b7326fe166402b71cbf81515e6f7af601a6913323
                                    • Opcode Fuzzy Hash: 96b0b74a6112d946d410d648ae406f5b63b880fbcc2fbecee08befd60fe6673c
                                    • Instruction Fuzzy Hash: 7F51A631A1024E96EF14EFB4C944BEF7379EF58700F0055A9A609E7180EB799B44CBA5
                                    Function 0001766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memmove
                                    • String ID:
                                    • API String ID: 4104443479-0
                                    • Opcode ID: 137ddfd0232708e3b58a8764eb2c3eda55301eb74d4565348677704d51d6fb2f
                                    • Instruction ID: c6241ead21a069e8ac4450f5d1531136ec5390cc0c26f0ee60a4502371ddfe6f
                                    • Opcode Fuzzy Hash: 137ddfd0232708e3b58a8764eb2c3eda55301eb74d4565348677704d51d6fb2f
                                    • Instruction Fuzzy Hash: 43319279208A02DFD7259F18C590AA5F7F4FF09310B14C569E98E8B7A6E730E8D1CB94
                                    Function 00015C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00015CF6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FilePointer
                                    • String ID:
                                    • API String ID: 973152223-0
                                    • Opcode ID: 5d3c6b2a2121aba9d1693bbe2567da27f72b0c1cc8e8e1ef681d0fe88b14e333
                                    • Instruction ID: dc9facccc5de3568f6a02762de49e6498f575b99a21e6d8de39ea263c45f4ca6
                                    • Opcode Fuzzy Hash: 5d3c6b2a2121aba9d1693bbe2567da27f72b0c1cc8e8e1ef681d0fe88b14e333
                                    • Instruction Fuzzy Hash: 93313C71A00B0AEFCB18DF69D8846ADB7B5FF88311F148629D81997710D771A9A0DBD0
                                    Function 000500D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClearVariant
                                    • String ID:
                                    • API String ID: 1473721057-0
                                    • Opcode ID: 05532cc441203a55e574b9e5a6ea7ef32e74cca6086c829e71e4ad3455319c52
                                    • Instruction ID: d7ae71e3bae4ab49868f1a536fca7401332e0b9f385b650ee91173a2bf5655e8
                                    • Opcode Fuzzy Hash: 05532cc441203a55e574b9e5a6ea7ef32e74cca6086c829e71e4ad3455319c52
                                    • Instruction Fuzzy Hash: C0411974604351CFDB24DF14C484B5ABBE0BF45318F19889CE88A8B362C376EC85CB52
                                    Function 00014F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00014D13: FreeLibrary.KERNEL32(00000000,?), ref: 00014D4D
                                      • Part of subcall function 0003548B: __wfsopen.LIBCMT ref: 00035496
                                    • LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,000D62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00014F6F
                                      • Part of subcall function 00014CC8: FreeLibrary.KERNEL32(00000000), ref: 00014D02
                                      • Part of subcall function 00014DD0: _memmove.LIBCMT ref: 00014E1A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Library$Free$Load__wfsopen_memmove
                                    • String ID:
                                    • API String ID: 1396898556-0
                                    • Opcode ID: 585c4bbed8b70c4317d41d294416ed84b548f9c5e52826ff1699b4adf0a39cc5
                                    • Instruction ID: 422c133b9ff2310b4be3f86f7e3c5dc3d8160409a8054069631c2309e8cb2030
                                    • Opcode Fuzzy Hash: 585c4bbed8b70c4317d41d294416ed84b548f9c5e52826ff1699b4adf0a39cc5
                                    • Instruction Fuzzy Hash: 77112731A00205AACF15BF70DC02BEE73A89F44711F20843DF545AB2D2DA759A459790
                                    Function 000501AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClearVariant
                                    • String ID:
                                    • API String ID: 1473721057-0
                                    • Opcode ID: 3241154dbe961b55d2068ab01fde52de43dce9265fb3dbb2ced89910b29f3437
                                    • Instruction ID: a9e9e8d031131a8aae9b10b5385405a6c1a68df330fc00c3d6fd96f6e7ea77ac
                                    • Opcode Fuzzy Hash: 3241154dbe961b55d2068ab01fde52de43dce9265fb3dbb2ced89910b29f3437
                                    • Instruction Fuzzy Hash: 722122B4608341DFCB24DF54C484A9BBBE4BF89314F048968F88A87722D731E899CB52
                                    Function 00015D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00015807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00015D76
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FileRead
                                    • String ID:
                                    • API String ID: 2738559852-0
                                    • Opcode ID: 43c5f6c427e42d61b36671c7d3a44f680f7313ae020f9bf70161a04d6ee7a133
                                    • Instruction ID: df3d06d87de740afae57de40dcb11dce12e9b8168cc7e6a13949c08dbe8f6731
                                    • Opcode Fuzzy Hash: 43c5f6c427e42d61b36671c7d3a44f680f7313ae020f9bf70161a04d6ee7a133
                                    • Instruction Fuzzy Hash: E2113A71200B01DFD3708F15E888BA6B7F5FF85751F10C92EE4AA8AA50D770E985CB60
                                    Function 00034A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                    Download Yara Rule
                                    APIs
                                    • __lock_file.LIBCMT ref: 00034AD6
                                      • Part of subcall function 00038D68: __getptd_noexit.LIBCMT ref: 00038D68
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __getptd_noexit__lock_file
                                    • String ID:
                                    • API String ID: 2597487223-0
                                    • Opcode ID: 223bcee4e2e0789d6f0079d8e2f6aecfdf388d4c1d9f524e8ac10fd5ae513103
                                    • Instruction ID: 2330514d1603477830ea7bc4b4ffbb00aecf1ce0010dc5a6d91eed13556f409b
                                    • Opcode Fuzzy Hash: 223bcee4e2e0789d6f0079d8e2f6aecfdf388d4c1d9f524e8ac10fd5ae513103
                                    • Instruction Fuzzy Hash: 56F0AF31940709ABDFA3AF658C067EF77ADAF00325F048554B424AE1D2DB789E50DF52
                                    Function 00014FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                    Download Yara Rule
                                    APIs
                                    • FreeLibrary.KERNEL32(?,?,000D62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00014FDE
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FreeLibrary
                                    • String ID:
                                    • API String ID: 3664257935-0
                                    • Opcode ID: 4d5eec36f4a31afe6adfedc994d580cd6f421e2a85f808ececc82b57f77342fb
                                    • Instruction ID: 227527131f3f36824e155ae6688f1e8ecde2cc3e54e2003c27a9261776316e6c
                                    • Opcode Fuzzy Hash: 4d5eec36f4a31afe6adfedc994d580cd6f421e2a85f808ececc82b57f77342fb
                                    • Instruction Fuzzy Hash: A1F03971505B16CFCB349F64E8948A6BBF5BF043293208A3EE1D682720C771A895DF40
                                    Function 000309D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000309F4
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: LongNamePath_memmove
                                    • String ID:
                                    • API String ID: 2514874351-0
                                    • Opcode ID: cee27f9d6777a0be936fa8c29a7a75d75bb7e38319418a79d88a003853f2a2db
                                    • Instruction ID: d3241d5ae6b6c6776faa08e67e6d76859d26bc3d00f06cd04a1b3f2a0fe6779b
                                    • Opcode Fuzzy Hash: cee27f9d6777a0be936fa8c29a7a75d75bb7e38319418a79d88a003853f2a2db
                                    • Instruction Fuzzy Hash: 28E0867690422857D720D6989C05FFA77ADDF88690F0401B6FD0CD7205D9649C818690
                                    Function 00079129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __fread_nolock
                                    • String ID:
                                    • API String ID: 2638373210-0
                                    • Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
                                    • Instruction ID: 6901edc6668e5d1968787cfca955161d9d82aaa7e47e91fff0b32231d5762e01
                                    • Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
                                    • Instruction Fuzzy Hash: 82E09AB0604B009FDB798A24D811BE373E0AB06315F00081CF2AA93342EB62B8528B5D
                                    Function 01E708E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFileAttributesW.KERNELBASE(?), ref: 01E708EB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AttributesFile
                                    • String ID:
                                    • API String ID: 3188754299-0
                                    • Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
                                    • Instruction ID: 1eb855a000a902405499f9ef5a3a5f98af9cc79dd31a77af1e41784845c658b6
                                    • Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
                                    • Instruction Fuzzy Hash: 10E08C71A0520DEBFB20CBBCE808AED77A8DB8A320F044654F91AC3280D6309A409654
                                    Function 00015DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0004E16B,?,?,00000000), ref: 00015DBF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FilePointer
                                    • String ID:
                                    • API String ID: 973152223-0
                                    • Opcode ID: fe3b7c2fe0ce3e8469c661bad4fc527c761e38a24fc1864a59c92a2fb984e0c5
                                    • Instruction ID: daf9c05f43ca79fd8dbf0396063df928d76a050f9c29e4f9c5a7ced60fdefe8b
                                    • Opcode Fuzzy Hash: fe3b7c2fe0ce3e8469c661bad4fc527c761e38a24fc1864a59c92a2fb984e0c5
                                    • Instruction Fuzzy Hash: 47D0C77464020CBFE710DB80DC46FA9777CE705710F100195FD0496290D6B27D508795
                                    Function 01E708B0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFileAttributesW.KERNELBASE(?), ref: 01E708BB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AttributesFile
                                    • String ID:
                                    • API String ID: 3188754299-0
                                    • Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
                                    • Instruction ID: 029c722b60f617d217477faec2c85b1439b27ffbd892b5868bdeb3fff835dc3b
                                    • Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
                                    • Instruction Fuzzy Hash: 79D0A73090620CEBEB10CFB89C04ADEB3A8DB09320F004754FD15D3281D63199409790
                                    Function 0003548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __wfsopen
                                    • String ID:
                                    • API String ID: 197181222-0
                                    • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                    • Instruction ID: fcde7fbc66384f3bec4cc0f9b708ef110a1306261daaf8a1af773c1a1afa699e
                                    • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                    • Instruction Fuzzy Hash: 41B0927688020C77DE022E82EC02A993B1D9B40679F808020FB0C18172A673A6A09689
                                    Function 0007D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.KERNEL32(00000002,00000000), ref: 0007D46A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID:
                                    • API String ID: 1452528299-0
                                    • Opcode ID: 065bef42bdc0dbf4c2d5edc84a3bfaf582f17a40216a02518adf9956fb6c215d
                                    • Instruction ID: e2164b20fc5cae3e074b7a62f59537246221784a6d453552115d3379f2a7fdd1
                                    • Opcode Fuzzy Hash: 065bef42bdc0dbf4c2d5edc84a3bfaf582f17a40216a02518adf9956fb6c215d
                                    • Instruction Fuzzy Hash: 9B7151306087028FC754EF24D491AEEB7F1AF88314F44496DF49A9B2A2DB34ED49CB56
                                    Function 00030E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AllocVirtual
                                    • String ID:
                                    • API String ID: 4275171209-0
                                    • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                    • Instruction ID: 4dd681091c953c5209c85aa767a67535cadb50b55073cc4c4820e6c09077ce41
                                    • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                    • Instruction Fuzzy Hash: C431D374B01106DFC76ADF58C4A0969F7AAFF59300F648AA5E409CB651D731EDC1CB80
                                    Function 01E722FC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • Sleep.KERNELBASE(000001F4), ref: 01E72311
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Sleep
                                    • String ID:
                                    • API String ID: 3472027048-0
                                    • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                    • Instruction ID: 1f17857cd58eb77c1f81cbca7b615bb711e73276ba67f2a22858b528e621c7ac
                                    • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                    • Instruction Fuzzy Hash: D6E0BF7494010EEFDB00EFB4D5496DE7BB4EF04301F5005A1FD05D7681DB309E548A62
                                    Function 01E72300 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • Sleep.KERNELBASE(000001F4), ref: 01E72311
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2811168390.0000000001E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E70000, based on PE: false
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_1e70000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Sleep
                                    • String ID:
                                    • API String ID: 3472027048-0
                                    • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                    • Instruction ID: c2826f500650666cd7b4e9aa3de1e6582836942640a01706127a9cbd26f63ac0
                                    • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                    • Instruction Fuzzy Hash: 7AE0E67494010EEFDB00EFB4D54969E7FF4EF04301F500561FD05D2281D6309D508A62

                                    Non-executed Functions

                                    Function 0009CDAC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 637windowkeyboardCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0009CE50
                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0009CE91
                                    • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0009CED6
                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0009CF00
                                    • SendMessageW.USER32 ref: 0009CF29
                                    • _wcsncpy.LIBCMT ref: 0009CFA1
                                    • GetKeyState.USER32(00000011), ref: 0009CFC2
                                    • GetKeyState.USER32(00000009), ref: 0009CFCF
                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0009CFE5
                                    • GetKeyState.USER32(00000010), ref: 0009CFEF
                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0009D018
                                    • SendMessageW.USER32 ref: 0009D03F
                                    • SendMessageW.USER32(?,00001030,?,0009B602), ref: 0009D145
                                    • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0009D15B
                                    • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0009D16E
                                    • SetCapture.USER32(?), ref: 0009D177
                                    • ClientToScreen.USER32(?,?), ref: 0009D1DC
                                    • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0009D1E9
                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0009D203
                                    • ReleaseCapture.USER32 ref: 0009D20E
                                    • GetCursorPos.USER32(?), ref: 0009D248
                                    • ScreenToClient.USER32(?,?), ref: 0009D255
                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 0009D2B1
                                    • SendMessageW.USER32 ref: 0009D2DF
                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 0009D31C
                                    • SendMessageW.USER32 ref: 0009D34B
                                    • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0009D36C
                                    • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0009D37B
                                    • GetCursorPos.USER32(?), ref: 0009D39B
                                    • ScreenToClient.USER32(?,?), ref: 0009D3A8
                                    • GetParent.USER32(?), ref: 0009D3C8
                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 0009D431
                                    • SendMessageW.USER32 ref: 0009D462
                                    • ClientToScreen.USER32(?,?), ref: 0009D4C0
                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0009D4F0
                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 0009D51A
                                    • SendMessageW.USER32 ref: 0009D53D
                                    • ClientToScreen.USER32(?,?), ref: 0009D58F
                                    • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0009D5C3
                                      • Part of subcall function 000125DB: GetWindowLongW.USER32(?,000000EB), ref: 000125EC
                                    • GetWindowLongW.USER32(?,000000F0), ref: 0009D65F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                    • String ID: @GUI_DRAGID$F$pr
                                    • API String ID: 3977979337-907580709
                                    • Opcode ID: a6e7e149cca4b385230b5127a9eba3b4b60c6dab06a825585aabbc75531d7e9e
                                    • Instruction ID: 103373291b681313aab4253d9ad2534e9a5b3c6ce79b979c948b9c6d9084b9c2
                                    • Opcode Fuzzy Hash: a6e7e149cca4b385230b5127a9eba3b4b60c6dab06a825585aabbc75531d7e9e
                                    • Instruction Fuzzy Hash: 6A429E30604341AFEB25CF28C854FAABBE6FF49354F14061EF696872B1C7359850EB96
                                    Function 0009804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0009873F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend
                                    • String ID: %d/%02d/%02d
                                    • API String ID: 3850602802-328681919
                                    • Opcode ID: 87d1c063f01e2f935e6cea37e121b02ddcf1dcb87a4eaa22005dfba6fe086280
                                    • Instruction ID: 5de2cf4750207729d04da4b41f65ad90acb4aca006cf6086c6ed4f73e61fde8d
                                    • Opcode Fuzzy Hash: 87d1c063f01e2f935e6cea37e121b02ddcf1dcb87a4eaa22005dfba6fe086280
                                    • Instruction Fuzzy Hash: 0812CF71504209ABEF258F64CC49FAE7BF9EF46750F20812AF916EA2E1DF748941DB10
                                    Function 0002710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memmove$_memset
                                    • String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
                                    • API String ID: 1357608183-1798697756
                                    • Opcode ID: a7f6103beada167878c9df31de184bdb46155de19b66b5fa5877ec1d33964adc
                                    • Instruction ID: e6d50b8bfba64be3649c6786b25b5b15a0fb87c04f7e2cf07be3e142ec7a4ac2
                                    • Opcode Fuzzy Hash: a7f6103beada167878c9df31de184bdb46155de19b66b5fa5877ec1d33964adc
                                    • Instruction Fuzzy Hash: D6939175A04215DFDB24CF58D881BADB7F2FF48710F25816AE949EB281E7709E81CB90
                                    Function 00014A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetForegroundWindow.USER32(00000000,?), ref: 00014A3D
                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0004DA8E
                                    • IsIconic.USER32(?), ref: 0004DA97
                                    • ShowWindow.USER32(?,00000009), ref: 0004DAA4
                                    • SetForegroundWindow.USER32(?), ref: 0004DAAE
                                    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0004DAC4
                                    • GetCurrentThreadId.KERNEL32 ref: 0004DACB
                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0004DAD7
                                    • AttachThreadInput.USER32(?,00000000,00000001), ref: 0004DAE8
                                    • AttachThreadInput.USER32(?,00000000,00000001), ref: 0004DAF0
                                    • AttachThreadInput.USER32(00000000,?,00000001), ref: 0004DAF8
                                    • SetForegroundWindow.USER32(?), ref: 0004DAFB
                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0004DB10
                                    • keybd_event.USER32(00000012,00000000), ref: 0004DB1B
                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0004DB25
                                    • keybd_event.USER32(00000012,00000000), ref: 0004DB2A
                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0004DB33
                                    • keybd_event.USER32(00000012,00000000), ref: 0004DB38
                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 0004DB42
                                    • keybd_event.USER32(00000012,00000000), ref: 0004DB47
                                    • SetForegroundWindow.USER32(?), ref: 0004DB4A
                                    • AttachThreadInput.USER32(?,?,00000000), ref: 0004DB71
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                    • String ID: Shell_TrayWnd
                                    • API String ID: 4125248594-2988720461
                                    • Opcode ID: 971ee783c2aaf311300f6669d7d2af4147ba2b1c83910c819b6ec742c5b8fc59
                                    • Instruction ID: 4b60acd0d30984b6bee1a338f07d8cc272623d91a64d4b31bbfb2360fb066779
                                    • Opcode Fuzzy Hash: 971ee783c2aaf311300f6669d7d2af4147ba2b1c83910c819b6ec742c5b8fc59
                                    • Instruction Fuzzy Hash: 363163B1A40319BBFB216FA19C49F7F7EACFB44B50F114036FA04EA1D0C6B45D10AAA5
                                    Function 00068858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00068CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00068D0D
                                      • Part of subcall function 00068CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00068D3A
                                      • Part of subcall function 00068CC3: GetLastError.KERNEL32 ref: 00068D47
                                    • _memset.LIBCMT ref: 0006889B
                                    • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 000688ED
                                    • CloseHandle.KERNEL32(?), ref: 000688FE
                                    • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00068915
                                    • GetProcessWindowStation.USER32 ref: 0006892E
                                    • SetProcessWindowStation.USER32(00000000), ref: 00068938
                                    • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00068952
                                      • Part of subcall function 00068713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00068851), ref: 00068728
                                      • Part of subcall function 00068713: CloseHandle.KERNEL32(?,?,00068851), ref: 0006873A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                    • String ID: $default$winsta0
                                    • API String ID: 2063423040-1027155976
                                    • Opcode ID: 4f5fa2e65533a21a5649cd249ec9da635dc65b4d7f19dc06d4ac0e3542345404
                                    • Instruction ID: 85897f71948e6e14ad4d0507a1d4b44e577f9f8dbc042aba504a21ba12b70f49
                                    • Opcode Fuzzy Hash: 4f5fa2e65533a21a5649cd249ec9da635dc65b4d7f19dc06d4ac0e3542345404
                                    • Instruction Fuzzy Hash: 0A813CB1940209AFEF11DFE4DC45AEE7BBAFF04304F18826AFD10A6161DB758E149B61
                                    Function 0008425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                    Download Yara Rule
                                    APIs
                                    • OpenClipboard.USER32(0009F910), ref: 00084284
                                    • IsClipboardFormatAvailable.USER32(0000000D), ref: 00084292
                                    • GetClipboardData.USER32(0000000D), ref: 0008429A
                                    • CloseClipboard.USER32 ref: 000842A6
                                    • GlobalLock.KERNEL32(00000000), ref: 000842C2
                                    • CloseClipboard.USER32 ref: 000842CC
                                    • GlobalUnlock.KERNEL32(00000000,00000000), ref: 000842E1
                                    • IsClipboardFormatAvailable.USER32(00000001), ref: 000842EE
                                    • GetClipboardData.USER32(00000001), ref: 000842F6
                                    • GlobalLock.KERNEL32(00000000), ref: 00084303
                                    • GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00084337
                                    • CloseClipboard.USER32 ref: 00084447
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                    • String ID:
                                    • API String ID: 3222323430-0
                                    • Opcode ID: dac74866bbc8771c89d82d37a2df07455edb4987ad50f61ae421424db163f301
                                    • Instruction ID: bec34607fa1eda467203652c6d456725fa85d502be98bcb46b0bcd224572ef58
                                    • Opcode Fuzzy Hash: dac74866bbc8771c89d82d37a2df07455edb4987ad50f61ae421424db163f301
                                    • Instruction Fuzzy Hash: 02517071208303ABE711FF60EC85FBE77A8BF84B00F50452AF596D61A2DB74D9448B62
                                    Function 0007C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • FindFirstFileW.KERNEL32(?,?), ref: 0007C9F8
                                    • FindClose.KERNEL32(00000000), ref: 0007CA4C
                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0007CA71
                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0007CA88
                                    • FileTimeToSystemTime.KERNEL32(?,?), ref: 0007CAAF
                                    • __swprintf.LIBCMT ref: 0007CAFB
                                    • __swprintf.LIBCMT ref: 0007CB3E
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                    • __swprintf.LIBCMT ref: 0007CB92
                                      • Part of subcall function 000338D8: __woutput_l.LIBCMT ref: 00033931
                                    • __swprintf.LIBCMT ref: 0007CBE0
                                      • Part of subcall function 000338D8: __flsbuf.LIBCMT ref: 00033953
                                      • Part of subcall function 000338D8: __flsbuf.LIBCMT ref: 0003396B
                                    • __swprintf.LIBCMT ref: 0007CC2F
                                    • __swprintf.LIBCMT ref: 0007CC7E
                                    • __swprintf.LIBCMT ref: 0007CCCD
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                    • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                    • API String ID: 3953360268-2428617273
                                    • Opcode ID: 6505223f2dfa311188d597f5bc8fb88f987707c7fdbab4c56603511220b207ea
                                    • Instruction ID: dbf1828db613b1038309e126a674b3274bbde6c75fb8bd011cdb7d6a768175a2
                                    • Opcode Fuzzy Hash: 6505223f2dfa311188d597f5bc8fb88f987707c7fdbab4c56603511220b207ea
                                    • Instruction Fuzzy Hash: FCA14CB2508304ABD710EB64CC96DEFB7ECBF94705F40492DB586C7192EA34DA49CB62
                                    Function 0007F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0007F221
                                    • _wcscmp.LIBCMT ref: 0007F236
                                    • _wcscmp.LIBCMT ref: 0007F24D
                                    • GetFileAttributesW.KERNEL32(?), ref: 0007F25F
                                    • SetFileAttributesW.KERNEL32(?,?), ref: 0007F279
                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0007F291
                                    • FindClose.KERNEL32(00000000), ref: 0007F29C
                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 0007F2B8
                                    • _wcscmp.LIBCMT ref: 0007F2DF
                                    • _wcscmp.LIBCMT ref: 0007F2F6
                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0007F308
                                    • SetCurrentDirectoryW.KERNEL32(000CA5A0), ref: 0007F326
                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0007F330
                                    • FindClose.KERNEL32(00000000), ref: 0007F33D
                                    • FindClose.KERNEL32(00000000), ref: 0007F34F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                    • String ID: *.*
                                    • API String ID: 1803514871-438819550
                                    • Opcode ID: 01b2ba2ff2fff54a84af45bd20aaa56a5b80df15e053ca06984c9ce388cabb93
                                    • Instruction ID: 21daeac53c3ecf9fddd550669da4e90dc8523785651925358188db68ab177e38
                                    • Opcode Fuzzy Hash: 01b2ba2ff2fff54a84af45bd20aaa56a5b80df15e053ca06984c9ce388cabb93
                                    • Instruction Fuzzy Hash: DE31A776A0021A6BDB60DBB4DC49AFE73ECAF09360F148176E918D3091DB38DB45CA54
                                    Function 00090AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00090BDE
                                    • RegCreateKeyExW.ADVAPI32(?,?,00000000,0009F910,00000000,?,00000000,?,?), ref: 00090C4C
                                    • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00090C94
                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00090D1D
                                    • RegCloseKey.ADVAPI32(?), ref: 0009103D
                                    • RegCloseKey.ADVAPI32(00000000), ref: 0009104A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Close$ConnectCreateRegistryValue
                                    • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                    • API String ID: 536824911-966354055
                                    • Opcode ID: 71d03b2a4a03c26f1f8207b540014f1b503542885e949879a0c27cd5f7011303
                                    • Instruction ID: 8b683ed191846f1723c8ebfd8a1598638a3d0466dffdf113bfef6c089f039f25
                                    • Opcode Fuzzy Hash: 71d03b2a4a03c26f1f8207b540014f1b503542885e949879a0c27cd5f7011303
                                    • Instruction Fuzzy Hash: 6C025C752046119FCB14EF18C895EAAB7E5FF88714F04885DF99A9B362CB31ED41CB81
                                    Function 0007F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0007F37E
                                    • _wcscmp.LIBCMT ref: 0007F393
                                    • _wcscmp.LIBCMT ref: 0007F3AA
                                      • Part of subcall function 000745C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 000745DC
                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0007F3D9
                                    • FindClose.KERNEL32(00000000), ref: 0007F3E4
                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 0007F400
                                    • _wcscmp.LIBCMT ref: 0007F427
                                    • _wcscmp.LIBCMT ref: 0007F43E
                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0007F450
                                    • SetCurrentDirectoryW.KERNEL32(000CA5A0), ref: 0007F46E
                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0007F478
                                    • FindClose.KERNEL32(00000000), ref: 0007F485
                                    • FindClose.KERNEL32(00000000), ref: 0007F497
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                    • String ID: *.*
                                    • API String ID: 1824444939-438819550
                                    • Opcode ID: ffcfb1826d0de7b55a0a9dc0f54f9fbce0a2ac472567c8ffdcfcaf964920c0ba
                                    • Instruction ID: 5884e013d3bcc9aae2f33601779e36246a40f5c94c18dcd07b0bc2f14688239a
                                    • Opcode Fuzzy Hash: ffcfb1826d0de7b55a0a9dc0f54f9fbce0a2ac472567c8ffdcfcaf964920c0ba
                                    • Instruction Fuzzy Hash: 0931D771A0121B6BDF20AB74DC89AFE77EC9F05364F148175E814D70A1DB38DE44CA68
                                    Function 000681F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0006874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00068766
                                      • Part of subcall function 0006874A: GetLastError.KERNEL32(?,0006822A,?,?,?), ref: 00068770
                                      • Part of subcall function 0006874A: GetProcessHeap.KERNEL32(00000008,?,?,0006822A,?,?,?), ref: 0006877F
                                      • Part of subcall function 0006874A: HeapAlloc.KERNEL32(00000000,?,0006822A,?,?,?), ref: 00068786
                                      • Part of subcall function 0006874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0006879D
                                      • Part of subcall function 000687E7: GetProcessHeap.KERNEL32(00000008,00068240,00000000,00000000,?,00068240,?), ref: 000687F3
                                      • Part of subcall function 000687E7: HeapAlloc.KERNEL32(00000000,?,00068240,?), ref: 000687FA
                                      • Part of subcall function 000687E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00068240,?), ref: 0006880B
                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0006825B
                                    • _memset.LIBCMT ref: 00068270
                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0006828F
                                    • GetLengthSid.ADVAPI32(?), ref: 000682A0
                                    • GetAce.ADVAPI32(?,00000000,?), ref: 000682DD
                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000682F9
                                    • GetLengthSid.ADVAPI32(?), ref: 00068316
                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00068325
                                    • HeapAlloc.KERNEL32(00000000), ref: 0006832C
                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 0006834D
                                    • CopySid.ADVAPI32(00000000), ref: 00068354
                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00068385
                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000683AB
                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 000683BF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                    • String ID:
                                    • API String ID: 3996160137-0
                                    • Opcode ID: e3eb4435708eefa1cdc71b8d4e02b251f7e9b32161539ee303329e3cf457242e
                                    • Instruction ID: 0346f2bf4e4351491e421a730a42138648ca29e79d8bf7009a761e80d866cf5b
                                    • Opcode Fuzzy Hash: e3eb4435708eefa1cdc71b8d4e02b251f7e9b32161539ee303329e3cf457242e
                                    • Instruction Fuzzy Hash: 2E614D7190021AAFDF00DF94DC45AEEBBBAFF44700F14826AF915E7291DB359A15CB60
                                    Function 00026843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
                                    • API String ID: 0-4052911093
                                    • Opcode ID: 62906beb0c206a358636f24f3002ec051133ea2a29f972f45871af1ded9a3a51
                                    • Instruction ID: 9883e3ff65b0684433215b27688245fcd59db93e92f6f2fc466ea6f2675de728
                                    • Opcode Fuzzy Hash: 62906beb0c206a358636f24f3002ec051133ea2a29f972f45871af1ded9a3a51
                                    • Instruction Fuzzy Hash: CA726175E002299BDB64CF58D8807EDB7F6FF48310F14816AE849EB291DB759E81CB90
                                    Function 00090665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000910A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00090038,?,?), ref: 000910BC
                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00090737
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 000907D6
                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0009086E
                                    • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00090AAD
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00090ABA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                    • String ID:
                                    • API String ID: 1240663315-0
                                    • Opcode ID: 60b50648325a9e11f6f27719c0e2dc2b15b7a92ecc0a5cc218e68d5fe40fcc37
                                    • Instruction ID: b7509bb55b39971a75af330ae4724b4c12999d3ea072ee29a27c66cef63732b0
                                    • Opcode Fuzzy Hash: 60b50648325a9e11f6f27719c0e2dc2b15b7a92ecc0a5cc218e68d5fe40fcc37
                                    • Instruction Fuzzy Hash: 6EE16D31604211AFCB14DF28C895EAABBE9FF89714F04846DF45ADB262DA30ED41DB52
                                    Function 00070219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetKeyboardState.USER32(?), ref: 00070241
                                    • GetAsyncKeyState.USER32(000000A0), ref: 000702C2
                                    • GetKeyState.USER32(000000A0), ref: 000702DD
                                    • GetAsyncKeyState.USER32(000000A1), ref: 000702F7
                                    • GetKeyState.USER32(000000A1), ref: 0007030C
                                    • GetAsyncKeyState.USER32(00000011), ref: 00070324
                                    • GetKeyState.USER32(00000011), ref: 00070336
                                    • GetAsyncKeyState.USER32(00000012), ref: 0007034E
                                    • GetKeyState.USER32(00000012), ref: 00070360
                                    • GetAsyncKeyState.USER32(0000005B), ref: 00070378
                                    • GetKeyState.USER32(0000005B), ref: 0007038A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: State$Async$Keyboard
                                    • String ID:
                                    • API String ID: 541375521-0
                                    • Opcode ID: 692320a8d3fdbb0ac2e005b3dbd8b517c3e56bc5c54ac1590166620e17775b99
                                    • Instruction ID: 7c3f1e41d7270ccb6a72f37cc8914b1fde81a1ea13abe10e896682e208ef8f66
                                    • Opcode Fuzzy Hash: 692320a8d3fdbb0ac2e005b3dbd8b517c3e56bc5c54ac1590166620e17775b99
                                    • Instruction Fuzzy Hash: A241A974D047CAEEFFB14A6484083B5BEE47B11340F08C25ED6CD465C2E79C5AC4879A
                                    Function 00084458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                    • String ID:
                                    • API String ID: 1737998785-0
                                    • Opcode ID: 852c3d159cc7e1593a94d7d5216f2e94d2af1f5cb173b447a8b3ae5ea9380e56
                                    • Instruction ID: 5db3145444aa89b9fccb360c6e824b28a242e246105eca335836f188b1935ddc
                                    • Opcode Fuzzy Hash: 852c3d159cc7e1593a94d7d5216f2e94d2af1f5cb173b447a8b3ae5ea9380e56
                                    • Instruction Fuzzy Hash: A02171352016129FEB10AF64EC49BBD77A9FF04715F10802AF986DB2A2DB79AD00CB55
                                    Function 00073A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000148AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000148A1,?,?,000137C0,?), ref: 000148CE
                                      • Part of subcall function 00074CD3: GetFileAttributesW.KERNEL32(?,00073947), ref: 00074CD4
                                    • FindFirstFileW.KERNEL32(?,?), ref: 00073ADF
                                    • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00073B87
                                    • MoveFileW.KERNEL32(?,?), ref: 00073B9A
                                    • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00073BB7
                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00073BD9
                                    • FindClose.KERNEL32(00000000,?,?,?,?), ref: 00073BF5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                    • String ID: \*.*
                                    • API String ID: 4002782344-1173974218
                                    • Opcode ID: c951fed8f49e07859806a7f89844ad846bebce57f680945714d5a112b9a86c73
                                    • Instruction ID: f69f7d4da6d8400480f939e9c7b8b90030551f96d90bd62466fce41e06723dcf
                                    • Opcode Fuzzy Hash: c951fed8f49e07859806a7f89844ad846bebce57f680945714d5a112b9a86c73
                                    • Instruction Fuzzy Hash: BF51A131C0514DAADF15EBA0CD929FDB7B9AF14300F6481A9E40A77092EF346F49DBA1
                                    Function 0007F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                    • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0007F6AB
                                    • Sleep.KERNEL32(0000000A), ref: 0007F6DB
                                    • _wcscmp.LIBCMT ref: 0007F6EF
                                    • _wcscmp.LIBCMT ref: 0007F70A
                                    • FindNextFileW.KERNEL32(?,?), ref: 0007F7A8
                                    • FindClose.KERNEL32(00000000), ref: 0007F7BE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
                                    • String ID: *.*
                                    • API String ID: 713712311-438819550
                                    • Opcode ID: bdc186eb75b01c54c8a80a4042fcd76952c75a4ecb2bd8e451d7745c85c98fa3
                                    • Instruction ID: 5aacf1f3c93e83b2ab9c4b24f2f29261b76d0917f9239a05784a87c98a65f821
                                    • Opcode Fuzzy Hash: bdc186eb75b01c54c8a80a4042fcd76952c75a4ecb2bd8e451d7745c85c98fa3
                                    • Instruction Fuzzy Hash: 1041AE71D0420A9BCF55DF64CC85AFEBBF8FF05310F148166E818A6191DB349E84CBA4
                                    Function 00024140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                    • API String ID: 0-1546025612
                                    • Opcode ID: bbf5b99311ec2d7eb88fea1de08b3ba1d0bff5285ae8ea3dfc284df6a98b3e53
                                    • Instruction ID: 960c8abf6448edafc18e0f90107ca638183b9d4cd8fdfa705f01db574f1d2137
                                    • Opcode Fuzzy Hash: bbf5b99311ec2d7eb88fea1de08b3ba1d0bff5285ae8ea3dfc284df6a98b3e53
                                    • Instruction Fuzzy Hash: 79A2AE70E0422ACBDF64CF58E9847AEB7F1BB44305F2481AADC5AA7280D7709E85DB51
                                    Function 000258C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memmove
                                    • String ID:
                                    • API String ID: 4104443479-0
                                    • Opcode ID: 40a86a92c28352efd37c0ef1aab096829586d53cb01b8a2735a369c87bdf28f1
                                    • Instruction ID: e0a37bf0ae2d3e34b5d418b74dcdf3dc684e7080a91751e9b9aa8d377c6d85f0
                                    • Opcode Fuzzy Hash: 40a86a92c28352efd37c0ef1aab096829586d53cb01b8a2735a369c87bdf28f1
                                    • Instruction Fuzzy Hash: C6129C70A00619EFDF14CFA4D981AEEB7F6FF48300F108569E406A7252EB36AE51CB55
                                    Function 0007545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00068CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00068D0D
                                      • Part of subcall function 00068CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00068D3A
                                      • Part of subcall function 00068CC3: GetLastError.KERNEL32 ref: 00068D47
                                    • ExitWindowsEx.USER32(?,00000000), ref: 0007549B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                    • String ID: $@$SeShutdownPrivilege
                                    • API String ID: 2234035333-194228
                                    • Opcode ID: 104ed7ffaa7e39fd6ded2a53845b4bc09160c6dd17d3a2f7635faaa6b28d594b
                                    • Instruction ID: f7a2fce566e5d0026ccc3d852276b50e5e1759c8188aa9b7ce21afb46231b5d5
                                    • Opcode Fuzzy Hash: 104ed7ffaa7e39fd6ded2a53845b4bc09160c6dd17d3a2f7635faaa6b28d594b
                                    • Instruction Fuzzy Hash: 36012431F95B066AF77853749C4ABFA72A8AB00357F248121FD0ED20C3DADC5C8082A8
                                    Function 00086596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 000865EF
                                    • WSAGetLastError.WSOCK32(00000000), ref: 000865FE
                                    • bind.WSOCK32(00000000,?,00000010), ref: 0008661A
                                    • listen.WSOCK32(00000000,00000005), ref: 00086629
                                    • WSAGetLastError.WSOCK32(00000000), ref: 00086643
                                    • closesocket.WSOCK32(00000000,00000000), ref: 00086657
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorLast$bindclosesocketlistensocket
                                    • String ID:
                                    • API String ID: 1279440585-0
                                    • Opcode ID: 48cd142c16289e62fafc59179b5e2607874b9a8d0f07580caba006b3884adec4
                                    • Instruction ID: 1fe5b1b2bfee99e2ce44585404ac17c2b8516a205f2aca902188e4f724f97454
                                    • Opcode Fuzzy Hash: 48cd142c16289e62fafc59179b5e2607874b9a8d0f07580caba006b3884adec4
                                    • Instruction Fuzzy Hash: 00219E306002019FDB10AF64C849ABEB7E9FF44320F15815AE996E73D2DB74AD45CB51
                                    Function 00025680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00030FF6: std::exception::exception.LIBCMT ref: 0003102C
                                      • Part of subcall function 00030FF6: __CxxThrowException@8.LIBCMT ref: 00031041
                                    • _memmove.LIBCMT ref: 0006062F
                                    • _memmove.LIBCMT ref: 00060744
                                    • _memmove.LIBCMT ref: 000607EB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memmove$Exception@8Throwstd::exception::exception
                                    • String ID:
                                    • API String ID: 1300846289-0
                                    • Opcode ID: 6494f4b940257df41467a546554ffef21800ed9c709324df63aa64dcfd16f2a7
                                    • Instruction ID: 9f1e6189039aef5374ea3f012800aeea221875868deef95bceef3460f61a88d9
                                    • Opcode Fuzzy Hash: 6494f4b940257df41467a546554ffef21800ed9c709324df63aa64dcfd16f2a7
                                    • Instruction Fuzzy Hash: 7D0280B0E00209DFDF14DF64D991AAEBBB6EF44300F148069E806EB256EB35DA51CB95
                                    Function 00011287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • DefDlgProcW.USER32(?,?,?,?,?), ref: 000119FA
                                    • GetSysColor.USER32(0000000F), ref: 00011A4E
                                    • SetBkColor.GDI32(?,00000000), ref: 00011A61
                                      • Part of subcall function 00011290: DefDlgProcW.USER32(?,00000020,?), ref: 000112D8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ColorProc$LongWindow
                                    • String ID:
                                    • API String ID: 3744519093-0
                                    • Opcode ID: 59c3e2533a3f83ce5aee9f91ced221ddf39febba17471ccdb3806efd2a05f602
                                    • Instruction ID: d36756ca092c19ea64a5cbe68cdf52caac8c967f3dd90ef45b6c28a5b3cab054
                                    • Opcode Fuzzy Hash: 59c3e2533a3f83ce5aee9f91ced221ddf39febba17471ccdb3806efd2a05f602
                                    • Instruction Fuzzy Hash: 17A138B1106545BAEA3CAB289C84DFF3ADDDF49341B54012AF602D6192CF25DD81A2F7
                                    Function 00086A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000880A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000880CB
                                    • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00086AB1
                                    • WSAGetLastError.WSOCK32(00000000), ref: 00086ADA
                                    • bind.WSOCK32(00000000,?,00000010), ref: 00086B13
                                    • WSAGetLastError.WSOCK32(00000000), ref: 00086B20
                                    • closesocket.WSOCK32(00000000,00000000), ref: 00086B34
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                    • String ID:
                                    • API String ID: 99427753-0
                                    • Opcode ID: fd775d817dd9e3c77fbe2745ab6da1215612084eeb7123cc2261cbc339242d43
                                    • Instruction ID: d425a66c33bdbb42140d30438fcdce7b05c0ae62caaf82ff378e9e1520085502
                                    • Opcode Fuzzy Hash: fd775d817dd9e3c77fbe2745ab6da1215612084eeb7123cc2261cbc339242d43
                                    • Instruction Fuzzy Hash: 5641B175A00210AFEB14BF649C96FFE77E9AF04714F448059F95AAB3C3CA749D408B92
                                    Function 000955FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                    • String ID:
                                    • API String ID: 292994002-0
                                    • Opcode ID: 5d3b4d96c5db28a92d7c55daf3634ebf071e8ce59cd26e5d43da78ecfaa63a63
                                    • Instruction ID: 70cd54b36fe6d2472945f99deea13aa1fe5ed3f9932ba74650e9f080f0f42272
                                    • Opcode Fuzzy Hash: 5d3b4d96c5db28a92d7c55daf3634ebf071e8ce59cd26e5d43da78ecfaa63a63
                                    • Instruction Fuzzy Hash: 4F11BF32300A116FEB221F27DC54AAFBBD9FF44722B854029F906D7251CB749942DBA5
                                    Function 0007C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CoInitialize.OLE32(00000000), ref: 0007C69D
                                    • CoCreateInstance.OLE32(000A2D6C,00000000,00000001,000A2BDC,?), ref: 0007C6B5
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                    • CoUninitialize.OLE32 ref: 0007C922
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateInitializeInstanceUninitialize_memmove
                                    • String ID: .lnk
                                    • API String ID: 2683427295-24824748
                                    • Opcode ID: 47b1641cda885f6018ad9c577faa04147ff496459971dc1fedeffe568cfe7b96
                                    • Instruction ID: 1053067321aa4c18c33bd70477d8cc4fee35b3557eff0938779cbfc069a01f8c
                                    • Opcode Fuzzy Hash: 47b1641cda885f6018ad9c577faa04147ff496459971dc1fedeffe568cfe7b96
                                    • Instruction Fuzzy Hash: FAA13B71108205AFD700EF54CC91EEBB7E8EF88304F44492CF1969B1A2DB71EA49CB92
                                    Function 0008C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,00051D88,?), ref: 0008C312
                                    • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0008C324
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                    • API String ID: 2574300362-1816364905
                                    • Opcode ID: 4525d7e078d98bc28947fe15f77c135c1234caafd4d03ab36f41b8fc07a0d396
                                    • Instruction ID: 4d81771472f7f70674b85f87826b6530e3b60bf81cf5ff118ae83fa38a8e8797
                                    • Opcode Fuzzy Hash: 4525d7e078d98bc28947fe15f77c135c1234caafd4d03ab36f41b8fc07a0d396
                                    • Instruction Fuzzy Hash: 02E0ECB4600713CFEB605F29D814E5A76E4FB09755B90C43AE996D6260E7B4D881CBA0
                                    Function 00023190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __itow__swprintf
                                    • String ID:
                                    • API String ID: 674341424-0
                                    • Opcode ID: d9d64eca971a621ab72ae4f434848abc121222adafbbd30558dc1a3420c230c1
                                    • Instruction ID: 7356e335df0ee438e4e879dd803097a7446b913431d8cb0b3f45824b33dab1c5
                                    • Opcode Fuzzy Hash: d9d64eca971a621ab72ae4f434848abc121222adafbbd30558dc1a3420c230c1
                                    • Instruction Fuzzy Hash: 6B22AC716083219FC724DF14D891BAFB7E5AF84304F10492DF89A97292DB75EA48CB92
                                    Function 0008F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 0008F151
                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0008F15F
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                    • Process32NextW.KERNEL32(00000000,?), ref: 0008F21F
                                    • CloseHandle.KERNEL32(00000000,?,?,?), ref: 0008F22E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                    • String ID:
                                    • API String ID: 2576544623-0
                                    • Opcode ID: 1de0ba5f86bdbb7768476c5c0ce21de0ec967facb545678854269a47dbf1c990
                                    • Instruction ID: cf85d762f0c1ff42597b8c1c93f2ff9f46dd461e7c281ecd9963271fcf15ffd0
                                    • Opcode Fuzzy Hash: 1de0ba5f86bdbb7768476c5c0ce21de0ec967facb545678854269a47dbf1c990
                                    • Instruction Fuzzy Hash: 10516F715083119FD310EF24DC85EABBBE8FF94710F54482DF595972A2EB70AA48CB92
                                    Function 0006EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrlenW.KERNEL32(?,?,?,00000000), ref: 0006EB19
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: lstrlen
                                    • String ID: ($|
                                    • API String ID: 1659193697-1631851259
                                    • Opcode ID: d2617d584d2fa7602f237b631b521d5a472f566dac751673d898edacc511d45f
                                    • Instruction ID: c36b5423295480cc8f17b80dac1c78ba04039890dc7263dd70e73f46e7b6a577
                                    • Opcode Fuzzy Hash: d2617d584d2fa7602f237b631b521d5a472f566dac751673d898edacc511d45f
                                    • Instruction Fuzzy Hash: B1321675A007059FDB28CF19D481A6AB7F1FF48320B15C56EE89ADB3A2D770E941CB44
                                    Function 000825E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 000826D5
                                    • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 0008270C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Internet$AvailableDataFileQueryRead
                                    • String ID:
                                    • API String ID: 599397726-0
                                    • Opcode ID: 87f63f3c70072fc3df6ccd556b0469bf0a2a39be06f235b917368bb71ef5bdda
                                    • Instruction ID: 1a93968de94f7e7027669b8604321f7ad3218460e66cf62e858dc55ef22778ad
                                    • Opcode Fuzzy Hash: 87f63f3c70072fc3df6ccd556b0469bf0a2a39be06f235b917368bb71ef5bdda
                                    • Instruction Fuzzy Hash: 3B410371604609BFEB20EE95CC85EBFB7FCFB40724F10406AF681A6141EA71AE519760
                                    Function 0007B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetErrorMode.KERNEL32(00000001), ref: 0007B5AE
                                    • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0007B608
                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0007B655
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorMode$DiskFreeSpace
                                    • String ID:
                                    • API String ID: 1682464887-0
                                    • Opcode ID: 13eebbcc22354f4a5379513adac4d4789c4b19e5f979d69e58772cdf8bba5805
                                    • Instruction ID: f9f025d656ef8e06367d706851a322fff11ae8a6f5a7ac650a4f8db431e3dd79
                                    • Opcode Fuzzy Hash: 13eebbcc22354f4a5379513adac4d4789c4b19e5f979d69e58772cdf8bba5805
                                    • Instruction Fuzzy Hash: 00215C35A00118EFDB00EFA5D880AEDBBB8FF48310F1480AAE945EB352DB35A955CB55
                                    Function 00068CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00030FF6: std::exception::exception.LIBCMT ref: 0003102C
                                      • Part of subcall function 00030FF6: __CxxThrowException@8.LIBCMT ref: 00031041
                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00068D0D
                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00068D3A
                                    • GetLastError.KERNEL32 ref: 00068D47
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                    • String ID:
                                    • API String ID: 1922334811-0
                                    • Opcode ID: 86fa253802ab3f794e74242f022290ea4f7fd9a9558b2cb0e1ce45a7359df3cd
                                    • Instruction ID: 71352b5d277b65458af2f2d59c1c4a30136c47a2419067358d70538d41d9248d
                                    • Opcode Fuzzy Hash: 86fa253802ab3f794e74242f022290ea4f7fd9a9558b2cb0e1ce45a7359df3cd
                                    • Instruction Fuzzy Hash: 5F118CB1414209AFE728AF64DC85DBBB7FDFB44710B20C62EF45693651EB70AD408B60
                                    Function 00074021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0007404B
                                    • DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00074088
                                    • CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00074091
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CloseControlCreateDeviceFileHandle
                                    • String ID:
                                    • API String ID: 33631002-0
                                    • Opcode ID: 00f8f0e19850b809b0a3d3e0e8ffe9ddb42928fb4389c5678b15c278c142e66c
                                    • Instruction ID: ed3b1dcc25cd497792f92a209a34acc83dedc815d89c5610177f12c02320ae79
                                    • Opcode Fuzzy Hash: 00f8f0e19850b809b0a3d3e0e8ffe9ddb42928fb4389c5678b15c278c142e66c
                                    • Instruction Fuzzy Hash: 611173B1D04225BEE7109BE8DC44FBFBBBCEB08710F104556BA08E7191D378590447E5
                                    Function 00074C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00074C2C
                                    • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00074C43
                                    • FreeSid.ADVAPI32(?), ref: 00074C53
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AllocateCheckFreeInitializeMembershipToken
                                    • String ID:
                                    • API String ID: 3429775523-0
                                    • Opcode ID: 544e4afaaea0802896c40654eda74b2803f640cd1979e647f595e7a6b1a827b5
                                    • Instruction ID: 1c9a57d60d85787da8213e93a5816527e261a020f3cd99cc46b2c7404c7e1b0b
                                    • Opcode Fuzzy Hash: 544e4afaaea0802896c40654eda74b2803f640cd1979e647f595e7a6b1a827b5
                                    • Instruction Fuzzy Hash: D4F03775A11209BBEB04DFE09C89ABEBBBCFB08201F1044A9A901E2181E7746A148B50
                                    Function 00078B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                    Download Yara Rule
                                    APIs
                                    • __time64.LIBCMT ref: 00078B25
                                      • Part of subcall function 0003543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,000791F8,00000000,?,?,?,?,000793A9,00000000,?), ref: 00035443
                                      • Part of subcall function 0003543A: __aulldiv.LIBCMT ref: 00035463
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Time$FileSystem__aulldiv__time64
                                    • String ID: 0u
                                    • API String ID: 2893107130-4157853068
                                    • Opcode ID: 1b72a8e1168029e64a540465be0f2a4fe37df77899f79b8a9b54336cd51472a7
                                    • Instruction ID: 5c3b385e671eb96accb7e340e19bbc3adf6308193e7cc8203bc78ef84dd59324
                                    • Opcode Fuzzy Hash: 1b72a8e1168029e64a540465be0f2a4fe37df77899f79b8a9b54336cd51472a7
                                    • Instruction Fuzzy Hash: 8921E4726356108BD329CF25D841A52B3E1EFA4321B68CE6DD4F9CB2D0DA78B905CB94
                                    Function 0001E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: f0c853150554b13ec929a44c9f554613a3c3e35840ec21c7fe3cd2662ae80d3f
                                    • Instruction ID: ce92dbb19e73d6d1de94719fe40459d7f3a8ac6b405fe20fd6c2e5ba63ae869a
                                    • Opcode Fuzzy Hash: f0c853150554b13ec929a44c9f554613a3c3e35840ec21c7fe3cd2662ae80d3f
                                    • Instruction Fuzzy Hash: A6228A74A00256DFDB24DF54C494AEEBBF1FF08300F148569EC56AB382E774AA85CB91
                                    Function 0007C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • FindFirstFileW.KERNEL32(?,?), ref: 0007C966
                                    • FindClose.KERNEL32(00000000), ref: 0007C996
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Find$CloseFileFirst
                                    • String ID:
                                    • API String ID: 2295610775-0
                                    • Opcode ID: e0f8a7c0fb7aa3a7cb8c3196611c2dd87055f5badcd92d0fd12620a678c0f9bb
                                    • Instruction ID: 57dba571f02ad5fd6138dc1664a77d278a352e2873892cb460289b7a087662f4
                                    • Opcode Fuzzy Hash: e0f8a7c0fb7aa3a7cb8c3196611c2dd87055f5badcd92d0fd12620a678c0f9bb
                                    • Instruction Fuzzy Hash: 231161726106009FD710EF29D859A6AF7E9FF84324F04C51EF9A9D7291DB34AD04CB81
                                    Function 0007A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0008977D,?,0009FB84,?), ref: 0007A302
                                    • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0008977D,?,0009FB84,?), ref: 0007A314
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorFormatLastMessage
                                    • String ID:
                                    • API String ID: 3479602957-0
                                    • Opcode ID: 7ac41957dec52047693d6eb4d14cbbab1ebf69a2045371971a59f8f6636633b2
                                    • Instruction ID: 54a1ebbf0930d2d5c7cacb1261f0e8975c02e4c9c2297bf25145cde4db8d74d1
                                    • Opcode Fuzzy Hash: 7ac41957dec52047693d6eb4d14cbbab1ebf69a2045371971a59f8f6636633b2
                                    • Instruction Fuzzy Hash: F3F05E3564422DABEB209FA48C48FEA776DBF09761F008266B909D6191D6349A40CBA1
                                    Function 00068713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                    Download Yara Rule
                                    APIs
                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00068851), ref: 00068728
                                    • CloseHandle.KERNEL32(?,?,00068851), ref: 0006873A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AdjustCloseHandlePrivilegesToken
                                    • String ID:
                                    • API String ID: 81990902-0
                                    • Opcode ID: 1abc3c160c680589fb27a76ceeafddc5e8031ef03671e5a5ffd3f88f11ab6715
                                    • Instruction ID: 4ffcad46ad3738891c7af0cdddeb6244457f6a1c6302d2825a6f08aca5565e08
                                    • Opcode Fuzzy Hash: 1abc3c160c680589fb27a76ceeafddc5e8031ef03671e5a5ffd3f88f11ab6715
                                    • Instruction Fuzzy Hash: D8E0B676014611EFE7262B60EC09DB77BEDFB04350B24892AB496C0471DBA6ACA0DB10
                                    Function 0003A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00038F97,?,?,?,00000001), ref: 0003A39A
                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0003A3A3
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ExceptionFilterUnhandled
                                    • String ID:
                                    • API String ID: 3192549508-0
                                    • Opcode ID: 3fdf307a33189231eb26fdd59bed1c6b758cb9412652bc16f047e60e88381b3e
                                    • Instruction ID: 75b3e4001b922e5c1607e4acdb52673a91a7856ee1554f7384c21f679460f11b
                                    • Opcode Fuzzy Hash: 3fdf307a33189231eb26fdd59bed1c6b758cb9412652bc16f047e60e88381b3e
                                    • Instruction Fuzzy Hash: 46B09B31054209E7D6001B91EC097543F58F744752F408021F50DC4060C7E955904651
                                    Function 0003F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 73388281d72759e762e283892fe49496baf071407c931507c418bf34fe7dca66
                                    • Instruction ID: f5e81157177ac3c07c23ba0af7d6f40d7ead18bbb92188172793225a997ee5b0
                                    • Opcode Fuzzy Hash: 73388281d72759e762e283892fe49496baf071407c931507c418bf34fe7dca66
                                    • Instruction Fuzzy Hash: 4432F366D69F024DE7639634DD32336A28DAFB73C4F15D737E819B5AA6EB28C4834100
                                    Function 0004267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5711d147cf57b8ec3fafe491d190e4d2120bfeaaba3a1421b35e68c3b6731cb9
                                    • Instruction ID: b13395b8109c1ea8ee12f7fdf420b9d2b530d52ee00e27db447c425ceec960ee
                                    • Opcode Fuzzy Hash: 5711d147cf57b8ec3fafe491d190e4d2120bfeaaba3a1421b35e68c3b6731cb9
                                    • Instruction Fuzzy Hash: 59B11221E2AF414DE76396398831336BB4CAFBB2C5F91D71BFC2674D62EB2585838141
                                    Function 000841FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                    Download Yara Rule
                                    APIs
                                    • BlockInput.USER32(00000001), ref: 00084218
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BlockInput
                                    • String ID:
                                    • API String ID: 3456056419-0
                                    • Opcode ID: 27371704d810aa7fed2342b798b05d65e56da5ac1631359222bac8abdbeea043
                                    • Instruction ID: ebcd38b8350fd8d142ef29f5907c380601fd0530151dd434f764dc8d362c8956
                                    • Opcode Fuzzy Hash: 27371704d810aa7fed2342b798b05d65e56da5ac1631359222bac8abdbeea043
                                    • Instruction Fuzzy Hash: 2EE04F312442159FD710EF59D844ADAF7E8BF94760F008026FC89C7352DA70F8408BE1
                                    Function 00074EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                    Download Yara Rule
                                    APIs
                                    • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00074EEC
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: mouse_event
                                    • String ID:
                                    • API String ID: 2434400541-0
                                    • Opcode ID: af05e0a72ce23ac915bece5766cad312afb61a5bba676a5645cec4fea1f8d8b3
                                    • Instruction ID: b850aef396b166258eba744d2d4d5194a392d1bab14d7a1c8f4be8fd253723a8
                                    • Opcode Fuzzy Hash: af05e0a72ce23ac915bece5766cad312afb61a5bba676a5645cec4fea1f8d8b3
                                    • Instruction Fuzzy Hash: ECD05E98EA061979FCA84B209C5FF7B1148F3007A1FD0C14AB10AC90C2DAEC6C505538
                                    Function 00068C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                    Download Yara Rule
                                    APIs
                                    • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,000688D1), ref: 00068CB3
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: LogonUser
                                    • String ID:
                                    • API String ID: 1244722697-0
                                    • Opcode ID: c833bc23da8a146582ceb225ed9477640fbc72c5bd94bdfba64a84e0a324d367
                                    • Instruction ID: 3fb2c8524c4cdd55ee695c80f5374fb4603ae23533d7bb018b68aab137c2e3d9
                                    • Opcode Fuzzy Hash: c833bc23da8a146582ceb225ed9477640fbc72c5bd94bdfba64a84e0a324d367
                                    • Instruction Fuzzy Hash: 39D05E3226450EABEF018EA4DC01EBE3B69EB04B01F408111FE15C50A1C775D835AF60
                                    Function 00052230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetUserNameW.ADVAPI32(?,?), ref: 00052242
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: NameUser
                                    • String ID:
                                    • API String ID: 2645101109-0
                                    • Opcode ID: 39f9eb5711f6069d30010db5444ee2930778699e78df76093482aaa3d3b25cba
                                    • Instruction ID: 488fe4504bf18e39ffa6c51cc0f83bd15ba292808a664b14525640752e062681
                                    • Opcode Fuzzy Hash: 39f9eb5711f6069d30010db5444ee2930778699e78df76093482aaa3d3b25cba
                                    • Instruction Fuzzy Hash: 00C04CF1800109DBEB15DB90D988DFF77BCBB04305F104056A501F2100D7749B448A71
                                    Function 0003A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetUnhandledExceptionFilter.KERNEL32(?), ref: 0003A36A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ExceptionFilterUnhandled
                                    • String ID:
                                    • API String ID: 3192549508-0
                                    • Opcode ID: 92f3dd0ff590b49467668d00df22d23afa5eb422a106a059818b3bf568094d3b
                                    • Instruction ID: 87d18e3223004e9cd118957b0b1659dd14a150391811e90ee61bbf04a5a9bf81
                                    • Opcode Fuzzy Hash: 92f3dd0ff590b49467668d00df22d23afa5eb422a106a059818b3bf568094d3b
                                    • Instruction Fuzzy Hash: AFA0123000010DE78A001B51EC044547F5CE7001907008021F40C8002187B655504580
                                    Function 00028A0E Relevance: .6, Instructions: 608COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5b15fb7c3545b698081311baecf300472aea98259c94d2fd219dcc93c611bba0
                                    • Instruction ID: 19538eb28f2420efb6ddd8cb0748c6700a834b795793dee03bce2d8387f4998c
                                    • Opcode Fuzzy Hash: 5b15fb7c3545b698081311baecf300472aea98259c94d2fd219dcc93c611bba0
                                    • Instruction Fuzzy Hash: D7221934A06626CBDF788B18E89467D77E2EF01305F78C46BD84A9B691DF349D81CB60
                                    Function 00032405 Relevance: .3, Instructions: 345COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                    • Instruction ID: 78ed5f0570e09a39bad297e29027f23c0cb82445845c6968d14c05a3739ce99f
                                    • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                    • Instruction Fuzzy Hash: D7C1933220519309DFAF8639D43407EBAE95FA27B1B1A076DE4B3CB5D4EF20D564D620
                                    Function 0003283A Relevance: .3, Instructions: 341COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                    • Instruction ID: 71ecf2d86953a7945553f5a3d4f3899febb312eb86c45d0bcac6ea574be1abea
                                    • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                    • Instruction Fuzzy Hash: D8C1C4322051930EDFAF463A943417EFBE55BA27B171A076DE4B2DB5C4EF20D524E620
                                    Function 00031BB8 Relevance: .3, Instructions: 323COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                    • Instruction ID: 4896ff5bc5f9ca023ac49266483e111f339ab451a8c2cfbd39529e9b14d29028
                                    • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                    • Instruction Fuzzy Hash: F0C192322051930DDFAF463A94340BEBAE95FA67B171A1B6DE4B3CB5C4EF20D524D620
                                    Function 00087B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • DeleteObject.GDI32(00000000), ref: 00087B70
                                    • DeleteObject.GDI32(00000000), ref: 00087B82
                                    • DestroyWindow.USER32 ref: 00087B90
                                    • GetDesktopWindow.USER32 ref: 00087BAA
                                    • GetWindowRect.USER32(00000000), ref: 00087BB1
                                    • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00087CF2
                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00087D02
                                    • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087D4A
                                    • GetClientRect.USER32(00000000,?), ref: 00087D56
                                    • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00087D90
                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087DB2
                                    • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087DC5
                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087DD0
                                    • GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087DD9
                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087DE8
                                    • GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087DF1
                                    • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087DF8
                                    • GlobalFree.KERNEL32(00000000), ref: 00087E03
                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087E15
                                    • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,000A2CAC,00000000), ref: 00087E2B
                                    • GlobalFree.KERNEL32(00000000), ref: 00087E3B
                                    • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00087E61
                                    • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00087E80
                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00087EA2
                                    • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0008808F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                    • String ID: $AutoIt v3$DISPLAY$static
                                    • API String ID: 2211948467-2373415609
                                    • Opcode ID: 2e741beda8b376b818ff97d7a573c146cce1204347326733112226603c88161d
                                    • Instruction ID: ba34c8f15b2b103dc408480247d22d5bb961b32a3b5a215aedd1e4fe19bb0196
                                    • Opcode Fuzzy Hash: 2e741beda8b376b818ff97d7a573c146cce1204347326733112226603c88161d
                                    • Instruction Fuzzy Hash: DD026C71900215AFDB14DFA4CC89EAE7BB9FB48314F148169F959EB2A1CB74ED40CB60
                                    Function 000937F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CharUpperBuffW.USER32(?,?,0009F910), ref: 000938AF
                                    • IsWindowVisible.USER32(?), ref: 000938D3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharUpperVisibleWindow
                                    • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                    • API String ID: 4105515805-45149045
                                    • Opcode ID: 1aae74e35232d7142c3b775e33d2ddae27a0830b7fc2d3b35d2245c85e2789a7
                                    • Instruction ID: f776aead11e5f28714d88c9b93f5dcd873778b2e0d32c5fbdf2284a4a2d59b2e
                                    • Opcode Fuzzy Hash: 1aae74e35232d7142c3b775e33d2ddae27a0830b7fc2d3b35d2245c85e2789a7
                                    • Instruction Fuzzy Hash: 8DD100702047059BCF24EF14C465BAEB7EAAF54354F14485CB8865B2A3CB35EE4ADF82
                                    Function 0009A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetTextColor.GDI32(?,00000000), ref: 0009A89F
                                    • GetSysColorBrush.USER32(0000000F), ref: 0009A8D0
                                    • GetSysColor.USER32(0000000F), ref: 0009A8DC
                                    • SetBkColor.GDI32(?,000000FF), ref: 0009A8F6
                                    • SelectObject.GDI32(?,?), ref: 0009A905
                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0009A930
                                    • GetSysColor.USER32(00000010), ref: 0009A938
                                    • CreateSolidBrush.GDI32(00000000), ref: 0009A93F
                                    • FrameRect.USER32(?,?,00000000), ref: 0009A94E
                                    • DeleteObject.GDI32(00000000), ref: 0009A955
                                    • InflateRect.USER32(?,000000FE,000000FE), ref: 0009A9A0
                                    • FillRect.USER32(?,?,?), ref: 0009A9D2
                                    • GetWindowLongW.USER32(?,000000F0), ref: 0009A9FD
                                      • Part of subcall function 0009AB60: GetSysColor.USER32(00000012), ref: 0009AB99
                                      • Part of subcall function 0009AB60: SetTextColor.GDI32(?,?), ref: 0009AB9D
                                      • Part of subcall function 0009AB60: GetSysColorBrush.USER32(0000000F), ref: 0009ABB3
                                      • Part of subcall function 0009AB60: GetSysColor.USER32(0000000F), ref: 0009ABBE
                                      • Part of subcall function 0009AB60: GetSysColor.USER32(00000011), ref: 0009ABDB
                                      • Part of subcall function 0009AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0009ABE9
                                      • Part of subcall function 0009AB60: SelectObject.GDI32(?,00000000), ref: 0009ABFA
                                      • Part of subcall function 0009AB60: SetBkColor.GDI32(?,00000000), ref: 0009AC03
                                      • Part of subcall function 0009AB60: SelectObject.GDI32(?,?), ref: 0009AC10
                                      • Part of subcall function 0009AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0009AC2F
                                      • Part of subcall function 0009AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0009AC46
                                      • Part of subcall function 0009AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0009AC5B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                    • String ID:
                                    • API String ID: 4124339563-0
                                    • Opcode ID: 2d28af964790d0131ac9bc3d994e1c0a24d43de85f2ca400d69139aa405dbdab
                                    • Instruction ID: 39af2227305656271597455f0d420681a8771b484db367900d65bee5615430d5
                                    • Opcode Fuzzy Hash: 2d28af964790d0131ac9bc3d994e1c0a24d43de85f2ca400d69139aa405dbdab
                                    • Instruction Fuzzy Hash: 7AA19271108702EFEB109F64DC08A6B7BE9FF89321F104A2AF962D61E1D775D844DB92
                                    Function 00012C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • DestroyWindow.USER32(?,?,?), ref: 00012CA2
                                    • DeleteObject.GDI32(00000000), ref: 00012CE8
                                    • DeleteObject.GDI32(00000000), ref: 00012CF3
                                    • DestroyIcon.USER32(00000000,?,?,?), ref: 00012CFE
                                    • DestroyWindow.USER32(00000000,?,?,?), ref: 00012D09
                                    • SendMessageW.USER32(?,00001308,?,00000000), ref: 0004C68B
                                    • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0004C6C4
                                    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0004CAED
                                      • Part of subcall function 00011B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00012036,?,00000000,?,?,?,?,000116CB,00000000,?), ref: 00011B9A
                                    • SendMessageW.USER32(?,00001053), ref: 0004CB2A
                                    • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0004CB41
                                    • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0004CB57
                                    • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0004CB62
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                    • String ID: 0
                                    • API String ID: 464785882-4108050209
                                    • Opcode ID: 0cd314636ebdc0aef6b5362f128c6fce1a924c8214be1e0acc36f2a8e5c0ee43
                                    • Instruction ID: 19da2fdfbe7294d5ce6e0f342411d9468c5efe9c85dd63d579ff154c0b6db659
                                    • Opcode Fuzzy Hash: 0cd314636ebdc0aef6b5362f128c6fce1a924c8214be1e0acc36f2a8e5c0ee43
                                    • Instruction Fuzzy Hash: 32128D70605201EFEBA4CF24C888FA9B7E5BF45310F544579E985DB262CB31ECA1CB95
                                    Function 000877BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • DestroyWindow.USER32(00000000), ref: 000877F1
                                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 000878B0
                                    • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 000878EE
                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00087900
                                    • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00087946
                                    • GetClientRect.USER32(00000000,?), ref: 00087952
                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00087996
                                    • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 000879A5
                                    • GetStockObject.GDI32(00000011), ref: 000879B5
                                    • SelectObject.GDI32(00000000,00000000), ref: 000879B9
                                    • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 000879C9
                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 000879D2
                                    • DeleteDC.GDI32(00000000), ref: 000879DB
                                    • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00087A07
                                    • SendMessageW.USER32(00000030,00000000,00000001), ref: 00087A1E
                                    • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00087A59
                                    • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00087A6D
                                    • SendMessageW.USER32(00000404,00000001,00000000), ref: 00087A7E
                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00087AAE
                                    • GetStockObject.GDI32(00000011), ref: 00087AB9
                                    • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00087AC4
                                    • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00087ACE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                    • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                    • API String ID: 2910397461-517079104
                                    • Opcode ID: 18afa5c6ac05a50ea4ee37121cfda28fd6afc6c2311b1a239ae8112c2251d833
                                    • Instruction ID: 80830d2833c3a52d5a588c80e0d1f1052fd595843562efdf1965ac65cc05c158
                                    • Opcode Fuzzy Hash: 18afa5c6ac05a50ea4ee37121cfda28fd6afc6c2311b1a239ae8112c2251d833
                                    • Instruction Fuzzy Hash: 37A17C71A40609BFEB149BA4DC4AFBEBBA9FB44710F104116FA14E72E1CB74AD00CB60
                                    Function 0007AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetErrorMode.KERNEL32(00000001), ref: 0007AF89
                                    • GetDriveTypeW.KERNEL32(?,0009FAC0,?,\\.\,0009F910), ref: 0007B066
                                    • SetErrorMode.KERNEL32(00000000,0009FAC0,?,\\.\,0009F910), ref: 0007B1C4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorMode$DriveType
                                    • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                    • API String ID: 2907320926-4222207086
                                    • Opcode ID: 16b95ed4011fb6eef1348d132b4748a03f56d68cc1ba948ce80672ba2962fa85
                                    • Instruction ID: b48ce43c695bc1e91f160abc3c0a7c6fc7ac4fc35758f5103785ae50ba119f37
                                    • Opcode Fuzzy Hash: 16b95ed4011fb6eef1348d132b4748a03f56d68cc1ba948ce80672ba2962fa85
                                    • Instruction Fuzzy Hash: 8A51C270F88349AB8B10DB10CDA6FBD73B0BB153457A0C119E50EAB691C73DAD41DB8A
                                    Function 00016A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __wcsnicmp
                                    • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                    • API String ID: 1038674560-86951937
                                    • Opcode ID: 77faa3a232c4ec22b04c8a0bfe6fc5fa23751e4059fffe3ad232311f889c27e0
                                    • Instruction ID: 1f680ba46e36c2de41b1355d6208204aeac23734ded536bb4a617b7667546585
                                    • Opcode Fuzzy Hash: 77faa3a232c4ec22b04c8a0bfe6fc5fa23751e4059fffe3ad232311f889c27e0
                                    • Instruction Fuzzy Hash: 108126B0604245BACB25AF64CCC2FFE77A8AF15714F044034FE45AA183EB61DAC1C696
                                    Function 0009AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetSysColor.USER32(00000012), ref: 0009AB99
                                    • SetTextColor.GDI32(?,?), ref: 0009AB9D
                                    • GetSysColorBrush.USER32(0000000F), ref: 0009ABB3
                                    • GetSysColor.USER32(0000000F), ref: 0009ABBE
                                    • CreateSolidBrush.GDI32(?), ref: 0009ABC3
                                    • GetSysColor.USER32(00000011), ref: 0009ABDB
                                    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0009ABE9
                                    • SelectObject.GDI32(?,00000000), ref: 0009ABFA
                                    • SetBkColor.GDI32(?,00000000), ref: 0009AC03
                                    • SelectObject.GDI32(?,?), ref: 0009AC10
                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0009AC2F
                                    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0009AC46
                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 0009AC5B
                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0009ACA7
                                    • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0009ACCE
                                    • InflateRect.USER32(?,000000FD,000000FD), ref: 0009ACEC
                                    • DrawFocusRect.USER32(?,?), ref: 0009ACF7
                                    • GetSysColor.USER32(00000011), ref: 0009AD05
                                    • SetTextColor.GDI32(?,00000000), ref: 0009AD0D
                                    • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0009AD21
                                    • SelectObject.GDI32(?,0009A869), ref: 0009AD38
                                    • DeleteObject.GDI32(?), ref: 0009AD43
                                    • SelectObject.GDI32(?,?), ref: 0009AD49
                                    • DeleteObject.GDI32(?), ref: 0009AD4E
                                    • SetTextColor.GDI32(?,?), ref: 0009AD54
                                    • SetBkColor.GDI32(?,?), ref: 0009AD5E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                    • String ID:
                                    • API String ID: 1996641542-0
                                    • Opcode ID: ad08c1f894a5987102ccbb144cdf6683fdd4928544fc5738dba1b903cc585fa1
                                    • Instruction ID: c3397265ce494d9d2bbbe411ac367b00d8d400193a044157d8cdd477bbd50d87
                                    • Opcode Fuzzy Hash: ad08c1f894a5987102ccbb144cdf6683fdd4928544fc5738dba1b903cc585fa1
                                    • Instruction Fuzzy Hash: 95614E71900219EFEF119FA8DC48EAE7BB9FB09320F114126F915EB2A1D7759D40DB90
                                    Function 00098C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00098D34
                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00098D45
                                    • CharNextW.USER32(0000014E), ref: 00098D74
                                    • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00098DB5
                                    • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00098DCB
                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00098DDC
                                    • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00098DF9
                                    • SetWindowTextW.USER32(?,0000014E), ref: 00098E45
                                    • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00098E5B
                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 00098E8C
                                    • _memset.LIBCMT ref: 00098EB1
                                    • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00098EFA
                                    • _memset.LIBCMT ref: 00098F59
                                    • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00098F83
                                    • SendMessageW.USER32(?,00001074,?,00000001), ref: 00098FDB
                                    • SendMessageW.USER32(?,0000133D,?,?), ref: 00099088
                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 000990AA
                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 000990F4
                                    • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00099121
                                    • DrawMenuBar.USER32(?), ref: 00099130
                                    • SetWindowTextW.USER32(?,0000014E), ref: 00099158
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                    • String ID: 0
                                    • API String ID: 1073566785-4108050209
                                    • Opcode ID: 3df66a0e86c84a282a9e515cc8807db9614fd62cbd2d4db374bdb48ee97c15cb
                                    • Instruction ID: 20cf85ad407c3b2d7e7c93bf8b28e23bb71d7cc5bcb390760d9c3c06c77b1712
                                    • Opcode Fuzzy Hash: 3df66a0e86c84a282a9e515cc8807db9614fd62cbd2d4db374bdb48ee97c15cb
                                    • Instruction Fuzzy Hash: E6E18370901219ABDF21DF64CC84EFE7BB9FF06710F10815AF915AA291DB748A85EF60
                                    Function 00094B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCursorPos.USER32(?), ref: 00094C51
                                    • GetDesktopWindow.USER32 ref: 00094C66
                                    • GetWindowRect.USER32(00000000), ref: 00094C6D
                                    • GetWindowLongW.USER32(?,000000F0), ref: 00094CCF
                                    • DestroyWindow.USER32(?), ref: 00094CFB
                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00094D24
                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00094D42
                                    • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00094D68
                                    • SendMessageW.USER32(?,00000421,?,?), ref: 00094D7D
                                    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00094D90
                                    • IsWindowVisible.USER32(?), ref: 00094DB0
                                    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00094DCB
                                    • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00094DDF
                                    • GetWindowRect.USER32(?,?), ref: 00094DF7
                                    • MonitorFromPoint.USER32(?,?,00000002), ref: 00094E1D
                                    • GetMonitorInfoW.USER32(00000000,?), ref: 00094E37
                                    • CopyRect.USER32(?,?), ref: 00094E4E
                                    • SendMessageW.USER32(?,00000412,00000000), ref: 00094EB9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                    • String ID: ($0$tooltips_class32
                                    • API String ID: 698492251-4156429822
                                    • Opcode ID: 18d167ba387885c9d052b33fc031de3a2948f05e890188ea1cf045f30c5c19c4
                                    • Instruction ID: 8536bdb61200e9fcb948dd34bb26648a9294df74b689489231248e7c15c57dbb
                                    • Opcode Fuzzy Hash: 18d167ba387885c9d052b33fc031de3a2948f05e890188ea1cf045f30c5c19c4
                                    • Instruction Fuzzy Hash: D8B17971608341AFDB44DF24C849FAABBE4BF88314F00891DF5999B2A2DB74EC45DB91
                                    Function 000127D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000128BC
                                    • GetSystemMetrics.USER32(00000007), ref: 000128C4
                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000128EF
                                    • GetSystemMetrics.USER32(00000008), ref: 000128F7
                                    • GetSystemMetrics.USER32(00000004), ref: 0001291C
                                    • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00012939
                                    • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00012949
                                    • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0001297C
                                    • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00012990
                                    • GetClientRect.USER32(00000000,000000FF), ref: 000129AE
                                    • GetStockObject.GDI32(00000011), ref: 000129CA
                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 000129D5
                                      • Part of subcall function 00012344: GetCursorPos.USER32(?), ref: 00012357
                                      • Part of subcall function 00012344: ScreenToClient.USER32(000D67B0,?), ref: 00012374
                                      • Part of subcall function 00012344: GetAsyncKeyState.USER32(00000001), ref: 00012399
                                      • Part of subcall function 00012344: GetAsyncKeyState.USER32(00000002), ref: 000123A7
                                    • SetTimer.USER32(00000000,00000000,00000028,00011256), ref: 000129FC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                    • String ID: AutoIt v3 GUI
                                    • API String ID: 1458621304-248962490
                                    • Opcode ID: 739c261ad84030b73181b1082594293c487a8a3558b9cb7ebad17e2d53d7c078
                                    • Instruction ID: dd1b9998a3e480b08f56d1391be49b84d67b5276e1fd17e06fa3b6737d457e7f
                                    • Opcode Fuzzy Hash: 739c261ad84030b73181b1082594293c487a8a3558b9cb7ebad17e2d53d7c078
                                    • Instruction Fuzzy Hash: 10B17071A0120AEFEB14DFA8DC45BEE7BB4FB08315F10422AFA15E7290DB789951CB54
                                    Function 00094069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CharUpperBuffW.USER32(?,?), ref: 000940F6
                                    • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 000941B6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharMessageSendUpper
                                    • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                    • API String ID: 3974292440-719923060
                                    • Opcode ID: e2e76291c90630c7f145b3fba901893994009a5889c91aa4926b4cb4edec9e3b
                                    • Instruction ID: 4916a645c35e82999ddfecb171c85a6a69caed625a9b7a10fab873335b0af464
                                    • Opcode Fuzzy Hash: e2e76291c90630c7f145b3fba901893994009a5889c91aa4926b4cb4edec9e3b
                                    • Instruction Fuzzy Hash: ECA15E302143019BCB14EF20C962EAEB3E9BF84314F14896CB8969B6D3DB34ED46DB51
                                    Function 000852F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadCursorW.USER32(00000000,00007F89), ref: 00085309
                                    • LoadCursorW.USER32(00000000,00007F8A), ref: 00085314
                                    • LoadCursorW.USER32(00000000,00007F00), ref: 0008531F
                                    • LoadCursorW.USER32(00000000,00007F03), ref: 0008532A
                                    • LoadCursorW.USER32(00000000,00007F8B), ref: 00085335
                                    • LoadCursorW.USER32(00000000,00007F01), ref: 00085340
                                    • LoadCursorW.USER32(00000000,00007F81), ref: 0008534B
                                    • LoadCursorW.USER32(00000000,00007F88), ref: 00085356
                                    • LoadCursorW.USER32(00000000,00007F80), ref: 00085361
                                    • LoadCursorW.USER32(00000000,00007F86), ref: 0008536C
                                    • LoadCursorW.USER32(00000000,00007F83), ref: 00085377
                                    • LoadCursorW.USER32(00000000,00007F85), ref: 00085382
                                    • LoadCursorW.USER32(00000000,00007F82), ref: 0008538D
                                    • LoadCursorW.USER32(00000000,00007F84), ref: 00085398
                                    • LoadCursorW.USER32(00000000,00007F04), ref: 000853A3
                                    • LoadCursorW.USER32(00000000,00007F02), ref: 000853AE
                                    • GetCursorInfo.USER32(?), ref: 000853BE
                                    • GetLastError.KERNEL32(00000001,00000000), ref: 000853E9
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Cursor$Load$ErrorInfoLast
                                    • String ID:
                                    • API String ID: 3215588206-0
                                    • Opcode ID: 4907ba8a5f0b8905754afaeb85d828f873b933d3b495bc95dc5a2aa681bf9ecf
                                    • Instruction ID: d10be976eca524e62efd7b1bdc186edccec3d20406308f8e3a8559696eac722b
                                    • Opcode Fuzzy Hash: 4907ba8a5f0b8905754afaeb85d828f873b933d3b495bc95dc5a2aa681bf9ecf
                                    • Instruction Fuzzy Hash: DB417370E043196ADB509FBA8C4986EFFF8FF51B50B10452FA549E7291DAB8A500CF51
                                    Function 0006AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetClassNameW.USER32(?,?,00000100), ref: 0006AAA5
                                    • __swprintf.LIBCMT ref: 0006AB46
                                    • _wcscmp.LIBCMT ref: 0006AB59
                                    • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0006ABAE
                                    • _wcscmp.LIBCMT ref: 0006ABEA
                                    • GetClassNameW.USER32(?,?,00000400), ref: 0006AC21
                                    • GetDlgCtrlID.USER32(?), ref: 0006AC73
                                    • GetWindowRect.USER32(?,?), ref: 0006ACA9
                                    • GetParent.USER32(?), ref: 0006ACC7
                                    • ScreenToClient.USER32(00000000), ref: 0006ACCE
                                    • GetClassNameW.USER32(?,?,00000100), ref: 0006AD48
                                    • _wcscmp.LIBCMT ref: 0006AD5C
                                    • GetWindowTextW.USER32(?,?,00000400), ref: 0006AD82
                                    • _wcscmp.LIBCMT ref: 0006AD96
                                      • Part of subcall function 0003386C: _iswctype.LIBCMT ref: 00033874
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                    • String ID: %s%u
                                    • API String ID: 3744389584-679674701
                                    • Opcode ID: 734472a59fa2edd748635a4b6ad9649e28533e357f67adfa7a5c5983f17ce501
                                    • Instruction ID: 3abf3f76c90d409f58f99e97c77478de114747ce7dd89ddef0ebdec8dada024d
                                    • Opcode Fuzzy Hash: 734472a59fa2edd748635a4b6ad9649e28533e357f67adfa7a5c5983f17ce501
                                    • Instruction Fuzzy Hash: 43A1CE71304306AFD715EF64C884BEAB7EAFF05315F00462AF99AE2191DB30E955CB92
                                    Function 0006B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetClassNameW.USER32(00000008,?,00000400), ref: 0006B3DB
                                    • _wcscmp.LIBCMT ref: 0006B3EC
                                    • GetWindowTextW.USER32(00000001,?,00000400), ref: 0006B414
                                    • CharUpperBuffW.USER32(?,00000000), ref: 0006B431
                                    • _wcscmp.LIBCMT ref: 0006B44F
                                    • _wcsstr.LIBCMT ref: 0006B460
                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0006B498
                                    • _wcscmp.LIBCMT ref: 0006B4A8
                                    • GetWindowTextW.USER32(00000002,?,00000400), ref: 0006B4CF
                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0006B518
                                    • _wcscmp.LIBCMT ref: 0006B528
                                    • GetClassNameW.USER32(00000010,?,00000400), ref: 0006B550
                                    • GetWindowRect.USER32(00000004,?), ref: 0006B5B9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                    • String ID: @$ThumbnailClass
                                    • API String ID: 1788623398-1539354611
                                    • Opcode ID: 498ee2b77d14f5ca70043f3b1b8dc461f936578322425d4e316d6c761c70d44d
                                    • Instruction ID: 7615e781d0ab0f2f91fefd114dc6b9ae87e1e3cb7a781b36804795646e8867dd
                                    • Opcode Fuzzy Hash: 498ee2b77d14f5ca70043f3b1b8dc461f936578322425d4e316d6c761c70d44d
                                    • Instruction Fuzzy Hash: 398190B11083069BDB15DF14C885FAABBEAFF44314F04856AFD86DA092DB34DE85CB61
                                    Function 0009C8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • DragQueryPoint.SHELL32(?,?), ref: 0009C917
                                      • Part of subcall function 0009ADF1: ClientToScreen.USER32(?,?), ref: 0009AE1A
                                      • Part of subcall function 0009ADF1: GetWindowRect.USER32(?,?), ref: 0009AE90
                                      • Part of subcall function 0009ADF1: PtInRect.USER32(?,?,0009C304), ref: 0009AEA0
                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0009C980
                                    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0009C98B
                                    • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0009C9AE
                                    • _wcscat.LIBCMT ref: 0009C9DE
                                    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0009C9F5
                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0009CA0E
                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0009CA25
                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0009CA47
                                    • DragFinish.SHELL32(?), ref: 0009CA4E
                                    • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0009CB41
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pr
                                    • API String ID: 169749273-2908241141
                                    • Opcode ID: 914b7bf6c8558139b7cc2ba2a40e0467d319acbc1a5f66e5c56614a369ebce73
                                    • Instruction ID: 582ca8a10160df711810a11520a1c1488c9bbfac8afc27de5ea7e2b11d3d80fd
                                    • Opcode Fuzzy Hash: 914b7bf6c8558139b7cc2ba2a40e0467d319acbc1a5f66e5c56614a369ebce73
                                    • Instruction Fuzzy Hash: AE616D71508301AFD701DF64DC85DAFBBE8FF89750F00092EF596961A2DB709A49CB62
                                    Function 0006B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __wcsnicmp
                                    • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                    • API String ID: 1038674560-1810252412
                                    • Opcode ID: f2f76c5be4a941561becf9e2a0a8c8b6e7314c2516f3f45f12332a9947ed3926
                                    • Instruction ID: f53488da6569d97b6cc7b0cc17ccf712c0b288e44be022fb6cd6d77e8e12ff0d
                                    • Opcode Fuzzy Hash: f2f76c5be4a941561becf9e2a0a8c8b6e7314c2516f3f45f12332a9947ed3926
                                    • Instruction Fuzzy Hash: 7A31E071A48206A6CB14FB60CD97FEE77FA9F20750F600128B541B50D3EF61AF84C651
                                    Function 0006C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadIconW.USER32(00000063), ref: 0006C4D4
                                    • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0006C4E6
                                    • SetWindowTextW.USER32(?,?), ref: 0006C4FD
                                    • GetDlgItem.USER32(?,000003EA), ref: 0006C512
                                    • SetWindowTextW.USER32(00000000,?), ref: 0006C518
                                    • GetDlgItem.USER32(?,000003E9), ref: 0006C528
                                    • SetWindowTextW.USER32(00000000,?), ref: 0006C52E
                                    • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0006C54F
                                    • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0006C569
                                    • GetWindowRect.USER32(?,?), ref: 0006C572
                                    • SetWindowTextW.USER32(?,?), ref: 0006C5DD
                                    • GetDesktopWindow.USER32 ref: 0006C5E3
                                    • GetWindowRect.USER32(00000000), ref: 0006C5EA
                                    • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0006C636
                                    • GetClientRect.USER32(?,?), ref: 0006C643
                                    • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0006C668
                                    • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0006C693
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                    • String ID:
                                    • API String ID: 3869813825-0
                                    • Opcode ID: f46482c29a257d6ebab2df86e90f8712c7c3e167c8196b180662381e99d44a05
                                    • Instruction ID: bad11871dd9812af041c70873809b6778f41020b411be691c626bb3725bc129c
                                    • Opcode Fuzzy Hash: f46482c29a257d6ebab2df86e90f8712c7c3e167c8196b180662381e99d44a05
                                    • Instruction Fuzzy Hash: A2516F7190070AAFEB20DFA8DD85F7EBBF6FF04705F104929E686A25A0C774A954CB50
                                    Function 0009A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 0009A4C8
                                    • DestroyWindow.USER32(?,?), ref: 0009A542
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0009A5BC
                                    • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0009A5DE
                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0009A5F1
                                    • DestroyWindow.USER32(00000000), ref: 0009A613
                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00010000,00000000), ref: 0009A64A
                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0009A663
                                    • GetDesktopWindow.USER32 ref: 0009A67C
                                    • GetWindowRect.USER32(00000000), ref: 0009A683
                                    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0009A69B
                                    • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0009A6B3
                                      • Part of subcall function 000125DB: GetWindowLongW.USER32(?,000000EB), ref: 000125EC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                    • String ID: 0$tooltips_class32
                                    • API String ID: 1297703922-3619404913
                                    • Opcode ID: 568126f26a3b64fc270fcd4fcc010b5c110f3002f6a2d2fa9460e973c4e850f3
                                    • Instruction ID: f2d50ad4e62036c30049c67b4732ebb9c4d4d7df8526259f499ccf7ee0f3f58f
                                    • Opcode Fuzzy Hash: 568126f26a3b64fc270fcd4fcc010b5c110f3002f6a2d2fa9460e973c4e850f3
                                    • Instruction Fuzzy Hash: 25719C71244205AFEB20CF28CC45FAA77E5FB89304F08452DF985C72A1D775E941EB62
                                    Function 00094619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CharUpperBuffW.USER32(?,?), ref: 000946AB
                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 000946F6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharMessageSendUpper
                                    • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                    • API String ID: 3974292440-4258414348
                                    • Opcode ID: b1136ad2b4857fd3c38da4bb790fb46734ef55494ecaedc2488f864747ac4ad9
                                    • Instruction ID: 697c34bb7bc658f6681a3877d683592823eaee7ae746c16d5ad33d956b6a62ce
                                    • Opcode Fuzzy Hash: b1136ad2b4857fd3c38da4bb790fb46734ef55494ecaedc2488f864747ac4ad9
                                    • Instruction Fuzzy Hash: 3D914B742047019BCB14EF24C461EAEB7E6AF85314F04486CF8965B7A3DB35ED4ADB82
                                    Function 0009BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0009BB6E
                                    • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00096D80,?), ref: 0009BBCA
                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0009BC03
                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0009BC46
                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0009BC7D
                                    • FreeLibrary.KERNEL32(?), ref: 0009BC89
                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0009BC99
                                    • DestroyIcon.USER32(?), ref: 0009BCA8
                                    • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0009BCC5
                                    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0009BCD1
                                      • Part of subcall function 0003313D: __wcsicmp_l.LIBCMT ref: 000331C6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                    • String ID: .dll$.exe$.icl
                                    • API String ID: 1212759294-1154884017
                                    • Opcode ID: 193e5573ea56e179f75f65eedd2f21ab3e01eb81b0989f78b46f9710d91541d1
                                    • Instruction ID: 98ba9d6ab44701ed3c73efc211642a0906fd3bea05134cadde3d571f3beb393f
                                    • Opcode Fuzzy Hash: 193e5573ea56e179f75f65eedd2f21ab3e01eb81b0989f78b46f9710d91541d1
                                    • Instruction Fuzzy Hash: 6D61CFB1600219BAEF14DF64DD86FFE77A8BB08720F10411AF915D61D1DBB4A990EBA0
                                    Function 0007A0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadStringW.USER32(00000066,?,00000FFF,0009FB78), ref: 0007A0FC
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                    • LoadStringW.USER32(?,?,00000FFF,?), ref: 0007A11E
                                    • __swprintf.LIBCMT ref: 0007A177
                                    • __swprintf.LIBCMT ref: 0007A190
                                    • _wprintf.LIBCMT ref: 0007A246
                                    • _wprintf.LIBCMT ref: 0007A264
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: LoadString__swprintf_wprintf$_memmove
                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%
                                    • API String ID: 311963372-2232817571
                                    • Opcode ID: f2b649206827a4ac4e1603305fc7596c5de8ec1a529a7732e370e3bf76b7ff59
                                    • Instruction ID: aff912389e1845dc06527f0b4735d48922797bf825d1e74ec8135060ad8d0079
                                    • Opcode Fuzzy Hash: f2b649206827a4ac4e1603305fc7596c5de8ec1a529a7732e370e3bf76b7ff59
                                    • Instruction Fuzzy Hash: 1C517171900209ABDF15EBE4CD86EEEB7B9AF09300F104165F509760A2EB356F99CB61
                                    Function 0007A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    • CharLowerBuffW.USER32(?,?), ref: 0007A636
                                    • GetDriveTypeW.KERNEL32 ref: 0007A683
                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0007A6CB
                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0007A702
                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0007A730
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                    • API String ID: 2698844021-4113822522
                                    • Opcode ID: 4359b275c3ffbd3e780166e55233dc2f25ba3d514cb608f74b86bd204230f8a7
                                    • Instruction ID: 7032fda981924d763380c1ee8427f284b00a600515066f8128fd006b1b3fa447
                                    • Opcode Fuzzy Hash: 4359b275c3ffbd3e780166e55233dc2f25ba3d514cb608f74b86bd204230f8a7
                                    • Instruction Fuzzy Hash: 7A515F716043059FC700EF10C8919AEB7F8FF89718F44896DF89997252DB35AE49CB52
                                    Function 0007A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0007A47A
                                    • __swprintf.LIBCMT ref: 0007A49C
                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0007A4D9
                                    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0007A4FE
                                    • _memset.LIBCMT ref: 0007A51D
                                    • _wcsncpy.LIBCMT ref: 0007A559
                                    • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0007A58E
                                    • CloseHandle.KERNEL32(00000000), ref: 0007A599
                                    • RemoveDirectoryW.KERNEL32(?), ref: 0007A5A2
                                    • CloseHandle.KERNEL32(00000000), ref: 0007A5AC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                    • String ID: :$\$\??\%s
                                    • API String ID: 2733774712-3457252023
                                    • Opcode ID: c2a74a901ee4e8eadf8a947c213d5e4b2fbbdf3c596e448b96e6316cfafd0d1e
                                    • Instruction ID: f70453e15ed158f6b758a984ca8bbc5c8b8b4700a8046dd244b25f6dbb87ae1d
                                    • Opcode Fuzzy Hash: c2a74a901ee4e8eadf8a947c213d5e4b2fbbdf3c596e448b96e6316cfafd0d1e
                                    • Instruction Fuzzy Hash: 643181B5A0011AABDB219BA0DC49FEF77BCEF89701F1081B6F608D6151E67897448B29
                                    Function 0004AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
                                    • String ID:
                                    • API String ID: 884005220-0
                                    • Opcode ID: f40797df6eba7830572b97fea344a4b34494d28f209790fb4c8971aea6fb10e4
                                    • Instruction ID: 99f6212d782d6ba974d75f86b6f5f3b876d7e7b3036b430d4b7cbfb5b8a478e9
                                    • Opcode Fuzzy Hash: f40797df6eba7830572b97fea344a4b34494d28f209790fb4c8971aea6fb10e4
                                    • Instruction Fuzzy Hash: 6E61E6F2A41305AFEB615F24DC42BAD77E9EF13321F104176E8019B292DB39D940C7AA
                                    Function 0007DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                    Download Yara Rule
                                    APIs
                                    • __wsplitpath.LIBCMT ref: 0007DC7B
                                    • _wcscat.LIBCMT ref: 0007DC93
                                    • _wcscat.LIBCMT ref: 0007DCA5
                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0007DCBA
                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0007DCCE
                                    • GetFileAttributesW.KERNEL32(?), ref: 0007DCE6
                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 0007DD00
                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0007DD12
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                    • String ID: *.*
                                    • API String ID: 34673085-438819550
                                    • Opcode ID: 45f59c616635c5de3fcfd90da5a4a491ace523fb1b5293a77dff367f0d026a86
                                    • Instruction ID: f168c67337d197667ae418654b534b52bbd64bfd98d67b783bc503287841ede2
                                    • Opcode Fuzzy Hash: 45f59c616635c5de3fcfd90da5a4a491ace523fb1b5293a77dff367f0d026a86
                                    • Instruction Fuzzy Hash: BA815C71904245DFCB64DF24C8859AEB7F8AF88310F19882BE889C7251E738E944CB56
                                    Function 0009C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0009C4EC
                                    • GetFocus.USER32 ref: 0009C4FC
                                    • GetDlgCtrlID.USER32(00000000), ref: 0009C507
                                    • _memset.LIBCMT ref: 0009C632
                                    • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0009C65D
                                    • GetMenuItemCount.USER32(?), ref: 0009C67D
                                    • GetMenuItemID.USER32(?,00000000), ref: 0009C690
                                    • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0009C6C4
                                    • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0009C70C
                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0009C744
                                    • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0009C779
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                    • String ID: 0
                                    • API String ID: 1296962147-4108050209
                                    • Opcode ID: 9a5d538cab13f9e09943797e5f05f8452c1f0c29e08a1cf02158944dc0c76357
                                    • Instruction ID: 8e13d27a3f058e583dc24a6023b0274ac2a63da55a64418bd8785e8a6fafbeba
                                    • Opcode Fuzzy Hash: 9a5d538cab13f9e09943797e5f05f8452c1f0c29e08a1cf02158944dc0c76357
                                    • Instruction Fuzzy Hash: 1E818E70A083019FEB10CF14C984EABBBE8FB88354F10492EF99597291D771D945EBA2
                                    Function 000683F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0006874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00068766
                                      • Part of subcall function 0006874A: GetLastError.KERNEL32(?,0006822A,?,?,?), ref: 00068770
                                      • Part of subcall function 0006874A: GetProcessHeap.KERNEL32(00000008,?,?,0006822A,?,?,?), ref: 0006877F
                                      • Part of subcall function 0006874A: HeapAlloc.KERNEL32(00000000,?,0006822A,?,?,?), ref: 00068786
                                      • Part of subcall function 0006874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0006879D
                                      • Part of subcall function 000687E7: GetProcessHeap.KERNEL32(00000008,00068240,00000000,00000000,?,00068240,?), ref: 000687F3
                                      • Part of subcall function 000687E7: HeapAlloc.KERNEL32(00000000,?,00068240,?), ref: 000687FA
                                      • Part of subcall function 000687E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00068240,?), ref: 0006880B
                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00068458
                                    • _memset.LIBCMT ref: 0006846D
                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0006848C
                                    • GetLengthSid.ADVAPI32(?), ref: 0006849D
                                    • GetAce.ADVAPI32(?,00000000,?), ref: 000684DA
                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000684F6
                                    • GetLengthSid.ADVAPI32(?), ref: 00068513
                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00068522
                                    • HeapAlloc.KERNEL32(00000000), ref: 00068529
                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 0006854A
                                    • CopySid.ADVAPI32(00000000), ref: 00068551
                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00068582
                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000685A8
                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 000685BC
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                    • String ID:
                                    • API String ID: 3996160137-0
                                    • Opcode ID: 8052920e0e5f85032018c8ab1e5319f417be1efd1f5eb75409ddbd312f614c61
                                    • Instruction ID: b241ad9a8232b3ca384f14d34b3e44adb9850ca70af84290698181b245c44421
                                    • Opcode Fuzzy Hash: 8052920e0e5f85032018c8ab1e5319f417be1efd1f5eb75409ddbd312f614c61
                                    • Instruction Fuzzy Hash: 2B61197190020AABDF10DFA4DC45AEEBBBAFF44300F14826AF915E6291DB359A15CF60
                                    Function 0008762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetDC.USER32(00000000), ref: 000876A2
                                    • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 000876AE
                                    • CreateCompatibleDC.GDI32(?), ref: 000876BA
                                    • SelectObject.GDI32(00000000,?), ref: 000876C7
                                    • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0008771B
                                    • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00087757
                                    • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0008777B
                                    • SelectObject.GDI32(00000006,?), ref: 00087783
                                    • DeleteObject.GDI32(?), ref: 0008778C
                                    • DeleteDC.GDI32(00000006), ref: 00087793
                                    • ReleaseDC.USER32(00000000,?), ref: 0008779E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                    • String ID: (
                                    • API String ID: 2598888154-3887548279
                                    • Opcode ID: 6083c525db667898c60da530051a6cf1d791a36bedbbf8a0bef952f593111cd2
                                    • Instruction ID: 0181174936326659504dfb9d8550e7b12369d55512616e8dbd36cf97519ffc16
                                    • Opcode Fuzzy Hash: 6083c525db667898c60da530051a6cf1d791a36bedbbf8a0bef952f593111cd2
                                    • Instruction Fuzzy Hash: FE515A75904209EFDB25DFA8CC85EAEBBB9FF48310F24842AE99997210D635A850CB50
                                    Function 00016BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00030B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00016C6C,?,00008000), ref: 00030BB7
                                      • Part of subcall function 000148AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000148A1,?,?,000137C0,?), ref: 000148CE
                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00016D0D
                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00016E5A
                                      • Part of subcall function 000159CD: _wcscpy.LIBCMT ref: 00015A05
                                      • Part of subcall function 0003387D: _iswctype.LIBCMT ref: 00033885
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                    • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                    • API String ID: 537147316-1018226102
                                    • Opcode ID: bb4e418637060522baf3918ef386fa3e0bfb68ae3c0b24549d9d337e8e650f7a
                                    • Instruction ID: f8a86631caa92a95d88bc91c2a9d07cd0583fdec2d4ecdf770b3d59ad24b0f04
                                    • Opcode Fuzzy Hash: bb4e418637060522baf3918ef386fa3e0bfb68ae3c0b24549d9d337e8e650f7a
                                    • Instruction Fuzzy Hash: 2D027B711083419FC724EF24C881AEFBBE5BF99354F14492DF48A972A2DB31D989CB46
                                    Function 000145DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 000145F9
                                    • GetMenuItemCount.USER32(000D6890), ref: 0004D7CD
                                    • GetMenuItemCount.USER32(000D6890), ref: 0004D87D
                                    • GetCursorPos.USER32(?), ref: 0004D8C1
                                    • SetForegroundWindow.USER32(00000000), ref: 0004D8CA
                                    • TrackPopupMenuEx.USER32(000D6890,00000000,?,00000000,00000000,00000000), ref: 0004D8DD
                                    • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0004D8E9
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
                                    • String ID:
                                    • API String ID: 2751501086-0
                                    • Opcode ID: 89578073e0768a9b9e30826696bb511eba125afa4a2c13216a74555a881c6ba8
                                    • Instruction ID: b68cb59d36afe59b478038e9be02c21886db0f3b96de8c4f36c309a0c2c8c970
                                    • Opcode Fuzzy Hash: 89578073e0768a9b9e30826696bb511eba125afa4a2c13216a74555a881c6ba8
                                    • Instruction Fuzzy Hash: 387108B0604206BAFB309F14DC49FEABFA4FF05358F204227F615A61E1DBB56850DB95
                                    Function 00088BC0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VariantInit.OLEAUT32(?), ref: 00088BEC
                                    • CoInitialize.OLE32(00000000), ref: 00088C19
                                    • CoUninitialize.OLE32 ref: 00088C23
                                    • GetRunningObjectTable.OLE32(00000000,?), ref: 00088D23
                                    • SetErrorMode.KERNEL32(00000001,00000029), ref: 00088E50
                                    • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,000A2C0C), ref: 00088E84
                                    • CoGetObject.OLE32(?,00000000,000A2C0C,?), ref: 00088EA7
                                    • SetErrorMode.KERNEL32(00000000), ref: 00088EBA
                                    • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00088F3A
                                    • VariantClear.OLEAUT32(?), ref: 00088F4A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                    • String ID: ,,
                                    • API String ID: 2395222682-401794086
                                    • Opcode ID: be10e18a0162fe21feac2f1e6a6809540a19596d70949f6da68c6ea6f756455f
                                    • Instruction ID: 46fe6dd96905cb9fa90c0d1cfe109868ae12b23eb6684b3072b2f7217ce6897c
                                    • Opcode Fuzzy Hash: be10e18a0162fe21feac2f1e6a6809540a19596d70949f6da68c6ea6f756455f
                                    • Instruction Fuzzy Hash: 05C12271208305AFD700EF68C88496BB7E9BF89348F40896DF58ADB252DB71ED05CB52
                                    Function 000910A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                    Download Yara Rule
                                    APIs
                                    • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00090038,?,?), ref: 000910BC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharUpper
                                    • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                    • API String ID: 3964851224-909552448
                                    • Opcode ID: 9710cdc9d6c5307684101c5a5794ee58d3e135085ba131efe38bc9fc8b7e5266
                                    • Instruction ID: ada9b41ee78efacc7b5a31fd2b76e245bbb764e666e52fb2cacfb63a46a2ba2c
                                    • Opcode Fuzzy Hash: 9710cdc9d6c5307684101c5a5794ee58d3e135085ba131efe38bc9fc8b7e5266
                                    • Instruction Fuzzy Hash: 81416A3024524B9BDF11EF90DCA2AEF37B8BF15300F544858FC915B292DB34A96ADB60
                                    Function 00075569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                      • Part of subcall function 00017A84: _memmove.LIBCMT ref: 00017B0D
                                    • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 000755D2
                                    • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 000755E8
                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000755F9
                                    • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0007560B
                                    • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0007561C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: SendString$_memmove
                                    • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                    • API String ID: 2279737902-1007645807
                                    • Opcode ID: f6be82ae978635a019314ec6e74bf53c4cd60fb2b485ce85f5231b30ae51e0dc
                                    • Instruction ID: 22939707c6bfede1c1be29ea3dab3fc67f5cd41f0522a028f12b45dfab308a1f
                                    • Opcode Fuzzy Hash: f6be82ae978635a019314ec6e74bf53c4cd60fb2b485ce85f5231b30ae51e0dc
                                    • Instruction Fuzzy Hash: CB11C420A505AD79D720B7A1CC5AEFFBBBCEFD6B04F40042DB509A70D2DEA40E45C5A2
                                    Function 000748F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                    • String ID: 0.0.0.0
                                    • API String ID: 208665112-3771769585
                                    • Opcode ID: b9361f7ac20b93033f000e95b5b4e1838fb05da388665acd6f8eedb345793a85
                                    • Instruction ID: 526b4d80b1b0066b798268fe670deee17b42922b9faf0a270b0c83e81768765b
                                    • Opcode Fuzzy Hash: b9361f7ac20b93033f000e95b5b4e1838fb05da388665acd6f8eedb345793a85
                                    • Instruction Fuzzy Hash: 9E110531E08115AFDB25AB64EC4AEEF77BCEB01710F0041B6F508D6092EFB89A818665
                                    Function 00075217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • timeGetTime.WINMM ref: 0007521C
                                      • Part of subcall function 00030719: timeGetTime.WINMM(?,75C0B400,00020FF9), ref: 0003071D
                                    • Sleep.KERNEL32(0000000A), ref: 00075248
                                    • EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0007526C
                                    • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0007528E
                                    • SetActiveWindow.USER32 ref: 000752AD
                                    • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 000752BB
                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 000752DA
                                    • Sleep.KERNEL32(000000FA), ref: 000752E5
                                    • IsWindow.USER32 ref: 000752F1
                                    • EndDialog.USER32(00000000), ref: 00075302
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                    • String ID: BUTTON
                                    • API String ID: 1194449130-3405671355
                                    • Opcode ID: f0873843e0228289191b48b6d8a5fd853fc66d2903b93e12f66e7ac1b1598c6d
                                    • Instruction ID: 6cf4a02018d3f7f67c813b52bbe61a977b0143504bdbdf86ef335db790793b55
                                    • Opcode Fuzzy Hash: f0873843e0228289191b48b6d8a5fd853fc66d2903b93e12f66e7ac1b1598c6d
                                    • Instruction Fuzzy Hash: 8F219270605B05AFF7005B60EC88B793B6AFB45387F504426F90DC11B6EBED9D109676
                                    Function 0007D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    • CoInitialize.OLE32(00000000), ref: 0007D855
                                    • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0007D8E8
                                    • SHGetDesktopFolder.SHELL32(?), ref: 0007D8FC
                                    • CoCreateInstance.OLE32(000A2D7C,00000000,00000001,000CA89C,?), ref: 0007D948
                                    • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0007D9B7
                                    • CoTaskMemFree.OLE32(?,?), ref: 0007DA0F
                                    • _memset.LIBCMT ref: 0007DA4C
                                    • SHBrowseForFolderW.SHELL32(?), ref: 0007DA88
                                    • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0007DAAB
                                    • CoTaskMemFree.OLE32(00000000), ref: 0007DAB2
                                    • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0007DAE9
                                    • CoUninitialize.OLE32(00000001,00000000), ref: 0007DAEB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                    • String ID:
                                    • API String ID: 1246142700-0
                                    • Opcode ID: e0f3900a056222e1b9301438a109a59216b1e949d2201d0ee0e519cbaf0c823c
                                    • Instruction ID: a8522f50a9fbc3cc37cbdd10c7400a746d2c4d040b6fdb11523402a67f70f14b
                                    • Opcode Fuzzy Hash: e0f3900a056222e1b9301438a109a59216b1e949d2201d0ee0e519cbaf0c823c
                                    • Instruction Fuzzy Hash: CBB10A75A00109AFDB04DFA4C898DAEBBF9FF48304B1484A9F909EB261DB35ED41CB55
                                    Function 0007052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetKeyboardState.USER32(?), ref: 000705A7
                                    • SetKeyboardState.USER32(?), ref: 00070612
                                    • GetAsyncKeyState.USER32(000000A0), ref: 00070632
                                    • GetKeyState.USER32(000000A0), ref: 00070649
                                    • GetAsyncKeyState.USER32(000000A1), ref: 00070678
                                    • GetKeyState.USER32(000000A1), ref: 00070689
                                    • GetAsyncKeyState.USER32(00000011), ref: 000706B5
                                    • GetKeyState.USER32(00000011), ref: 000706C3
                                    • GetAsyncKeyState.USER32(00000012), ref: 000706EC
                                    • GetKeyState.USER32(00000012), ref: 000706FA
                                    • GetAsyncKeyState.USER32(0000005B), ref: 00070723
                                    • GetKeyState.USER32(0000005B), ref: 00070731
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: State$Async$Keyboard
                                    • String ID:
                                    • API String ID: 541375521-0
                                    • Opcode ID: c735a30b0b7be8a0fb946b07c4c5cdb5f3eb4f532c4c2ac45b0fce781c060719
                                    • Instruction ID: 1f32432d75a4b7147d80bc9a18441d049164b80f242984026394ab8a222ea1f4
                                    • Opcode Fuzzy Hash: c735a30b0b7be8a0fb946b07c4c5cdb5f3eb4f532c4c2ac45b0fce781c060719
                                    • Instruction Fuzzy Hash: E451EC70E0478459FB74DBA488547EABFF49F01340F08C69AD5CA5A1C3DA6CAB4CCB59
                                    Function 0006C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetDlgItem.USER32(?,00000001), ref: 0006C746
                                    • GetWindowRect.USER32(00000000,?), ref: 0006C758
                                    • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0006C7B6
                                    • GetDlgItem.USER32(?,00000002), ref: 0006C7C1
                                    • GetWindowRect.USER32(00000000,?), ref: 0006C7D3
                                    • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0006C827
                                    • GetDlgItem.USER32(?,000003E9), ref: 0006C835
                                    • GetWindowRect.USER32(00000000,?), ref: 0006C846
                                    • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0006C889
                                    • GetDlgItem.USER32(?,000003EA), ref: 0006C897
                                    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0006C8B4
                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0006C8C1
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$ItemMoveRect$Invalidate
                                    • String ID:
                                    • API String ID: 3096461208-0
                                    • Opcode ID: 87781ddece810ac928533e75f528847f670b32cf3c4996fdd18992c4ccf1c3e7
                                    • Instruction ID: 44bdfe49c93da4e7f92d6ce39c46fb723b9a1e9d794885856b76920a0ed135f2
                                    • Opcode Fuzzy Hash: 87781ddece810ac928533e75f528847f670b32cf3c4996fdd18992c4ccf1c3e7
                                    • Instruction Fuzzy Hash: 13511D71B00205AFEB18CFA9DD99EBEBBBAFB88311F148129F515D7290DB749D408B50
                                    Function 0001201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00011B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00012036,?,00000000,?,?,?,?,000116CB,00000000,?), ref: 00011B9A
                                    • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 000120D3
                                    • KillTimer.USER32(-00000001,?,?,?,?,000116CB,00000000,?,?,00011AE2,?,?), ref: 0001216E
                                    • DestroyAcceleratorTable.USER32(00000000), ref: 0004BEF6
                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000116CB,00000000,?,?,00011AE2,?,?), ref: 0004BF27
                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000116CB,00000000,?,?,00011AE2,?,?), ref: 0004BF3E
                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000116CB,00000000,?,?,00011AE2,?,?), ref: 0004BF5A
                                    • DeleteObject.GDI32(00000000), ref: 0004BF6C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                    • String ID:
                                    • API String ID: 641708696-0
                                    • Opcode ID: 060168ff0171c233ada95c3c278c5b4283afa8b872921e5e880fa846345526fa
                                    • Instruction ID: 72cb2b103e8555836b37f28d1830a2fa5960d901c947eea61c2dd8d1f345c67b
                                    • Opcode Fuzzy Hash: 060168ff0171c233ada95c3c278c5b4283afa8b872921e5e880fa846345526fa
                                    • Instruction Fuzzy Hash: 9D618A30105701EFEB369F14DD48BA9B7F1FB54312F10462AE54286A61CB7AA8E1EF50
                                    Function 000121A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000125DB: GetWindowLongW.USER32(?,000000EB), ref: 000125EC
                                    • GetSysColor.USER32(0000000F), ref: 000121D3
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ColorLongWindow
                                    • String ID:
                                    • API String ID: 259745315-0
                                    • Opcode ID: 9f43943b7efb44b2100e5958a78e69cb5364e96d1079a0e826e72191fb8516e4
                                    • Instruction ID: caac075c3fe5367755c1eb02eb9a194ee04bf08846fdc3aa1f502cefc5324536
                                    • Opcode Fuzzy Hash: 9f43943b7efb44b2100e5958a78e69cb5364e96d1079a0e826e72191fb8516e4
                                    • Instruction Fuzzy Hash: C0418031100540EBEB655F28EC88BFD3BA5EB06331F184266FE658A1F6C7358C92DB61
                                    Function 0007AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                    Download Yara Rule
                                    APIs
                                    • CharLowerBuffW.USER32(?,?,0009F910), ref: 0007AB76
                                    • GetDriveTypeW.KERNEL32(00000061,000CA620,00000061), ref: 0007AC40
                                    • _wcscpy.LIBCMT ref: 0007AC6A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharDriveLowerType_wcscpy
                                    • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                    • API String ID: 2820617543-1000479233
                                    • Opcode ID: cefb33fb8b0471461559e408434ef1599d26134ef0434f06bea9a1ecf454fa10
                                    • Instruction ID: 68fca6bfc35a56a8258df99347f498656d9fa56057c136aa92b63756e010a746
                                    • Opcode Fuzzy Hash: cefb33fb8b0471461559e408434ef1599d26134ef0434f06bea9a1ecf454fa10
                                    • Instruction Fuzzy Hash: 38517E306083059FC720EF14C891AEEB7E9EF86304F54882DF59A572A3DB359D49CA53
                                    Function 0009C27C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                      • Part of subcall function 00012344: GetCursorPos.USER32(?), ref: 00012357
                                      • Part of subcall function 00012344: ScreenToClient.USER32(000D67B0,?), ref: 00012374
                                      • Part of subcall function 00012344: GetAsyncKeyState.USER32(00000001), ref: 00012399
                                      • Part of subcall function 00012344: GetAsyncKeyState.USER32(00000002), ref: 000123A7
                                    • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0009C2E4
                                    • ImageList_EndDrag.COMCTL32 ref: 0009C2EA
                                    • ReleaseCapture.USER32 ref: 0009C2F0
                                    • SetWindowTextW.USER32(?,00000000), ref: 0009C39A
                                    • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0009C3AD
                                    • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0009C48F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                    • String ID: @GUI_DRAGFILE$@GUI_DROPID$pr$pr
                                    • API String ID: 1924731296-1214319859
                                    • Opcode ID: 227ecf96aff197e031d56361d8b68e79f7b4cd2226fab24011e9446af4ec5105
                                    • Instruction ID: 9cfdc0c238c18b9da29279375026660be7efe1379a78ef40b6ada5fb21870aba
                                    • Opcode Fuzzy Hash: 227ecf96aff197e031d56361d8b68e79f7b4cd2226fab24011e9446af4ec5105
                                    • Instruction Fuzzy Hash: FC519070208305AFEB04DF24CC95FAA7BE5FB88310F00852EF9558B2E2DB759954DB62
                                    Function 00019997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __i64tow__itow__swprintf
                                    • String ID: %.15g$0x%p$False$True
                                    • API String ID: 421087845-2263619337
                                    • Opcode ID: c1930ee571d2b0abe95a8bc8c1dad781c6687b666d573b0fb6d8bf7cdf4157b3
                                    • Instruction ID: f4dfda21a2574081824754ac861c1c8aa52f63f0dd55d9e8c30f39e08f95f3b4
                                    • Opcode Fuzzy Hash: c1930ee571d2b0abe95a8bc8c1dad781c6687b666d573b0fb6d8bf7cdf4157b3
                                    • Instruction Fuzzy Hash: 5F4192B1604206AFDB34EF38D852FBA73E8EB45300F24487EE549D7292EA719D818B11
                                    Function 000973C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 000973D9
                                    • CreateMenu.USER32 ref: 000973F4
                                    • SetMenu.USER32(?,00000000), ref: 00097403
                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00097490
                                    • IsMenu.USER32(?), ref: 000974A6
                                    • CreatePopupMenu.USER32 ref: 000974B0
                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 000974DD
                                    • DrawMenuBar.USER32 ref: 000974E5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                    • String ID: 0$F
                                    • API String ID: 176399719-3044882817
                                    • Opcode ID: 0b5cffc198692906b61f277d4d4864842a0a7a4abea6682ad1d1ef793e0a4974
                                    • Instruction ID: 29ad0f09deac2d16d8b44ff30763642f8332e211fb3558ff17298b3c959c5ec5
                                    • Opcode Fuzzy Hash: 0b5cffc198692906b61f277d4d4864842a0a7a4abea6682ad1d1ef793e0a4974
                                    • Instruction Fuzzy Hash: A8415675A05209EFEF20DF64D884AAABBF9FF49300F144029FE5997361DB35A910DB60
                                    Function 0009772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 000977CD
                                    • CreateCompatibleDC.GDI32(00000000), ref: 000977D4
                                    • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 000977E7
                                    • SelectObject.GDI32(00000000,00000000), ref: 000977EF
                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 000977FA
                                    • DeleteDC.GDI32(00000000), ref: 00097803
                                    • GetWindowLongW.USER32(?,000000EC), ref: 0009780D
                                    • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00097821
                                    • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0009782D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                    • String ID: static
                                    • API String ID: 2559357485-2160076837
                                    • Opcode ID: fbb8c3b77603e9c45d8ffdde4c7544cdb3e5282ab6b7fc81f18b52065b2fee99
                                    • Instruction ID: d8d0cf5f6cd9035be87c0596367165b0db4c6a037829351dc38c859e7a21652c
                                    • Opcode Fuzzy Hash: fbb8c3b77603e9c45d8ffdde4c7544cdb3e5282ab6b7fc81f18b52065b2fee99
                                    • Instruction Fuzzy Hash: 5B317032115216BBEF115FA4DC09FEB3BA9FF09760F110225FA19D60A0CB35D821EBA4
                                    Function 00037040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 0003707B
                                      • Part of subcall function 00038D68: __getptd_noexit.LIBCMT ref: 00038D68
                                    • __gmtime64_s.LIBCMT ref: 00037114
                                    • __gmtime64_s.LIBCMT ref: 0003714A
                                    • __gmtime64_s.LIBCMT ref: 00037167
                                    • __allrem.LIBCMT ref: 000371BD
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000371D9
                                    • __allrem.LIBCMT ref: 000371F0
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0003720E
                                    • __allrem.LIBCMT ref: 00037225
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00037243
                                    • __invoke_watson.LIBCMT ref: 000372B4
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                    • String ID:
                                    • API String ID: 384356119-0
                                    • Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
                                    • Instruction ID: 5f73c22931068019fa58f3801c2646e041b738f15c121c49ffc122768b10701c
                                    • Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
                                    • Instruction Fuzzy Hash: EA71C8F2A04716ABD7359E79CC81B9BB3ECAF15320F14423AF918E7682E770D9408794
                                    Function 00072A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00072A31
                                    • GetMenuItemInfoW.USER32(000D6890,000000FF,00000000,00000030), ref: 00072A92
                                    • SetMenuItemInfoW.USER32(000D6890,00000004,00000000,00000030), ref: 00072AC8
                                    • Sleep.KERNEL32(000001F4), ref: 00072ADA
                                    • GetMenuItemCount.USER32(?), ref: 00072B1E
                                    • GetMenuItemID.USER32(?,00000000), ref: 00072B3A
                                    • GetMenuItemID.USER32(?,-00000001), ref: 00072B64
                                    • GetMenuItemID.USER32(?,?), ref: 00072BA9
                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00072BEF
                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00072C03
                                    • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00072C24
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                    • String ID:
                                    • API String ID: 4176008265-0
                                    • Opcode ID: 8905569fd785b5d776187c328eac784c62fb4a623dff947c9123351910b79ec5
                                    • Instruction ID: 05ad08d1ffe23f114e288afda006703cd7423077f39a3c78a34dfcd46bf72d9a
                                    • Opcode Fuzzy Hash: 8905569fd785b5d776187c328eac784c62fb4a623dff947c9123351910b79ec5
                                    • Instruction Fuzzy Hash: 2461B0B0D0024AAFEB21CF64CD88EBE7BB8FB01304F14846AE84593252D739AD45DB25
                                    Function 00097192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00097214
                                    • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00097217
                                    • GetWindowLongW.USER32(?,000000F0), ref: 0009723B
                                    • _memset.LIBCMT ref: 0009724C
                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0009725E
                                    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 000972D6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$LongWindow_memset
                                    • String ID:
                                    • API String ID: 830647256-0
                                    • Opcode ID: 4f0d516f04e00d4a57e70d7a0fdb1a8e69971342523a819a541231336a61678c
                                    • Instruction ID: 9400aa60c3a6bdb12b0de83ede41fc003fec1547fc2f484b6848c472480e2f08
                                    • Opcode Fuzzy Hash: 4f0d516f04e00d4a57e70d7a0fdb1a8e69971342523a819a541231336a61678c
                                    • Instruction Fuzzy Hash: A7616D75A00208AFDB10DFA4CC81EEE77F8EB09710F14416AFA14E72A1D775AE45EB60
                                    Function 0006710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00067135
                                    • SafeArrayAllocData.OLEAUT32(?), ref: 0006718E
                                    • VariantInit.OLEAUT32(?), ref: 000671A0
                                    • SafeArrayAccessData.OLEAUT32(?,?), ref: 000671C0
                                    • VariantCopy.OLEAUT32(?,?), ref: 00067213
                                    • SafeArrayUnaccessData.OLEAUT32(?), ref: 00067227
                                    • VariantClear.OLEAUT32(?), ref: 0006723C
                                    • SafeArrayDestroyData.OLEAUT32(?), ref: 00067249
                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00067252
                                    • VariantClear.OLEAUT32(?), ref: 00067264
                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0006726F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                    • String ID:
                                    • API String ID: 2706829360-0
                                    • Opcode ID: af2578f19b51a918488e8ab354d93dcc70217741779bccd412176b71a237c08f
                                    • Instruction ID: 65680309160fec6a909bbe5e1e781d9d3f88a81b537e0e90a459800d5bd75ee2
                                    • Opcode Fuzzy Hash: af2578f19b51a918488e8ab354d93dcc70217741779bccd412176b71a237c08f
                                    • Instruction Fuzzy Hash: E7415F35A0421AAFDF04DFA8D8549EEBBB9FF48354F00806AF915E7261DB34A945CB90
                                    Function 000886D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    • CoInitialize.OLE32 ref: 00088718
                                    • CoUninitialize.OLE32 ref: 00088723
                                    • CoCreateInstance.OLE32(?,00000000,00000017,000A2BEC,?), ref: 00088783
                                    • IIDFromString.OLE32(?,?), ref: 000887F6
                                    • VariantInit.OLEAUT32(?), ref: 00088890
                                    • VariantClear.OLEAUT32(?), ref: 000888F1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                    • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                    • API String ID: 834269672-1287834457
                                    • Opcode ID: 183d39ab3c81bbb6f5b47b0ef697b88faf4fcc1ea5749981e9b40dbeaef4a959
                                    • Instruction ID: 758a00c2df454407117051d728c129db518b9576ae83774ca4bd84da8ca69865
                                    • Opcode Fuzzy Hash: 183d39ab3c81bbb6f5b47b0ef697b88faf4fcc1ea5749981e9b40dbeaef4a959
                                    • Instruction Fuzzy Hash: B9616A70608301DFD710EF64C988AAEBBE4BF45714F94881DF9859B291DB74ED48CB92
                                    Function 00085A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • WSAStartup.WSOCK32(00000101,?), ref: 00085AA6
                                    • inet_addr.WSOCK32(?,?,?), ref: 00085AEB
                                    • gethostbyname.WSOCK32(?), ref: 00085AF7
                                    • IcmpCreateFile.IPHLPAPI ref: 00085B05
                                    • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00085B75
                                    • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00085B8B
                                    • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00085C00
                                    • WSACleanup.WSOCK32 ref: 00085C06
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                    • String ID: Ping
                                    • API String ID: 1028309954-2246546115
                                    • Opcode ID: 800b419d520d740221d4051dccddc60a5c008333dde81cc5535da4480499c893
                                    • Instruction ID: ae823ae00e9d8ec40897ad5edfd3bdcede713b921cc03d562451827a6aac6253
                                    • Opcode Fuzzy Hash: 800b419d520d740221d4051dccddc60a5c008333dde81cc5535da4480499c893
                                    • Instruction Fuzzy Hash: 2A518F316047019FDB20AF64CC85B6ABBE4FF88711F14896AF595DB2A2DB74EC40CB42
                                    Function 0007B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetErrorMode.KERNEL32(00000001), ref: 0007B73B
                                    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0007B7B1
                                    • GetLastError.KERNEL32 ref: 0007B7BB
                                    • SetErrorMode.KERNEL32(00000000,READY), ref: 0007B828
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Error$Mode$DiskFreeLastSpace
                                    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                    • API String ID: 4194297153-14809454
                                    • Opcode ID: 4c76ae1156c5c3258624cc407bcea21e50cf16ed2b659543dce1eaecb635921b
                                    • Instruction ID: 3755b304be6587a3949bead8ac1d990a83397a92886907f1175840a6d5d988ca
                                    • Opcode Fuzzy Hash: 4c76ae1156c5c3258624cc407bcea21e50cf16ed2b659543dce1eaecb635921b
                                    • Instruction Fuzzy Hash: B931C034E042099FDB14EF64C885BFE7BB8FF44700F10802AE509DB292DB399946CB56
                                    Function 00069471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 0006B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0006B0E7
                                    • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 000694F6
                                    • GetDlgCtrlID.USER32 ref: 00069501
                                    • GetParent.USER32 ref: 0006951D
                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00069520
                                    • GetDlgCtrlID.USER32(?), ref: 00069529
                                    • GetParent.USER32(?), ref: 00069545
                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 00069548
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$CtrlParent$ClassName_memmove
                                    • String ID: ComboBox$ListBox
                                    • API String ID: 1536045017-1403004172
                                    • Opcode ID: 672d88a6d764d98c48b531574efa6e75e56615d5c9c66865b07150208ae49122
                                    • Instruction ID: 476317fa458e7df7f430bda09991e1dc838faead8a5998293ab12c79d962b791
                                    • Opcode Fuzzy Hash: 672d88a6d764d98c48b531574efa6e75e56615d5c9c66865b07150208ae49122
                                    • Instruction Fuzzy Hash: F821D670A00204BBDF05AB64CC85EFEBBB9FF45300F10016AB562972E2DB795959DB20
                                    Function 0006955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 0006B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0006B0E7
                                    • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 000695DF
                                    • GetDlgCtrlID.USER32 ref: 000695EA
                                    • GetParent.USER32 ref: 00069606
                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00069609
                                    • GetDlgCtrlID.USER32(?), ref: 00069612
                                    • GetParent.USER32(?), ref: 0006962E
                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 00069631
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$CtrlParent$ClassName_memmove
                                    • String ID: ComboBox$ListBox
                                    • API String ID: 1536045017-1403004172
                                    • Opcode ID: c2001b49c9a30e28712303002535ec9eb15a76dd089aad10c753b26319515fb6
                                    • Instruction ID: 3b55266fe03dd65b6518df3e4dad009cdbb9b7412559e8d9a6ac4e71d3f4ac4c
                                    • Opcode Fuzzy Hash: c2001b49c9a30e28712303002535ec9eb15a76dd089aad10c753b26319515fb6
                                    • Instruction Fuzzy Hash: AE21A775A00204BBDF05AB60CCC5EFEBBB9FF48300F10415AF952972A2DB799959DB20
                                    Function 00069645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetParent.USER32 ref: 00069651
                                    • GetClassNameW.USER32(00000000,?,00000100), ref: 00069666
                                    • _wcscmp.LIBCMT ref: 00069678
                                    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 000696F3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClassMessageNameParentSend_wcscmp
                                    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                    • API String ID: 1704125052-3381328864
                                    • Opcode ID: 50a29b7016447a5a6ade44c2cf29ec269b4de31254fb00a11d4be19b7eeb3907
                                    • Instruction ID: dcbc0162582005ed87288492d9f4d3f9797b8808d47ec9b2c6045afbadb5dd27
                                    • Opcode Fuzzy Hash: 50a29b7016447a5a6ade44c2cf29ec269b4de31254fb00a11d4be19b7eeb3907
                                    • Instruction Fuzzy Hash: 34118A7A248717BAF6122620DC4BDEA77DD9B05770F20012BFA00E54D2FE7159515758
                                    Function 00074189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • __swprintf.LIBCMT ref: 0007419D
                                    • __swprintf.LIBCMT ref: 000741AA
                                      • Part of subcall function 000338D8: __woutput_l.LIBCMT ref: 00033931
                                    • FindResourceW.KERNEL32(?,?,0000000E), ref: 000741D4
                                    • LoadResource.KERNEL32(?,00000000), ref: 000741E0
                                    • LockResource.KERNEL32(00000000), ref: 000741ED
                                    • FindResourceW.KERNEL32(?,?,00000003), ref: 0007420D
                                    • LoadResource.KERNEL32(?,00000000), ref: 0007421F
                                    • SizeofResource.KERNEL32(?,00000000), ref: 0007422E
                                    • LockResource.KERNEL32(?), ref: 0007423A
                                    • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0007429B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                    • String ID:
                                    • API String ID: 1433390588-0
                                    • Opcode ID: 580ffcef88f5118d5e8b3fb80b8eba1b6c06084930b08c39a468e176893d1a54
                                    • Instruction ID: bd7372894d6ced2a0bb363001f1bfd2d0cfed719e6ef83cd44d968bec303cb65
                                    • Opcode Fuzzy Hash: 580ffcef88f5118d5e8b3fb80b8eba1b6c06084930b08c39a468e176893d1a54
                                    • Instruction Fuzzy Hash: C9318071A0521AABDB119F60EC88EBF7BACFF04301F408526F909D2151E778D9628BB5
                                    Function 000716DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCurrentThreadId.KERNEL32 ref: 00071700
                                    • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00070778,?,00000001), ref: 00071714
                                    • GetWindowThreadProcessId.USER32(00000000), ref: 0007171B
                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00070778,?,00000001), ref: 0007172A
                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0007173C
                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00070778,?,00000001), ref: 00071755
                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00070778,?,00000001), ref: 00071767
                                    • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00070778,?,00000001), ref: 000717AC
                                    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00070778,?,00000001), ref: 000717C1
                                    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00070778,?,00000001), ref: 000717CC
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                    • String ID:
                                    • API String ID: 2156557900-0
                                    • Opcode ID: 42dd578dd5e88ceb1352c6588e5742204765d8cc65bbaabf994ffd4d3d0457f7
                                    • Instruction ID: 97cc22df5db06c198fe7c8f56eeb9d2ad565b02ffada2e20c455484179adc597
                                    • Opcode Fuzzy Hash: 42dd578dd5e88ceb1352c6588e5742204765d8cc65bbaabf994ffd4d3d0457f7
                                    • Instruction Fuzzy Hash: 28316B75A09304ABEB259F18EC84BB97BFDAB55711F108026F808D62E0E77C9D40CBB4
                                    Function 0001FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                    Download Yara Rule
                                    APIs
                                    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0001FC06
                                    • OleUninitialize.OLE32(?,00000000), ref: 0001FCA5
                                    • UnregisterHotKey.USER32(?), ref: 0001FDFC
                                    • DestroyWindow.USER32(?), ref: 00054A00
                                    • FreeLibrary.KERNEL32(?), ref: 00054A65
                                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00054A92
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                    • String ID: close all
                                    • API String ID: 469580280-3243417748
                                    • Opcode ID: 0691a104d4a6be4e376b1e31d49abb31658d256bc2e4ffc6194dd2443d02844b
                                    • Instruction ID: 9f925a6a430a769324977b671f753f3101e463ab51ced959704cd94d0da4cc15
                                    • Opcode Fuzzy Hash: 0691a104d4a6be4e376b1e31d49abb31658d256bc2e4ffc6194dd2443d02844b
                                    • Instruction Fuzzy Hash: 11A19230701212CFDB69EF14C595AFAF3A5BF04705F5442ADE80AAB252CB30AD96CF95
                                    Function 00089428 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Variant$ClearInit$_memset
                                    • String ID: ,,$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                    • API String ID: 2862541840-2086106293
                                    • Opcode ID: d8c95b41065ba77c0cea8704ef6422eb5233cbce73ea3337117cb49915b63e56
                                    • Instruction ID: c88e8cff44d5fa2dd68ec87577ef7bbad792f4e947fadd7ee1728ec902f91cc4
                                    • Opcode Fuzzy Hash: d8c95b41065ba77c0cea8704ef6422eb5233cbce73ea3337117cb49915b63e56
                                    • Instruction Fuzzy Hash: 1291AD70A00219ABDF24EFA5C848FAEBBB8FF85314F148159F555AB281D7709905CFA0
                                    Function 0006A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                    Download Yara Rule
                                    APIs
                                    • EnumChildWindows.USER32(?,0006AA64), ref: 0006A9A2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ChildEnumWindows
                                    • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                    • API String ID: 3555792229-1603158881
                                    • Opcode ID: 5dba27c1cff186ed82fe949b6d0f98c082c8dbeb81cfcddbe12ebb503c7a630c
                                    • Instruction ID: fca542957f8b321c25595f2a3ad0300734e1ca4af916c6913e1ed2ab9b65be9f
                                    • Opcode Fuzzy Hash: 5dba27c1cff186ed82fe949b6d0f98c082c8dbeb81cfcddbe12ebb503c7a630c
                                    • Instruction Fuzzy Hash: C9918570704606EADB58EF60C481BEDF7BABF05304F508119D49AB7152DF306A99CFA1
                                    Function 00012E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SetWindowLongW.USER32(?,000000EB), ref: 00012EAE
                                      • Part of subcall function 00011DB3: GetClientRect.USER32(?,?), ref: 00011DDC
                                      • Part of subcall function 00011DB3: GetWindowRect.USER32(?,?), ref: 00011E1D
                                      • Part of subcall function 00011DB3: ScreenToClient.USER32(?,?), ref: 00011E45
                                    • GetDC.USER32 ref: 0004CF82
                                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0004CF95
                                    • SelectObject.GDI32(00000000,00000000), ref: 0004CFA3
                                    • SelectObject.GDI32(00000000,00000000), ref: 0004CFB8
                                    • ReleaseDC.USER32(?,00000000), ref: 0004CFC0
                                    • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0004D04B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                    • String ID: U
                                    • API String ID: 4009187628-3372436214
                                    • Opcode ID: e23f374b92f4dc817980081793fe3ce12155b12d23be283c149e01e8ca1c25f4
                                    • Instruction ID: e802a31b2f86e4dee881b28d539a5c4c09de5745ee905a028c9c37b69dc83100
                                    • Opcode Fuzzy Hash: e23f374b92f4dc817980081793fe3ce12155b12d23be283c149e01e8ca1c25f4
                                    • Instruction Fuzzy Hash: 9C71DDB0500209EFDF618F64C880AEA3BF6FF49320F14427AED559A2A6C7358C91DB64
                                    Function 00088F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,?,0009F910), ref: 0008903D
                                    • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0009F910), ref: 00089071
                                    • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 000891EB
                                    • SysFreeString.OLEAUT32(?), ref: 00089215
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                    • String ID:
                                    • API String ID: 560350794-0
                                    • Opcode ID: 33ec308afae67888d450f3cf0bd5bf321aca09c2ea1531c499f6552d655a1960
                                    • Instruction ID: 0eca2a3634c7216f11d99bce3b990a273fac62c1e9f2cb61c7e30ec7cda0f7c3
                                    • Opcode Fuzzy Hash: 33ec308afae67888d450f3cf0bd5bf321aca09c2ea1531c499f6552d655a1960
                                    • Instruction Fuzzy Hash: 64F13771A00219EFDF14EF94C888EBEB7B9BF49314F148059F956AB291CB31AE45CB50
                                    Function 0008F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 0008F9C9
                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0008FB5C
                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0008FB80
                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0008FBC0
                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0008FBE2
                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0008FD5E
                                    • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0008FD90
                                    • CloseHandle.KERNEL32(?), ref: 0008FDBF
                                    • CloseHandle.KERNEL32(?), ref: 0008FE36
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                    • String ID:
                                    • API String ID: 4090791747-0
                                    • Opcode ID: ddba14c90ccee782bc009f52b5b973d9de2bdd668a0db25d847b94722c635631
                                    • Instruction ID: 74e298ba3d8f432dd09c7e2f2228c22bfba21ae113325d035df7329351113abc
                                    • Opcode Fuzzy Hash: ddba14c90ccee782bc009f52b5b973d9de2bdd668a0db25d847b94722c635631
                                    • Instruction Fuzzy Hash: 42E1A0316043029FCB25EF34C891ABABBE5BF84354F14856DF8998B2A2DB31DD44CB52
                                    Function 00074F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000748AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000738D3,?), ref: 000748C7
                                      • Part of subcall function 000748AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000738D3,?), ref: 000748E0
                                      • Part of subcall function 00074CD3: GetFileAttributesW.KERNEL32(?,00073947), ref: 00074CD4
                                    • lstrcmpiW.KERNEL32(?,?), ref: 00074FE2
                                    • _wcscmp.LIBCMT ref: 00074FFC
                                    • MoveFileW.KERNEL32(?,?), ref: 00075017
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                    • String ID:
                                    • API String ID: 793581249-0
                                    • Opcode ID: 3c578cf28bc5738e7c694630a06ec87e9a8f960947efa01922408323337f6e03
                                    • Instruction ID: f440aa25553969fa6d93df2edf868346a33797991a1596c9545ee6f3c88ce8f5
                                    • Opcode Fuzzy Hash: 3c578cf28bc5738e7c694630a06ec87e9a8f960947efa01922408323337f6e03
                                    • Instruction Fuzzy Hash: 635175B25087859BC765DB60CC819DFB3ECAF85301F40892EF189D7152EF74A288876A
                                    Function 000988B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                    Download Yara Rule
                                    APIs
                                    • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0009896E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: InvalidateRect
                                    • String ID:
                                    • API String ID: 634782764-0
                                    • Opcode ID: 5d4eba6cbee433f1014ed15145cb5675fb8941c925817fca3e85583179abf766
                                    • Instruction ID: bb104cf556a8d4161c63107fc054794df8b3651c11d8f04e5116fadb325ce586
                                    • Opcode Fuzzy Hash: 5d4eba6cbee433f1014ed15145cb5675fb8941c925817fca3e85583179abf766
                                    • Instruction Fuzzy Hash: 6551A430604209BBEF349F28CC85BAE7BA5BB06350F608112F515E63E1DF75A990EB52
                                    Function 00012B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0004C547
                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0004C569
                                    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0004C581
                                    • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0004C59F
                                    • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0004C5C0
                                    • DestroyIcon.USER32(00000000), ref: 0004C5CF
                                    • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0004C5EC
                                    • DestroyIcon.USER32(?), ref: 0004C5FB
                                      • Part of subcall function 0009A71E: DeleteObject.GDI32(00000000), ref: 0009A757
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                    • String ID:
                                    • API String ID: 2819616528-0
                                    • Opcode ID: 56433e21ec22e294e6754bcdd66d0153d5fab92004cea48dfd1bf16c9c735589
                                    • Instruction ID: 607a583da2b95fe3f27178d6ff8522362bb3434753e32fef4b2766b20a6f4e4e
                                    • Opcode Fuzzy Hash: 56433e21ec22e294e6754bcdd66d0153d5fab92004cea48dfd1bf16c9c735589
                                    • Instruction Fuzzy Hash: 01515674A05609AFEB60DF24CC85FAE77E5EB48350F104529F902D72A0DB74EDA0DB60
                                    Function 00069B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0006AE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 0006AE77
                                      • Part of subcall function 0006AE57: GetCurrentThreadId.KERNEL32 ref: 0006AE7E
                                      • Part of subcall function 0006AE57: AttachThreadInput.USER32(00000000,?,00069B65,?,00000001), ref: 0006AE85
                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00069B70
                                    • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00069B8D
                                    • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00069B90
                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00069B99
                                    • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00069BB7
                                    • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00069BBA
                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 00069BC3
                                    • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00069BDA
                                    • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00069BDD
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                    • String ID:
                                    • API String ID: 2014098862-0
                                    • Opcode ID: 8dea1ec51919507d65731a31631c2095a5538f00b182509525f670c0afd79175
                                    • Instruction ID: df8535ae8197ccd57ec76a18ec987c11a914d5f693b8bebcb54f8ae62cdf5779
                                    • Opcode Fuzzy Hash: 8dea1ec51919507d65731a31631c2095a5538f00b182509525f670c0afd79175
                                    • Instruction Fuzzy Hash: D211E171A50218BEF6106B60DC89FAA3B2DEB4C755F100426F244AB0A1CAF35C50DAA4
                                    Function 00068E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00068A84,00000B00,?,?), ref: 00068E0C
                                    • HeapAlloc.KERNEL32(00000000,?,00068A84,00000B00,?,?), ref: 00068E13
                                    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00068A84,00000B00,?,?), ref: 00068E28
                                    • GetCurrentProcess.KERNEL32(?,00000000,?,00068A84,00000B00,?,?), ref: 00068E30
                                    • DuplicateHandle.KERNEL32(00000000,?,00068A84,00000B00,?,?), ref: 00068E33
                                    • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00068A84,00000B00,?,?), ref: 00068E43
                                    • GetCurrentProcess.KERNEL32(00068A84,00000000,?,00068A84,00000B00,?,?), ref: 00068E4B
                                    • DuplicateHandle.KERNEL32(00000000,?,00068A84,00000B00,?,?), ref: 00068E4E
                                    • CreateThread.KERNEL32(00000000,00000000,00068E74,00000000,00000000,00000000), ref: 00068E68
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                    • String ID:
                                    • API String ID: 1957940570-0
                                    • Opcode ID: 345a1f20074b1c526d8fe787b0dfe9433152ae4665e86b7c6d7d5d48b4740e22
                                    • Instruction ID: c1075344a39da6995fefd5dbaf2ab836cd05201f59ccedc071eae4ea60d3c7d1
                                    • Opcode Fuzzy Hash: 345a1f20074b1c526d8fe787b0dfe9433152ae4665e86b7c6d7d5d48b4740e22
                                    • Instruction Fuzzy Hash: 1E01A8B5240309FFE610ABA5DC49F6B3BACFB89711F104422FA05DB1A1CA759800CB64
                                    Function 00089A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00067652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?,?,?,0006799D), ref: 0006766F
                                      • Part of subcall function 00067652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?,?), ref: 0006768A
                                      • Part of subcall function 00067652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?,?), ref: 00067698
                                      • Part of subcall function 00067652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?), ref: 000676A8
                                    • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00089B1B
                                    • _memset.LIBCMT ref: 00089B28
                                    • _memset.LIBCMT ref: 00089C6B
                                    • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00089C97
                                    • CoTaskMemFree.OLE32(?), ref: 00089CA2
                                    Strings
                                    • NULL Pointer assignment, xrefs: 00089CF0
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                    • String ID: NULL Pointer assignment
                                    • API String ID: 1300414916-2785691316
                                    • Opcode ID: 37826ece51829b87cf55c7b5f62843656f7d803e0b2203a815c392acf108e4ce
                                    • Instruction ID: 199f022b291d3f8313096d4de537db42b4117f5e73ece8cf2c2cbd467ddc4eea
                                    • Opcode Fuzzy Hash: 37826ece51829b87cf55c7b5f62843656f7d803e0b2203a815c392acf108e4ce
                                    • Instruction Fuzzy Hash: E6912971D00219EBDB10EFA4DC85AEEBBB9BF08710F24415AF519A7281DB715A44CFA0
                                    Function 00096FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00097093
                                    • SendMessageW.USER32(?,00001036,00000000,?), ref: 000970A7
                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 000970C1
                                    • _wcscat.LIBCMT ref: 0009711C
                                    • SendMessageW.USER32(?,00001057,00000000,?), ref: 00097133
                                    • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00097161
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$Window_wcscat
                                    • String ID: SysListView32
                                    • API String ID: 307300125-78025650
                                    • Opcode ID: 4dfff6eee985c00dc764035168c9e8dbcc3529a1b6422393caea6f7fed9e4166
                                    • Instruction ID: 9696872477429374c747d474321339f9374e4dfe76ef0619d42d700ce4b3e036
                                    • Opcode Fuzzy Hash: 4dfff6eee985c00dc764035168c9e8dbcc3529a1b6422393caea6f7fed9e4166
                                    • Instruction Fuzzy Hash: 9541A171A14309EFEF219F64CC85BEE77E8EF48350F10042AF688E7192D6729D849B60
                                    Function 0008EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00073E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00073EB6
                                      • Part of subcall function 00073E91: Process32FirstW.KERNEL32(00000000,?), ref: 00073EC4
                                      • Part of subcall function 00073E91: CloseHandle.KERNEL32(00000000), ref: 00073F8E
                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0008ECB8
                                    • GetLastError.KERNEL32 ref: 0008ECCB
                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0008ECFA
                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 0008ED77
                                    • GetLastError.KERNEL32(00000000), ref: 0008ED82
                                    • CloseHandle.KERNEL32(00000000), ref: 0008EDB7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                    • String ID: SeDebugPrivilege
                                    • API String ID: 2533919879-2896544425
                                    • Opcode ID: 7f35c12bd39bf7be25b6c743e08b49099760021f95ebf1f92d94dfe0a07e9b01
                                    • Instruction ID: f5e07cff74e917340c4d7e5ad865f208b21d690b95c8432f30e7a7ab90f2f003
                                    • Opcode Fuzzy Hash: 7f35c12bd39bf7be25b6c743e08b49099760021f95ebf1f92d94dfe0a07e9b01
                                    • Instruction Fuzzy Hash: A941AE712042019FDB24EF24CC95FBDB7A5BF40714F188069F8869B2D3DB79A848CB96
                                    Function 00073226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadIconW.USER32(00000000,00007F03), ref: 000732C5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: IconLoad
                                    • String ID: blank$info$question$stop$warning
                                    • API String ID: 2457776203-404129466
                                    • Opcode ID: fc307851d6f79a5eed519693c11d372256e5ceacbe0c3ea61f93afa78282fe10
                                    • Instruction ID: 673a1cb255e772b89d569b96c89186993ce892000a3e083d87f3678b563e8ab4
                                    • Opcode Fuzzy Hash: fc307851d6f79a5eed519693c11d372256e5ceacbe0c3ea61f93afa78282fe10
                                    • Instruction Fuzzy Hash: B1115B35B48356BAB7015B54DC83DAEB3DCDF09374F10402AF908A6183D6795B0216B9
                                    Function 00074534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0007454E
                                    • LoadStringW.USER32(00000000), ref: 00074555
                                    • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0007456B
                                    • LoadStringW.USER32(00000000), ref: 00074572
                                    • _wprintf.LIBCMT ref: 00074598
                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 000745B6
                                    Strings
                                    • %s (%d) : ==> %s: %s %s, xrefs: 00074593
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: HandleLoadModuleString$Message_wprintf
                                    • String ID: %s (%d) : ==> %s: %s %s
                                    • API String ID: 3648134473-3128320259
                                    • Opcode ID: 52d0bcbd6f498f984cdddcc5e97ba69662030953d58a00f3f7d7dc408308dcf0
                                    • Instruction ID: f479eccf6898166d487ac17acfc84133e242c8e5970f35e5d24f83c09e0e3e5d
                                    • Opcode Fuzzy Hash: 52d0bcbd6f498f984cdddcc5e97ba69662030953d58a00f3f7d7dc408308dcf0
                                    • Instruction Fuzzy Hash: D30167F3904209BFE7519790DD89EFB776CE708301F0045A6B749D2051EA785E858B74
                                    Function 0009D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • GetSystemMetrics.USER32(0000000F), ref: 0009D78A
                                    • GetSystemMetrics.USER32(0000000F), ref: 0009D7AA
                                    • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0009D9E5
                                    • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0009DA03
                                    • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0009DA24
                                    • ShowWindow.USER32(00000003,00000000), ref: 0009DA43
                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0009DA68
                                    • DefDlgProcW.USER32(?,00000005,?,?), ref: 0009DA8B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                    • String ID:
                                    • API String ID: 1211466189-0
                                    • Opcode ID: c896ef7d250958b26351ecb4f8dcdcfafa1060ece232704aef33cb5e09f103dd
                                    • Instruction ID: bfae0b92325444de31b8b21a3935fa04f939759756cf91c02921f3a23dec6f43
                                    • Opcode Fuzzy Hash: c896ef7d250958b26351ecb4f8dcdcfafa1060ece232704aef33cb5e09f103dd
                                    • Instruction Fuzzy Hash: 52B18875A40226EBDF14CF69C9C57BD7BF1BF04701F08816AEC489B295DB34A960EB60
                                    Function 00012A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                    Download Yara Rule
                                    APIs
                                    • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0004C417,00000004,00000000,00000000,00000000), ref: 00012ACF
                                    • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0004C417,00000004,00000000,00000000,00000000,000000FF), ref: 00012B17
                                    • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0004C417,00000004,00000000,00000000,00000000), ref: 0004C46A
                                    • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0004C417,00000004,00000000,00000000,00000000), ref: 0004C4D6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ShowWindow
                                    • String ID:
                                    • API String ID: 1268545403-0
                                    • Opcode ID: 63593f77a95952870114407026051311491e823e33d4bd0eb0fc67ad8b87172f
                                    • Instruction ID: b3cf82e98869a9d39ef9424c561b07b3fdcf36479fae1b545d3838e2318d6fff
                                    • Opcode Fuzzy Hash: 63593f77a95952870114407026051311491e823e33d4bd0eb0fc67ad8b87172f
                                    • Instruction Fuzzy Hash: 1F413C312097809BE7B58B288DD8BFF7BD1BF85300F95842EE04786561D639A8E1D722
                                    Function 00077368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • InterlockedExchange.KERNEL32(?,000001F5), ref: 0007737F
                                      • Part of subcall function 00030FF6: std::exception::exception.LIBCMT ref: 0003102C
                                      • Part of subcall function 00030FF6: __CxxThrowException@8.LIBCMT ref: 00031041
                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 000773B6
                                    • EnterCriticalSection.KERNEL32(?), ref: 000773D2
                                    • _memmove.LIBCMT ref: 00077420
                                    • _memmove.LIBCMT ref: 0007743D
                                    • LeaveCriticalSection.KERNEL32(?), ref: 0007744C
                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00077461
                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 00077480
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                    • String ID:
                                    • API String ID: 256516436-0
                                    • Opcode ID: 1d0c3b54346a21c27a3b01c89d2e6e90d1159b92f4b9af65a2252d9bfe7892a4
                                    • Instruction ID: 62385423b9dd85e608535d42443f27b5c6e8a5ba67293cb12a7cc23c2e47bc87
                                    • Opcode Fuzzy Hash: 1d0c3b54346a21c27a3b01c89d2e6e90d1159b92f4b9af65a2252d9bfe7892a4
                                    • Instruction Fuzzy Hash: D8318F31904206EBDF10EF64DD85AAE7BB8FF45710F1481B6F908EB256DB749A10CBA4
                                    Function 00096442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • DeleteObject.GDI32(00000000), ref: 0009645A
                                    • GetDC.USER32(00000000), ref: 00096462
                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0009646D
                                    • ReleaseDC.USER32(00000000,00000000), ref: 00096479
                                    • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 000964B5
                                    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 000964C6
                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00099299,?,?,000000FF,00000000,?,000000FF,?), ref: 00096500
                                    • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00096520
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                    • String ID:
                                    • API String ID: 3864802216-0
                                    • Opcode ID: 712f4ae4256a8ee28c40775a623ff82953e15957d2a2ef82b0b812779db0a86c
                                    • Instruction ID: cd55538f3c6bc69e2fb640a005b1f340595404f5a14090d38149cb2e9530bd91
                                    • Opcode Fuzzy Hash: 712f4ae4256a8ee28c40775a623ff82953e15957d2a2ef82b0b812779db0a86c
                                    • Instruction Fuzzy Hash: D9317A72200610AFEF108F50CC8AFFA3BA9FB09761F040066FE08DA295C6799851CB60
                                    Function 0006C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memcmp
                                    • String ID:
                                    • API String ID: 2931989736-0
                                    • Opcode ID: 6a4ad55a4e58b9fa93383899f976b4ef123e11493f0da2c58fe41b6db9cfcdf0
                                    • Instruction ID: 019b179bd9560f82073a175d57be418d548c20ad7dce6b80209867e1a8e67a96
                                    • Opcode Fuzzy Hash: 6a4ad55a4e58b9fa93383899f976b4ef123e11493f0da2c58fe41b6db9cfcdf0
                                    • Instruction Fuzzy Hash: E821F671600205BBF261A5658D43FFF339EAF163A4F080020FE869A283E761DE1182E5
                                    Function 0007ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                      • Part of subcall function 0002FEC6: _wcscpy.LIBCMT ref: 0002FEE9
                                    • _wcstok.LIBCMT ref: 0007EEFF
                                    • _wcscpy.LIBCMT ref: 0007EF8E
                                    • _memset.LIBCMT ref: 0007EFC1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                    • String ID: X
                                    • API String ID: 774024439-3081909835
                                    • Opcode ID: bc2d51923ee36e53731d56e12aa5629059d49d82fe363b2584f1dc30de1558c3
                                    • Instruction ID: da439844a022833f5cda8e2e953b72755be1d73a6e09c3b94bdca235dd59e1d2
                                    • Opcode Fuzzy Hash: bc2d51923ee36e53731d56e12aa5629059d49d82fe363b2584f1dc30de1558c3
                                    • Instruction Fuzzy Hash: 92C170719083419FC724EF24C895AEEB7E4BF84310F04896DF4999B2A2DB74ED45CB86
                                    Function 00011424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8d8235a82c01808715c7158968817116ed3049b8ade7db50f72783b2e7d4bda9
                                    • Instruction ID: 978c92de5e048fd32e2f33fe122e830b236934bf9d6d5c11f529cbd119324023
                                    • Opcode Fuzzy Hash: 8d8235a82c01808715c7158968817116ed3049b8ade7db50f72783b2e7d4bda9
                                    • Instruction Fuzzy Hash: 3A716C70904109EFDB18CF98CC49AFEBBB9FF85310F148159FA15AB251C734AA91CBA4
                                    Function 00086E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 6a114c979859190dea251af3ea91e0ec8e33e83347fd8a32be0fac166f4e1fc3
                                    • Instruction ID: a96e4bb81c1f1155236be0fb1bdc7f9a52077a1a16112f7407492c3a2a7c7436
                                    • Opcode Fuzzy Hash: 6a114c979859190dea251af3ea91e0ec8e33e83347fd8a32be0fac166f4e1fc3
                                    • Instruction Fuzzy Hash: 6361DE71508300ABD720EB24CC95EAFB7E9BF84714F504919F58A9B2A2DB71DE44CB92
                                    Function 0009B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • IsWindow.USER32(011855F8), ref: 0009B6A5
                                    • IsWindowEnabled.USER32(011855F8), ref: 0009B6B1
                                    • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0009B795
                                    • SendMessageW.USER32(011855F8,000000B0,?,?), ref: 0009B7CC
                                    • IsDlgButtonChecked.USER32(?,?), ref: 0009B809
                                    • GetWindowLongW.USER32(011855F8,000000EC), ref: 0009B82B
                                    • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0009B843
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                    • String ID:
                                    • API String ID: 4072528602-0
                                    • Opcode ID: 8238a94c57123f2932d9cd7d7ed3947e4559ed3cf7427618084e3235599fadf3
                                    • Instruction ID: e7de1a3e23a9f3cddaf25f248adde7198e8972a585cf16aa6a94693e2cf6d180
                                    • Opcode Fuzzy Hash: 8238a94c57123f2932d9cd7d7ed3947e4559ed3cf7427618084e3235599fadf3
                                    • Instruction Fuzzy Hash: FC71B134608304AFEF209F94D9D4FBABBF9FF49320F04416AE95597261C735A950EB20
                                    Function 0008F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 0008F75C
                                    • _memset.LIBCMT ref: 0008F825
                                    • ShellExecuteExW.SHELL32(?), ref: 0008F86A
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                      • Part of subcall function 0002FEC6: _wcscpy.LIBCMT ref: 0002FEE9
                                    • GetProcessId.KERNEL32(00000000), ref: 0008F8E1
                                    • CloseHandle.KERNEL32(00000000), ref: 0008F910
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                    • String ID: @
                                    • API String ID: 3522835683-2766056989
                                    • Opcode ID: 9c2d2ef444594d1b1e1b9cc5d503687e9d2d1ef2e240f249075d9e9c3e43a1fb
                                    • Instruction ID: 9c63793eda7a7453d0e9aa6cec618fc868d24bd153f1c6e76f0045ba1a1cd298
                                    • Opcode Fuzzy Hash: 9c2d2ef444594d1b1e1b9cc5d503687e9d2d1ef2e240f249075d9e9c3e43a1fb
                                    • Instruction Fuzzy Hash: FB617D75A0061ADFCB15EF64C5959EEBBF5FF48310F148469E886AB352CB34AD80CB90
                                    Function 0007145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetParent.USER32(?), ref: 0007149C
                                    • GetKeyboardState.USER32(?), ref: 000714B1
                                    • SetKeyboardState.USER32(?), ref: 00071512
                                    • PostMessageW.USER32(?,00000101,00000010,?), ref: 00071540
                                    • PostMessageW.USER32(?,00000101,00000011,?), ref: 0007155F
                                    • PostMessageW.USER32(?,00000101,00000012,?), ref: 000715A5
                                    • PostMessageW.USER32(?,00000101,0000005B,?), ref: 000715C8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessagePost$KeyboardState$Parent
                                    • String ID:
                                    • API String ID: 87235514-0
                                    • Opcode ID: 3f934afb8e84815565022290ef25c99565bf70d3eb642b93b99aee4dbefd7f34
                                    • Instruction ID: c380863f610974414f879fa246a0ae714a091a027ee7a0334ed20950b18027ab
                                    • Opcode Fuzzy Hash: 3f934afb8e84815565022290ef25c99565bf70d3eb642b93b99aee4dbefd7f34
                                    • Instruction Fuzzy Hash: A051D1B0E047D67EFB3A46288C45BFA7EE96B46304F08C589E5D9598C3C29C9C84D758
                                    Function 00071276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetParent.USER32(00000000), ref: 000712B5
                                    • GetKeyboardState.USER32(?), ref: 000712CA
                                    • SetKeyboardState.USER32(?), ref: 0007132B
                                    • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00071357
                                    • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00071374
                                    • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 000713B8
                                    • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 000713D9
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessagePost$KeyboardState$Parent
                                    • String ID:
                                    • API String ID: 87235514-0
                                    • Opcode ID: 00f6bb9d473c11f58ffc576a1b44936b8c47cd849498229d01b85ebae268ce60
                                    • Instruction ID: 8b5eebab63a81c3a0d37107d3604e2b31ec809bacef9abf74a0ebe78fe246bec
                                    • Opcode Fuzzy Hash: 00f6bb9d473c11f58ffc576a1b44936b8c47cd849498229d01b85ebae268ce60
                                    • Instruction Fuzzy Hash: BB51A3B0E086D53DFB3646288C45BFA7EE96F06300F08C589E1DC5A8C3D299ED94D759
                                    Function 0007589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _wcsncpy$LocalTime
                                    • String ID:
                                    • API String ID: 2945705084-0
                                    • Opcode ID: d7ac62323ba91fca4529f9cbf5ff3d64e2de4acc6eb6604ef5f96699c22f60e9
                                    • Instruction ID: 2095aa5f5bc7432f57be64185035129b89d17adacd8ee2feff88da46ee28f802
                                    • Opcode Fuzzy Hash: d7ac62323ba91fca4529f9cbf5ff3d64e2de4acc6eb6604ef5f96699c22f60e9
                                    • Instruction Fuzzy Hash: 1D418469C20528B6CB12EBB48C8A9CF73BC9F04311F509566F618E3122E634E755C7EA
                                    Function 0006DA5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0006DAC5
                                    • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0006DAFB
                                    • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0006DB0C
                                    • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0006DB8E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorMode$AddressCreateInstanceProc
                                    • String ID: ,,$DllGetClassObject
                                    • API String ID: 753597075-2315376627
                                    • Opcode ID: dbbd5fc0c1f47c7cbcbe9ccc6d60b45937918d91835ece52dd5cd04908052b10
                                    • Instruction ID: 02b358d2df457ebdac1cc43468cd755b100f565b56d3c1a3551e4697074a87c1
                                    • Opcode Fuzzy Hash: dbbd5fc0c1f47c7cbcbe9ccc6d60b45937918d91835ece52dd5cd04908052b10
                                    • Instruction Fuzzy Hash: 9D417171A00209DFDB15CF54C884AAA7BAAEF85350F1580ABAD05DF20AD7B1D940DBA0
                                    Function 000738AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000748AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000738D3,?), ref: 000748C7
                                      • Part of subcall function 000748AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000738D3,?), ref: 000748E0
                                    • lstrcmpiW.KERNEL32(?,?), ref: 000738F3
                                    • _wcscmp.LIBCMT ref: 0007390F
                                    • MoveFileW.KERNEL32(?,?), ref: 00073927
                                    • _wcscat.LIBCMT ref: 0007396F
                                    • SHFileOperationW.SHELL32(?), ref: 000739DB
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                    • String ID: \*.*
                                    • API String ID: 1377345388-1173974218
                                    • Opcode ID: da1eb70b829df74f0e3e225fe13a76c77c0d72c1f484472921db7d0659261c82
                                    • Instruction ID: ea445d259aad296b469861d5e03313175111cdd6b992f87b2dbd49e11abef65a
                                    • Opcode Fuzzy Hash: da1eb70b829df74f0e3e225fe13a76c77c0d72c1f484472921db7d0659261c82
                                    • Instruction Fuzzy Hash: 7B4183729083449ED752EF64C4419EFB7ECAF88340F44492EB589C7152EB78D688C756
                                    Function 00097500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00097519
                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000975C0
                                    • IsMenu.USER32(?), ref: 000975D8
                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00097620
                                    • DrawMenuBar.USER32 ref: 00097633
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Menu$Item$DrawInfoInsert_memset
                                    • String ID: 0
                                    • API String ID: 3866635326-4108050209
                                    • Opcode ID: 442da493fad5ca60f1b053ea2d9a48bc3bc335971c3f0e02ccfa8fe8cfda2118
                                    • Instruction ID: 22b7c6eaead9ba4afc90a0c87e6eb679d668a4e154e7a1e6c90f340141c19a97
                                    • Opcode Fuzzy Hash: 442da493fad5ca60f1b053ea2d9a48bc3bc335971c3f0e02ccfa8fe8cfda2118
                                    • Instruction Fuzzy Hash: 88412A76A15609EFDF20DF54D884EAABBF8FF09310F04812AE91997250D735AD50DFA0
                                    Function 0009122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0009125C
                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00091286
                                    • FreeLibrary.KERNEL32(00000000), ref: 0009133D
                                      • Part of subcall function 0009122D: RegCloseKey.ADVAPI32(?), ref: 000912A3
                                      • Part of subcall function 0009122D: FreeLibrary.KERNEL32(?), ref: 000912F5
                                      • Part of subcall function 0009122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00091318
                                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 000912E0
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: EnumFreeLibrary$CloseDeleteOpen
                                    • String ID:
                                    • API String ID: 395352322-0
                                    • Opcode ID: 67ca15be7309b7f34624049301798c869232a1db27fe0ded492d8ddd2f7b0b7c
                                    • Instruction ID: ede9774aeb8bebce9f18520176d6661f98f95bcaca2708d4d63b626a2470a7bf
                                    • Opcode Fuzzy Hash: 67ca15be7309b7f34624049301798c869232a1db27fe0ded492d8ddd2f7b0b7c
                                    • Instruction Fuzzy Hash: B4310D71A0111ABFEF159B90DC89AFEB7BCEF08340F00416AE511E2151DA749F55AAA0
                                    Function 0009653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0009655B
                                    • GetWindowLongW.USER32(011855F8,000000F0), ref: 0009658E
                                    • GetWindowLongW.USER32(011855F8,000000F0), ref: 000965C3
                                    • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 000965F5
                                    • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0009661F
                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 00096630
                                    • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0009664A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: LongWindow$MessageSend
                                    • String ID:
                                    • API String ID: 2178440468-0
                                    • Opcode ID: 36ee8b5de732cdd5dbee1d052bf866cd71a02f67fc0a3df4daa26535a3e897b0
                                    • Instruction ID: a37c2bdc630b7a9459e06a3356181190b7fb0ac0730092ec74919a70798157ab
                                    • Opcode Fuzzy Hash: 36ee8b5de732cdd5dbee1d052bf866cd71a02f67fc0a3df4daa26535a3e897b0
                                    • Instruction Fuzzy Hash: 9C31F230604251AFEF218F58DC95F653BE1FB4A750F1A02A9F911CB2B6CB66A840EB51
                                    Function 00086486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000880A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000880CB
                                    • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 000864D9
                                    • WSAGetLastError.WSOCK32(00000000), ref: 000864E8
                                    • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00086521
                                    • connect.WSOCK32(00000000,?,00000010), ref: 0008652A
                                    • WSAGetLastError.WSOCK32 ref: 00086534
                                    • closesocket.WSOCK32(00000000), ref: 0008655D
                                    • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00086576
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                    • String ID:
                                    • API String ID: 910771015-0
                                    • Opcode ID: 0d0b94b7263cff1cf78345f69398e99c09259686a672dcb6353e5256004f739e
                                    • Instruction ID: 3f0fd4f822126082688468175ffaf5f3b68c2e15e16458462936c0bb92931b95
                                    • Opcode Fuzzy Hash: 0d0b94b7263cff1cf78345f69398e99c09259686a672dcb6353e5256004f739e
                                    • Instruction Fuzzy Hash: D8318F31600218ABEB10AF64CC85BFE7BA9FF44714F058069F986D7291DF75AD48CBA1
                                    Function 0006E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0006E0FA
                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0006E120
                                    • SysAllocString.OLEAUT32(00000000), ref: 0006E123
                                    • SysAllocString.OLEAUT32 ref: 0006E144
                                    • SysFreeString.OLEAUT32 ref: 0006E14D
                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 0006E167
                                    • SysAllocString.OLEAUT32(?), ref: 0006E175
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                    • String ID:
                                    • API String ID: 3761583154-0
                                    • Opcode ID: 374e4d592f5f4b48be09f616b17b5ed2bdb0ea42fa28d030d6abeeb78e80f55b
                                    • Instruction ID: 2bd399ee7ad07dd2851cdd1f8a9c42dd0d8628321824327ae404d5238a70d8cc
                                    • Opcode Fuzzy Hash: 374e4d592f5f4b48be09f616b17b5ed2bdb0ea42fa28d030d6abeeb78e80f55b
                                    • Instruction Fuzzy Hash: 35218635604209AFEB10AFA8DC88CBB77EDFB09760B108136F915CB261DA74DC419B64
                                    Function 0006FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __wcsnicmp
                                    • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                    • API String ID: 1038674560-2734436370
                                    • Opcode ID: 7d15b7cf5c784c333f16bc37eee474b61adc5dc9431f1b334b27f626e0d82cc5
                                    • Instruction ID: eab16184d55facd9494ebb8229c5c3c10bee195dfa6e6d366496e65f30354c70
                                    • Opcode Fuzzy Hash: 7d15b7cf5c784c333f16bc37eee474b61adc5dc9431f1b334b27f626e0d82cc5
                                    • Instruction Fuzzy Hash: 99214932204652A6D335E634FE12EFB73DDEF56350F148036F98687143EB91AD81D291
                                    Function 0009783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00011D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00011D73
                                      • Part of subcall function 00011D35: GetStockObject.GDI32(00000011), ref: 00011D87
                                      • Part of subcall function 00011D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00011D91
                                    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 000978A1
                                    • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 000978AE
                                    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 000978B9
                                    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 000978C8
                                    • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 000978D4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$CreateObjectStockWindow
                                    • String ID: Msctls_Progress32
                                    • API String ID: 1025951953-3636473452
                                    • Opcode ID: 833fe3cd66b6ffb85610f9560b6002eddebaf2f130d30e957cc5b3914225f574
                                    • Instruction ID: c5a75375ab54782e0d0d1b7a161a5e2c4fe32badb222aed3ee752255623a46a7
                                    • Opcode Fuzzy Hash: 833fe3cd66b6ffb85610f9560b6002eddebaf2f130d30e957cc5b3914225f574
                                    • Instruction Fuzzy Hash: C71193B2154219BFEF159F60CC85EEB7F5DEF08758F014115BA08A6090CB729C21DBA0
                                    Function 000341C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00034292,?), ref: 000341E3
                                    • GetProcAddress.KERNEL32(00000000), ref: 000341EA
                                    • EncodePointer.KERNEL32(00000000), ref: 000341F6
                                    • DecodePointer.KERNEL32(00000001,00034292,?), ref: 00034213
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                    • String ID: RoInitialize$combase.dll
                                    • API String ID: 3489934621-340411864
                                    • Opcode ID: 9f9b07a9030352b79493b4862dbb5475641f2586f0ab267e57193213d1022ad4
                                    • Instruction ID: 4afb40bfba44250b98a42b1d0b86a413153fd14c9b72eedc8f87465c51049816
                                    • Opcode Fuzzy Hash: 9f9b07a9030352b79493b4862dbb5475641f2586f0ab267e57193213d1022ad4
                                    • Instruction Fuzzy Hash: 1EE01AB8A92301AFFB606BB4EC09B243BA8B721706F508436B911E90A0DBBD50958F10
                                    Function 0003429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,000341B8), ref: 000342B8
                                    • GetProcAddress.KERNEL32(00000000), ref: 000342BF
                                    • EncodePointer.KERNEL32(00000000), ref: 000342CA
                                    • DecodePointer.KERNEL32(000341B8), ref: 000342E5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                    • String ID: RoUninitialize$combase.dll
                                    • API String ID: 3489934621-2819208100
                                    • Opcode ID: 886a65b9fb159aed0f8336bd0e3c30b3bcb249c245d23a1758eebd4336961fef
                                    • Instruction ID: bb01ac0bc0785547fc6c0f4941371171c43cdef64d841a3990e04c1b694c2df4
                                    • Opcode Fuzzy Hash: 886a65b9fb159aed0f8336bd0e3c30b3bcb249c245d23a1758eebd4336961fef
                                    • Instruction Fuzzy Hash: 9BE0B67C582312ABFB509B64ED0DB153BA8B725742F504036F911F90A0CBBC9580CA24
                                    Function 0007675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memmove$__itow__swprintf
                                    • String ID:
                                    • API String ID: 3253778849-0
                                    • Opcode ID: 9878d26070b011936cad77e1676243b9e2a31e5d9705435f175891a5af6f413f
                                    • Instruction ID: c070f90910bc99d9dc1550600908e74e516719186a2768ea3abf0c3cb92c863f
                                    • Opcode Fuzzy Hash: 9878d26070b011936cad77e1676243b9e2a31e5d9705435f175891a5af6f413f
                                    • Instruction Fuzzy Hash: 7F61143090465A9BCF16EF20CC92EFE37A8AF08308F048519F95A5B293DF39AC41CB51
                                    Function 0009046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 000910A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00090038,?,?), ref: 000910BC
                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00090548
                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00090588
                                    • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 000905AB
                                    • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 000905D4
                                    • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00090617
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00090624
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                    • String ID:
                                    • API String ID: 4046560759-0
                                    • Opcode ID: e655e0506c6d390946480cd52ba37360b5aa62deb8a9963a7bbf1386ecba7b6a
                                    • Instruction ID: 4d2709b724e6846b7395ef537f1ad6bbc5013eb4dee91eab65b828935e0d04e1
                                    • Opcode Fuzzy Hash: e655e0506c6d390946480cd52ba37360b5aa62deb8a9963a7bbf1386ecba7b6a
                                    • Instruction Fuzzy Hash: A5515A31208201AFDB14EF64C885EAFBBE9FF88714F04492DF595872A2DB31E944DB52
                                    Function 00095A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetMenu.USER32(?), ref: 00095A82
                                    • GetMenuItemCount.USER32(00000000), ref: 00095AB9
                                    • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00095AE1
                                    • GetMenuItemID.USER32(?,?), ref: 00095B50
                                    • GetSubMenu.USER32(?,?), ref: 00095B5E
                                    • PostMessageW.USER32(?,00000111,?,00000000), ref: 00095BAF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Menu$Item$CountMessagePostString
                                    • String ID:
                                    • API String ID: 650687236-0
                                    • Opcode ID: a25963388e3ee7a702b7766d7ad7cc4b5794e5d5d711053995e39f9288082c43
                                    • Instruction ID: d8fd2ff5da53383124e78156e0f4fb02d5d22afc65a8341f9b5dac9209eb7fc3
                                    • Opcode Fuzzy Hash: a25963388e3ee7a702b7766d7ad7cc4b5794e5d5d711053995e39f9288082c43
                                    • Instruction Fuzzy Hash: FE519C31A00615AFDF12EFA5CC45AEEB7B4EF48321F10406AE905BB352CB74AE419B95
                                    Function 0006F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                    Download Yara Rule
                                    APIs
                                    • VariantInit.OLEAUT32(?), ref: 0006F3F7
                                    • VariantClear.OLEAUT32(00000013), ref: 0006F469
                                    • VariantClear.OLEAUT32(00000000), ref: 0006F4C4
                                    • _memmove.LIBCMT ref: 0006F4EE
                                    • VariantClear.OLEAUT32(?), ref: 0006F53B
                                    • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0006F569
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Variant$Clear$ChangeInitType_memmove
                                    • String ID:
                                    • API String ID: 1101466143-0
                                    • Opcode ID: db956980c6983b0ebef495295900b833d52563eb407fc2081fbb38c884546e99
                                    • Instruction ID: 6a398daa0cc1d8b61bd4e72838ffb14c42c687511a60faef98c3a650b765efb0
                                    • Opcode Fuzzy Hash: db956980c6983b0ebef495295900b833d52563eb407fc2081fbb38c884546e99
                                    • Instruction Fuzzy Hash: E7516CB5A0020ADFDB14CF58D884AAAB7F9FF4C354B15816AE959DB310D730E911CBA0
                                    Function 000726F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00072747
                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00072792
                                    • IsMenu.USER32(00000000), ref: 000727B2
                                    • CreatePopupMenu.USER32 ref: 000727E6
                                    • GetMenuItemCount.USER32(000000FF), ref: 00072844
                                    • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00072875
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                    • String ID:
                                    • API String ID: 3311875123-0
                                    • Opcode ID: 81bf6697c629fcc6f14173678ac607198ba43a09a621c30580579ddc41a63c0f
                                    • Instruction ID: d7f3c7bcb7367222757c674335b9f0c4f486b98ef0ba5a31a68060508783d8a1
                                    • Opcode Fuzzy Hash: 81bf6697c629fcc6f14173678ac607198ba43a09a621c30580579ddc41a63c0f
                                    • Instruction Fuzzy Hash: 4851B070E01206DBDF64CF68C988BAEBBF4BF04314F108269E4199B291DB7A9944CB56
                                    Function 00011765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • BeginPaint.USER32(?,?,?,?,?,?), ref: 0001179A
                                    • GetWindowRect.USER32(?,?), ref: 000117FE
                                    • ScreenToClient.USER32(?,?), ref: 0001181B
                                    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0001182C
                                    • EndPaint.USER32(?,?), ref: 00011876
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                    • String ID:
                                    • API String ID: 1827037458-0
                                    • Opcode ID: fc4e0cedd55267551a074c89cfcae49c984076a33f9e215a8737cb76c827ce0a
                                    • Instruction ID: 34d39f3b191dcbfa1673714b245099243284ba23e758a781903bf8cd14fb0f8b
                                    • Opcode Fuzzy Hash: fc4e0cedd55267551a074c89cfcae49c984076a33f9e215a8737cb76c827ce0a
                                    • Instruction Fuzzy Hash: 02416F715043019FE710DF24C884BFA7BF8FB49724F144669FAA4862A2CB759885DB62
                                    Function 0009B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • ShowWindow.USER32(000D67B0,00000000,011855F8,?,?,000D67B0,?,0009B862,?,?), ref: 0009B9CC
                                    • EnableWindow.USER32(00000000,00000000), ref: 0009B9F0
                                    • ShowWindow.USER32(000D67B0,00000000,011855F8,?,?,000D67B0,?,0009B862,?,?), ref: 0009BA50
                                    • ShowWindow.USER32(00000000,00000004,?,0009B862,?,?), ref: 0009BA62
                                    • EnableWindow.USER32(00000000,00000001), ref: 0009BA86
                                    • SendMessageW.USER32(?,0000130C,?,00000000), ref: 0009BAA9
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$Show$Enable$MessageSend
                                    • String ID:
                                    • API String ID: 642888154-0
                                    • Opcode ID: fa9a35112ce86356d41ee1fc6e4e79da1225aeee15cdf1e669acd033eeb80df7
                                    • Instruction ID: ebb82a773b25fb2c9f9c20270755fa1a0056ac5a3ce9a0cf11d33e836b3700c9
                                    • Opcode Fuzzy Hash: fa9a35112ce86356d41ee1fc6e4e79da1225aeee15cdf1e669acd033eeb80df7
                                    • Instruction Fuzzy Hash: F4415030604241AFDF61CF58E689BA57BE0BB05320F1842B9FA48CF2A2C735AC45DB51
                                    Function 000873B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetForegroundWindow.USER32(?,?,?,?,?,?,00085134,?,?,00000000,00000001), ref: 000873BF
                                      • Part of subcall function 00083C94: GetWindowRect.USER32(?,?), ref: 00083CA7
                                    • GetDesktopWindow.USER32 ref: 000873E9
                                    • GetWindowRect.USER32(00000000), ref: 000873F0
                                    • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00087422
                                      • Part of subcall function 000754E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0007555E
                                    • GetCursorPos.USER32(?), ref: 0008744E
                                    • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 000874AC
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                    • String ID:
                                    • API String ID: 4137160315-0
                                    • Opcode ID: 6bbed015baec898587cc857e016d3af63d4b8ce0c58bc955a99fed9ea78d39ce
                                    • Instruction ID: 7c25445112faa1d15d1425a31a40d08b51655c58784e9c515b6e771c63953944
                                    • Opcode Fuzzy Hash: 6bbed015baec898587cc857e016d3af63d4b8ce0c58bc955a99fed9ea78d39ce
                                    • Instruction Fuzzy Hash: AB31C172509306ABD720EF54D849FAABBE9FB88314F10491AF58897191C774E9488B92
                                    Function 00068D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000685F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00068608
                                      • Part of subcall function 000685F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00068612
                                      • Part of subcall function 000685F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00068621
                                      • Part of subcall function 000685F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00068628
                                      • Part of subcall function 000685F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0006863E
                                    • GetLengthSid.ADVAPI32(?,00000000,00068977), ref: 00068DAC
                                    • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00068DB8
                                    • HeapAlloc.KERNEL32(00000000), ref: 00068DBF
                                    • CopySid.ADVAPI32(00000000,00000000,?), ref: 00068DD8
                                    • GetProcessHeap.KERNEL32(00000000,00000000,00068977), ref: 00068DEC
                                    • HeapFree.KERNEL32(00000000), ref: 00068DF3
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                    • String ID:
                                    • API String ID: 3008561057-0
                                    • Opcode ID: 2447cf4862cb8f4e07a82ccbb08834b4621d4805ce1457792d9d0ca5ed4d56ea
                                    • Instruction ID: 1ebe62a7420ce6de08d60f4f647b2ee5aece6eca3ea125c7eff36b952958b916
                                    • Opcode Fuzzy Hash: 2447cf4862cb8f4e07a82ccbb08834b4621d4805ce1457792d9d0ca5ed4d56ea
                                    • Instruction Fuzzy Hash: 3F11BE71500606FFEB649FA4CC09BBE7BAAFF55315F10822AF945D7250DB369900CBA0
                                    Function 00068AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00068B2A
                                    • OpenProcessToken.ADVAPI32(00000000), ref: 00068B31
                                    • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00068B40
                                    • CloseHandle.KERNEL32(00000004), ref: 00068B4B
                                    • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00068B7A
                                    • DestroyEnvironmentBlock.USERENV(00000000), ref: 00068B8E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                    • String ID:
                                    • API String ID: 1413079979-0
                                    • Opcode ID: fa098ab32c3fe925ccd73c892e9a0083502c127c948dbb48c1cc50b27a8f792f
                                    • Instruction ID: abbd0afb6dc713d5b0ba35e6df06568ddeeaf3327b684c99a64dd4408e1fb1a7
                                    • Opcode Fuzzy Hash: fa098ab32c3fe925ccd73c892e9a0083502c127c948dbb48c1cc50b27a8f792f
                                    • Instruction Fuzzy Hash: 68115CB250020AABEF118FA4DD49FEE7BA9FF48304F049165FE04E2160C7758D649B60
                                    Function 0009C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000112F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0001134D
                                      • Part of subcall function 000112F3: SelectObject.GDI32(?,00000000), ref: 0001135C
                                      • Part of subcall function 000112F3: BeginPath.GDI32(?), ref: 00011373
                                      • Part of subcall function 000112F3: SelectObject.GDI32(?,00000000), ref: 0001139C
                                    • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0009C1C4
                                    • LineTo.GDI32(00000000,00000003,?), ref: 0009C1D8
                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0009C1E6
                                    • LineTo.GDI32(00000000,00000000,?), ref: 0009C1F6
                                    • EndPath.GDI32(00000000), ref: 0009C206
                                    • StrokePath.GDI32(00000000), ref: 0009C216
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                    • String ID:
                                    • API String ID: 43455801-0
                                    • Opcode ID: 7d8ff62a89623eff9dc45768e483b8586f9b596cbc9cc7d5ea54baa8d4492cab
                                    • Instruction ID: fddf1229e1521d29b5eb0594c5e102b85088ae4d6a9f9f1e55abdab42b197608
                                    • Opcode Fuzzy Hash: 7d8ff62a89623eff9dc45768e483b8586f9b596cbc9cc7d5ea54baa8d4492cab
                                    • Instruction Fuzzy Hash: D1111B7640410DBFEF119F90DC88EEA7FADFB08354F048022FA188A1A1C7769D95DBA0
                                    Function 000303A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                    Download Yara Rule
                                    APIs
                                    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 000303D3
                                    • MapVirtualKeyW.USER32(00000010,00000000), ref: 000303DB
                                    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 000303E6
                                    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 000303F1
                                    • MapVirtualKeyW.USER32(00000011,00000000), ref: 000303F9
                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00030401
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Virtual
                                    • String ID:
                                    • API String ID: 4278518827-0
                                    • Opcode ID: 0dad2e6babf611f86d07ede125af8e7ea89941ced11d57517100bf17d7530e7e
                                    • Instruction ID: f2e52019e6262531d90098d08bdecd7fff68bc71b59485ae70c5de1303e18bcc
                                    • Opcode Fuzzy Hash: 0dad2e6babf611f86d07ede125af8e7ea89941ced11d57517100bf17d7530e7e
                                    • Instruction Fuzzy Hash: E5016CB090175A7DE3008F5A8C85B52FFB8FF19354F00411BA15C87941C7F5A864CBE5
                                    Function 0007568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0007569B
                                    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 000756B1
                                    • GetWindowThreadProcessId.USER32(?,?), ref: 000756C0
                                    • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000756CF
                                    • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000756D9
                                    • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000756E0
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                    • String ID:
                                    • API String ID: 839392675-0
                                    • Opcode ID: 58abb68b0da34e03c28b140a7b53e30af9d32fa652ed8268ec3067907d8f349f
                                    • Instruction ID: 7e27f551eb72d4a94c318f3dd5f42226baaba39058b61d4d3862b96d9dbc8877
                                    • Opcode Fuzzy Hash: 58abb68b0da34e03c28b140a7b53e30af9d32fa652ed8268ec3067907d8f349f
                                    • Instruction Fuzzy Hash: 03F01D3264125ABBE7215BA29C0EEFF7A7CFBC6B11F00016AFA04D105096A91A0186B5
                                    Function 000774D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • InterlockedExchange.KERNEL32(?,?), ref: 000774E5
                                    • EnterCriticalSection.KERNEL32(?,?,00021044,?,?), ref: 000774F6
                                    • TerminateThread.KERNEL32(00000000,000001F6,?,00021044,?,?), ref: 00077503
                                    • WaitForSingleObject.KERNEL32(00000000,000003E8,?,00021044,?,?), ref: 00077510
                                      • Part of subcall function 00076ED7: CloseHandle.KERNEL32(00000000,?,0007751D,?,00021044,?,?), ref: 00076EE1
                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 00077523
                                    • LeaveCriticalSection.KERNEL32(?,?,00021044,?,?), ref: 0007752A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                    • String ID:
                                    • API String ID: 3495660284-0
                                    • Opcode ID: 76ada328c5a9f7cc6f8ed262365173b79c20647a2ae6423998b217541c99526d
                                    • Instruction ID: e924e20903b58e52196ddab0d99b9915d8b4a819ad46b68d44fc042e055112c9
                                    • Opcode Fuzzy Hash: 76ada328c5a9f7cc6f8ed262365173b79c20647a2ae6423998b217541c99526d
                                    • Instruction Fuzzy Hash: B6F0303A540613ABE7112B64EC48AEA7769BF45342B100533F106D10A1CB795811CB50
                                    Function 00068E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                    Download Yara Rule
                                    APIs
                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00068E7F
                                    • UnloadUserProfile.USERENV(?,?), ref: 00068E8B
                                    • CloseHandle.KERNEL32(?), ref: 00068E94
                                    • CloseHandle.KERNEL32(?), ref: 00068E9C
                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00068EA5
                                    • HeapFree.KERNEL32(00000000), ref: 00068EAC
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                    • String ID:
                                    • API String ID: 146765662-0
                                    • Opcode ID: 94bc87e86cc2a26b1567ad8ad64264ff5bfd6921f064a44888d9b142fccb47ef
                                    • Instruction ID: 747743ec5065183c2ccf67ba60c648e933fd9f589c1e1a69fa7ca146ab0fd2ad
                                    • Opcode Fuzzy Hash: 94bc87e86cc2a26b1567ad8ad64264ff5bfd6921f064a44888d9b142fccb47ef
                                    • Instruction Fuzzy Hash: 17E05276104506FBEA012FF5EC0C96ABB69FB89762B608632F219C1470CB3A9461DB90
                                    Function 00067A78 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON
                                    Download Yara Rule
                                    APIs
                                    • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,000A2C7C,?), ref: 00067C32
                                    • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,000A2C7C,?), ref: 00067C4A
                                    • CLSIDFromProgID.OLE32(?,?,00000000,0009FB80,000000FF,?,00000000,00000800,00000000,?,000A2C7C,?), ref: 00067C6F
                                    • _memcmp.LIBCMT ref: 00067C90
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FromProg$FreeTask_memcmp
                                    • String ID: ,,
                                    • API String ID: 314563124-401794086
                                    • Opcode ID: edc6590e6ebb6b2ef4026e8aeec159bb3f43c8aeb61eba9ec17442191ff57fb8
                                    • Instruction ID: eaa0a5b0a03e623d41570c31bd75c86e825bdf65601a8a79edfa1fc6b80d06ae
                                    • Opcode Fuzzy Hash: edc6590e6ebb6b2ef4026e8aeec159bb3f43c8aeb61eba9ec17442191ff57fb8
                                    • Instruction Fuzzy Hash: BF810B75A00109EFCB04DF94C984EEEB7BAFF89315F204198E516EB250DB71AE46CB61
                                    Function 00088902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                    Download Yara Rule
                                    APIs
                                    • VariantInit.OLEAUT32(?), ref: 00088928
                                    • CharUpperBuffW.USER32(?,?), ref: 00088A37
                                    • VariantClear.OLEAUT32(?), ref: 00088BAF
                                      • Part of subcall function 00077804: VariantInit.OLEAUT32(00000000), ref: 00077844
                                      • Part of subcall function 00077804: VariantCopy.OLEAUT32(00000000,?), ref: 0007784D
                                      • Part of subcall function 00077804: VariantClear.OLEAUT32(00000000), ref: 00077859
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Variant$ClearInit$BuffCharCopyUpper
                                    • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                    • API String ID: 4237274167-1221869570
                                    • Opcode ID: 4bae8e9f6618ce6075cf09d5673e526495d1e2188d9cd3881604be61f7de4fc8
                                    • Instruction ID: 8d4f0d3887fccca5210913c878949a57cf8a5f306980557ae8cf62902bfa6b9b
                                    • Opcode Fuzzy Hash: 4bae8e9f6618ce6075cf09d5673e526495d1e2188d9cd3881604be61f7de4fc8
                                    • Instruction Fuzzy Hash: 01916D716083019FC714EF24C4849AABBE4FFC9354F44896EF89A8B362DB31E945CB52
                                    Function 00072F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0002FEC6: _wcscpy.LIBCMT ref: 0002FEE9
                                    • _memset.LIBCMT ref: 00073077
                                    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000730A6
                                    • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00073159
                                    • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00073187
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ItemMenu$Info$Default_memset_wcscpy
                                    • String ID: 0
                                    • API String ID: 4152858687-4108050209
                                    • Opcode ID: cd0123e1988396573382acfdef177cd5d3e90874874a63cef45588c9908c0699
                                    • Instruction ID: 0ce6b92ffbbfd3c6850542f6b2edd855a12e518417827684a40b7de8e55c2d28
                                    • Opcode Fuzzy Hash: cd0123e1988396573382acfdef177cd5d3e90874874a63cef45588c9908c0699
                                    • Instruction Fuzzy Hash: 12512771A083419FE7659F28C8456ABB7E8EF44310F04862EF889D3191DB78DE44E79A
                                    Function 00072C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00072CAF
                                    • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00072CCB
                                    • DeleteMenu.USER32(?,00000007,00000000), ref: 00072D11
                                    • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,000D6890,00000000), ref: 00072D5A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Menu$Delete$InfoItem_memset
                                    • String ID: 0
                                    • API String ID: 1173514356-4108050209
                                    • Opcode ID: 62f7d12be85a3a792a48a40fc2d1eb0551b1df72e0d90da16373226baecc758b
                                    • Instruction ID: 2b2233aaefca2e067ceb6096f6c3352f89eec78ee36420cb30d65f36d5de9de9
                                    • Opcode Fuzzy Hash: 62f7d12be85a3a792a48a40fc2d1eb0551b1df72e0d90da16373226baecc758b
                                    • Instruction Fuzzy Hash: 1941A0306043429FD720DF24C844B5BBBE8FF85320F14862EF96997292DB78E904CB96
                                    Function 0008DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                    Download Yara Rule
                                    APIs
                                    • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0008DAD9
                                      • Part of subcall function 000179AB: _memmove.LIBCMT ref: 000179F9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharLower_memmove
                                    • String ID: cdecl$none$stdcall$winapi
                                    • API String ID: 3425801089-567219261
                                    • Opcode ID: 28112d5a690827d9c6c1a4ddd2ba161d078d7cfba92f63c5f0fa660ee8734200
                                    • Instruction ID: cce627a9aa32bc85e049e61a63835fecec08ea44044a9f3d06da1b7871e94609
                                    • Opcode Fuzzy Hash: 28112d5a690827d9c6c1a4ddd2ba161d078d7cfba92f63c5f0fa660ee8734200
                                    • Instruction Fuzzy Hash: B7315E7050461AEBCF10EF54CC919EEB3F9FF55310B108A2AE865AB6D2DB71A945CB80
                                    Function 00069372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 0006B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0006B0E7
                                    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 000693F6
                                    • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00069409
                                    • SendMessageW.USER32(?,00000189,?,00000000), ref: 00069439
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$_memmove$ClassName
                                    • String ID: ComboBox$ListBox
                                    • API String ID: 365058703-1403004172
                                    • Opcode ID: 1ab848e6d7d068ef07c2fe5527a3d368fee1408fe2bbe192131a1c1a169fd3dd
                                    • Instruction ID: 594abab72c6c6e23e42a45396a70bb5e1e0193138460967368bf6ab66030c2c2
                                    • Opcode Fuzzy Hash: 1ab848e6d7d068ef07c2fe5527a3d368fee1408fe2bbe192131a1c1a169fd3dd
                                    • Instruction Fuzzy Hash: 39210571A00108BFDB14ABB0DC85DFFBBBDDF45360B144129F926972E2DF350A4A9620
                                    Function 00081B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00081B40
                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00081B66
                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00081B96
                                    • InternetCloseHandle.WININET(00000000), ref: 00081BDD
                                      • Part of subcall function 00082777: GetLastError.KERNEL32(?,?,00081B0B,00000000,00000000,00000001), ref: 0008278C
                                      • Part of subcall function 00082777: SetEvent.KERNEL32(?,?,00081B0B,00000000,00000000,00000001), ref: 000827A1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                    • String ID:
                                    • API String ID: 3113390036-3916222277
                                    • Opcode ID: f43086efa090bee0a0c72cadf76c5c912daf62e7a615a2b610428b91cb399ba7
                                    • Instruction ID: 5a18e25366f54ea3ad3927d6f5a0d95cda827e9010ab6dde5f85574ff080bb57
                                    • Opcode Fuzzy Hash: f43086efa090bee0a0c72cadf76c5c912daf62e7a615a2b610428b91cb399ba7
                                    • Instruction Fuzzy Hash: CE218BB1604208BFEB21AF619CC5EFF76ECFF49744F10412AF585E6240EB649D0697A1
                                    Function 00096656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00011D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00011D73
                                      • Part of subcall function 00011D35: GetStockObject.GDI32(00000011), ref: 00011D87
                                      • Part of subcall function 00011D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00011D91
                                    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 000966D0
                                    • LoadLibraryW.KERNEL32(?), ref: 000966D7
                                    • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 000966EC
                                    • DestroyWindow.USER32(?), ref: 000966F4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                    • String ID: SysAnimate32
                                    • API String ID: 4146253029-1011021900
                                    • Opcode ID: 0fda954e8e1080ee7bf79d4c0ee9775b85a23f16690051d059615271332d28a1
                                    • Instruction ID: 56f5a95ec712b55ae5eeed68f44f5da716a2756cf3c1b20201776ded9f1a0418
                                    • Opcode Fuzzy Hash: 0fda954e8e1080ee7bf79d4c0ee9775b85a23f16690051d059615271332d28a1
                                    • Instruction Fuzzy Hash: 05216D71204206ABEF104FA4EC81EBB77EDFB59368F10462AFA51D6190D772DC51A760
                                    Function 0007703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetStdHandle.KERNEL32(0000000C), ref: 0007705E
                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00077091
                                    • GetStdHandle.KERNEL32(0000000C), ref: 000770A3
                                    • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 000770DD
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateHandle$FilePipe
                                    • String ID: nul
                                    • API String ID: 4209266947-2873401336
                                    • Opcode ID: 704e20dfa2bf18122c4fb1a1bbbcf262a2df725f2fa781524e377239799925d5
                                    • Instruction ID: 29beeb88b81649cdb89b5a49fa9d14b34f503ac924055a10c9d6fa7ee12cb645
                                    • Opcode Fuzzy Hash: 704e20dfa2bf18122c4fb1a1bbbcf262a2df725f2fa781524e377239799925d5
                                    • Instruction Fuzzy Hash: FB215374A04209DBDF209F38DC05BAA77E4BF44760F20862AFDA9D72D0D775A850CBA4
                                    Function 0007710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetStdHandle.KERNEL32(000000F6), ref: 0007712B
                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0007715D
                                    • GetStdHandle.KERNEL32(000000F6), ref: 0007716E
                                    • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 000771A8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateHandle$FilePipe
                                    • String ID: nul
                                    • API String ID: 4209266947-2873401336
                                    • Opcode ID: e4ae61d85bb047fa9b13ee380e154af2ccc02dfc8c4d5208e88af798eb7c018f
                                    • Instruction ID: f99acb9d931c75af497b1be866b409e97758c51af056ba2765e19cb510664f63
                                    • Opcode Fuzzy Hash: e4ae61d85bb047fa9b13ee380e154af2ccc02dfc8c4d5208e88af798eb7c018f
                                    • Instruction Fuzzy Hash: 4221D671A043069BDF209F2C9C04AA977E8BF45370F608619FDA9D32D0D774A841CB58
                                    Function 0007AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                    Download Yara Rule
                                    APIs
                                    • SetErrorMode.KERNEL32(00000001), ref: 0007AEBF
                                    • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0007AF13
                                    • __swprintf.LIBCMT ref: 0007AF2C
                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000,0009F910), ref: 0007AF6A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorMode$InformationVolume__swprintf
                                    • String ID: %lu
                                    • API String ID: 3164766367-685833217
                                    • Opcode ID: f4b49c447ca37181480bf4fbd3c6881c3109fbd158e020958991b28042916f6e
                                    • Instruction ID: 82bafb052d20a7f32e883b6d4c9fd5bc6996bb5d612b28560ad239151cd813f8
                                    • Opcode Fuzzy Hash: f4b49c447ca37181480bf4fbd3c6881c3109fbd158e020958991b28042916f6e
                                    • Instruction Fuzzy Hash: BD214470A00109AFDB10DF54CD85DEE77B8EF89704B104069F909DB252DB35EA45CB61
                                    Function 0006A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                      • Part of subcall function 0006A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0006A399
                                      • Part of subcall function 0006A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0006A3AC
                                      • Part of subcall function 0006A37C: GetCurrentThreadId.KERNEL32 ref: 0006A3B3
                                      • Part of subcall function 0006A37C: AttachThreadInput.USER32(00000000), ref: 0006A3BA
                                    • GetFocus.USER32 ref: 0006A554
                                      • Part of subcall function 0006A3C5: GetParent.USER32(?), ref: 0006A3D3
                                    • GetClassNameW.USER32(?,?,00000100), ref: 0006A59D
                                    • EnumChildWindows.USER32(?,0006A615), ref: 0006A5C5
                                    • __swprintf.LIBCMT ref: 0006A5DF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
                                    • String ID: %s%d
                                    • API String ID: 1941087503-1110647743
                                    • Opcode ID: 3e7b2629d481aaacc87e1498a3c56020d55d6691d0e83259f33bf3647aab8759
                                    • Instruction ID: a80fce00dd3889d6a69cfbdf5a7c5e2daf5e3a9695a8c41658f9fcf728a20884
                                    • Opcode Fuzzy Hash: 3e7b2629d481aaacc87e1498a3c56020d55d6691d0e83259f33bf3647aab8759
                                    • Instruction Fuzzy Hash: 4111A2713002096BDF117FA4DC85FEA77B9AF49700F044075BA08AA193CA705A458F75
                                    Function 00072017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                    Download Yara Rule
                                    APIs
                                    • CharUpperBuffW.USER32(?,?), ref: 00072048
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharUpper
                                    • String ID: APPEND$EXISTS$KEYS$REMOVE
                                    • API String ID: 3964851224-769500911
                                    • Opcode ID: cdafcdf931505232e5781364b99573e561f2e2d1c871743640e335a21e1c8fe7
                                    • Instruction ID: 8565f2cbd8d1c5eb8716e6e65152d4ce64eca8a3e9a9117b8c770cb89aaf4ffe
                                    • Opcode Fuzzy Hash: cdafcdf931505232e5781364b99573e561f2e2d1c871743640e335a21e1c8fe7
                                    • Instruction Fuzzy Hash: 7A115B34940109CFCF00EFA4D8519EEB7F8FF16308F548869D899A7253EB366946CBA0
                                    Function 0008EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                    Download Yara Rule
                                    APIs
                                    • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0008EF1B
                                    • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0008EF4B
                                    • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0008F07E
                                    • CloseHandle.KERNEL32(?), ref: 0008F0FF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                    • String ID:
                                    • API String ID: 2364364464-0
                                    • Opcode ID: eeb8cecf6a02fb759e3e41db648b117ae5def5e06fb7d9aa2edd947de52a4625
                                    • Instruction ID: 17accaa0a0a2b4a19e28b40aca99eb0abb2799df9e7e9317438f9edece3b66a2
                                    • Opcode Fuzzy Hash: eeb8cecf6a02fb759e3e41db648b117ae5def5e06fb7d9aa2edd947de52a4625
                                    • Instruction Fuzzy Hash: 2C8172716047019FD724EF28C856FAAB7E5BF88710F14882DF599DB293DB70AD408B92
                                    Function 000902C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 000910A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00090038,?,?), ref: 000910BC
                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00090388
                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 000903C7
                                    • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0009040E
                                    • RegCloseKey.ADVAPI32(?,?), ref: 0009043A
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00090447
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                    • String ID:
                                    • API String ID: 3440857362-0
                                    • Opcode ID: 0cfbdc1b7869126535f1caf764190bc4743bcc5aec2a16cbaee5c620174554a3
                                    • Instruction ID: 6012a46b3eaf44b2790711ccf78b76c166d44d5100559bd1104982233779932b
                                    • Opcode Fuzzy Hash: 0cfbdc1b7869126535f1caf764190bc4743bcc5aec2a16cbaee5c620174554a3
                                    • Instruction Fuzzy Hash: F2515B71208205AFDB14EF64CC81EAEB7E9FF84704F44892DB5958B2A2DB31E944DB52
                                    Function 0007E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0007E88A
                                    • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0007E8B3
                                    • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0007E8F2
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0007E917
                                    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0007E91F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                    • String ID:
                                    • API String ID: 1389676194-0
                                    • Opcode ID: bbde12f433955addf3efd20e175ea5901f530302bbc1e29326cf9b519ab1d207
                                    • Instruction ID: 8a53e869dea073d6917a36b3fc17d3becf7b13179fbca74d9e9985e7b3e223e2
                                    • Opcode Fuzzy Hash: bbde12f433955addf3efd20e175ea5901f530302bbc1e29326cf9b519ab1d207
                                    • Instruction Fuzzy Hash: 2D511835A00205EFCB41EF64C991AAEBBF5FF08314B1480A9E849AB362CB35ED51DB51
                                    Function 0009A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 39ae4555c3577a7fad95c687267428e61947672219217521fd6e9585ef0c960a
                                    • Instruction ID: 4aec2beddb187a684d5602e54fbb27b24336e134920f32e3893f1def504ce3b3
                                    • Opcode Fuzzy Hash: 39ae4555c3577a7fad95c687267428e61947672219217521fd6e9585ef0c960a
                                    • Instruction Fuzzy Hash: D041D235A04204AFDB60DF28CC48BA9BBE4FB0A310F158165F955A72E1D774AE41EA91
                                    Function 00012344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCursorPos.USER32(?), ref: 00012357
                                    • ScreenToClient.USER32(000D67B0,?), ref: 00012374
                                    • GetAsyncKeyState.USER32(00000001), ref: 00012399
                                    • GetAsyncKeyState.USER32(00000002), ref: 000123A7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AsyncState$ClientCursorScreen
                                    • String ID:
                                    • API String ID: 4210589936-0
                                    • Opcode ID: 397488c16de9ade01fa7aa157efda020dc5c3ff8333edd2fbf40a3766ddcb98e
                                    • Instruction ID: 64fb84ea7d291d1df429195d3492ccd00c86813d0203d6256d879d9b4d47979a
                                    • Opcode Fuzzy Hash: 397488c16de9ade01fa7aa157efda020dc5c3ff8333edd2fbf40a3766ddcb98e
                                    • Instruction Fuzzy Hash: 32418371504119FFDF559F64C844EEDBBB4FB05364F10436AF834922A0C7B55AA0DBA1
                                    Function 00066920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0006695D
                                    • TranslateAcceleratorW.USER32(?,?,?), ref: 000669A9
                                    • TranslateMessage.USER32(?), ref: 000669D2
                                    • DispatchMessageW.USER32(?), ref: 000669DC
                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000669EB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Message$PeekTranslate$AcceleratorDispatch
                                    • String ID:
                                    • API String ID: 2108273632-0
                                    • Opcode ID: e73ebc9b99fcf0981cde3fbbc2c2de09dd2c196db9afcb60d4c7ff0870804ee9
                                    • Instruction ID: 368f8c170f2873d1542c2e58d1fef7c05ee7f7a235507936e2adb09cbb4393ed
                                    • Opcode Fuzzy Hash: e73ebc9b99fcf0981cde3fbbc2c2de09dd2c196db9afcb60d4c7ff0870804ee9
                                    • Instruction Fuzzy Hash: EC31C331905646AAEB60CFB4DC44BFA7BFEAB01304F144166E821D31A1DB7B9885DBB1
                                    Function 00068F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetWindowRect.USER32(?,?), ref: 00068F12
                                    • PostMessageW.USER32(?,00000201,00000001), ref: 00068FBC
                                    • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00068FC4
                                    • PostMessageW.USER32(?,00000202,00000000), ref: 00068FD2
                                    • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00068FDA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessagePostSleep$RectWindow
                                    • String ID:
                                    • API String ID: 3382505437-0
                                    • Opcode ID: feb4dcdb145f1fc7a1e1dee898947e406b9902ac15bde1baf9b671071831ebf4
                                    • Instruction ID: 20d6d9ee0c599dbef75186ac6c8394b728b641e1d26ba0f375afb0c9e1c5c996
                                    • Opcode Fuzzy Hash: feb4dcdb145f1fc7a1e1dee898947e406b9902ac15bde1baf9b671071831ebf4
                                    • Instruction Fuzzy Hash: 6C31CE7150021AEFDF14CFA8D94CAAE7BB6FB04315F108229F925EA1D0CBB49954DB90
                                    Function 0006B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • IsWindowVisible.USER32(?), ref: 0006B6C7
                                    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0006B6E4
                                    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0006B71C
                                    • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0006B742
                                    • _wcsstr.LIBCMT ref: 0006B74C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                    • String ID:
                                    • API String ID: 3902887630-0
                                    • Opcode ID: f4c7c8f959730fbd6a7dc173f30c863b4bb2bbb4c1f37f228fe4c6edd21c84d1
                                    • Instruction ID: 3aa0f3929140b73d51d46d8acb3e147b032d5841b310f655c2581d8c2cfaf1aa
                                    • Opcode Fuzzy Hash: f4c7c8f959730fbd6a7dc173f30c863b4bb2bbb4c1f37f228fe4c6edd21c84d1
                                    • Instruction Fuzzy Hash: 6021F971208205BBEB255B39DC49E7B7BEDEF49750F00403AFD05CA1A2EF65DC9096A0
                                    Function 0009B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • GetWindowLongW.USER32(?,000000F0), ref: 0009B44C
                                    • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0009B471
                                    • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0009B489
                                    • GetSystemMetrics.USER32(00000004), ref: 0009B4B2
                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00081184,00000000), ref: 0009B4D0
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$Long$MetricsSystem
                                    • String ID:
                                    • API String ID: 2294984445-0
                                    • Opcode ID: a69963782eb6354b70cb4e67cc59d65d3df36c58f1c36d6063b6bb528934d4c6
                                    • Instruction ID: d62dd70e255c69062091e8adda4208aa3e4f24a073af6c62c7bd121c87166169
                                    • Opcode Fuzzy Hash: a69963782eb6354b70cb4e67cc59d65d3df36c58f1c36d6063b6bb528934d4c6
                                    • Instruction Fuzzy Hash: AD218D71A14256AFDF608F38AD04A6A3BA4FB05730B114729F926C61E2E7349821FB90
                                    Function 000697E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00069802
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00069834
                                    • __itow.LIBCMT ref: 0006984C
                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00069874
                                    • __itow.LIBCMT ref: 00069885
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$__itow$_memmove
                                    • String ID:
                                    • API String ID: 2983881199-0
                                    • Opcode ID: be154933f7c43f6cb27b8294fed2ba76369f53b8b1acb6e70b964fe21c5707bd
                                    • Instruction ID: 3bf05fa7e570305aa44e8ab3032585f882c8fba9ab429084befb6f69567de2d5
                                    • Opcode Fuzzy Hash: be154933f7c43f6cb27b8294fed2ba76369f53b8b1acb6e70b964fe21c5707bd
                                    • Instruction Fuzzy Hash: 30219831700208AFEB219B659C86EEE7BFDEF49710F044025F905DB252DA708D459791
                                    Function 000112F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                    Download Yara Rule
                                    APIs
                                    • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0001134D
                                    • SelectObject.GDI32(?,00000000), ref: 0001135C
                                    • BeginPath.GDI32(?), ref: 00011373
                                    • SelectObject.GDI32(?,00000000), ref: 0001139C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ObjectSelect$BeginCreatePath
                                    • String ID:
                                    • API String ID: 3225163088-0
                                    • Opcode ID: a85a9c244f5381b8196066d72aad8139b37213eee14324dccc6f0e638d6e7caa
                                    • Instruction ID: 9c201acfd5cfab0bad7108fd75ea11f3ff4e7ac760611492d8ad86f359a23086
                                    • Opcode Fuzzy Hash: a85a9c244f5381b8196066d72aad8139b37213eee14324dccc6f0e638d6e7caa
                                    • Instruction Fuzzy Hash: 62214170801309EFEB159F65EC047E97BF8FB00321F244327F920965A4DB7A9991EBA0
                                    Function 0006C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memcmp
                                    • String ID:
                                    • API String ID: 2931989736-0
                                    • Opcode ID: 0fba37de363088ff108c29d4c603f357f70d4d89201e6ba45923dc723c43a6f1
                                    • Instruction ID: a1282d9bb34dbdaf40bc14b50b5a5b53b79fa8d2ed64f5f9ffc559bda4f5760a
                                    • Opcode Fuzzy Hash: 0fba37de363088ff108c29d4c603f357f70d4d89201e6ba45923dc723c43a6f1
                                    • Instruction Fuzzy Hash: 2101B5B26051067BF215A6645C43FFF739D9F673A4F044021FE459E283E750EE1182E0
                                    Function 00074D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCurrentThreadId.KERNEL32 ref: 00074D5C
                                    • __beginthreadex.LIBCMT ref: 00074D7A
                                    • MessageBoxW.USER32(?,?,?,?), ref: 00074D8F
                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00074DA5
                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00074DAC
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                    • String ID:
                                    • API String ID: 3824534824-0
                                    • Opcode ID: d1856222da74586f64e8d86ef5202933ede852b448ec8126409dfbaae792f29f
                                    • Instruction ID: 886618c5a37fca8f1b3e67b40ff8c13d272e74e58f7034884b2282332def55ea
                                    • Opcode Fuzzy Hash: d1856222da74586f64e8d86ef5202933ede852b448ec8126409dfbaae792f29f
                                    • Instruction Fuzzy Hash: 5011E1B2D04649ABE7119BA89C48AEA7BACEB45320F148266FD18D3251D67A8D4087B0
                                    Function 0006874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00068766
                                    • GetLastError.KERNEL32(?,0006822A,?,?,?), ref: 00068770
                                    • GetProcessHeap.KERNEL32(00000008,?,?,0006822A,?,?,?), ref: 0006877F
                                    • HeapAlloc.KERNEL32(00000000,?,0006822A,?,?,?), ref: 00068786
                                    • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0006879D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                    • String ID:
                                    • API String ID: 842720411-0
                                    • Opcode ID: 371dbb43710a95e7fcbe439430c315867b14702ba068480616be4fdd2c6b0800
                                    • Instruction ID: c879b131e054682c77f412a339efef309bd3a2024ee5b65a8b0020ceca01a97b
                                    • Opcode Fuzzy Hash: 371dbb43710a95e7fcbe439430c315867b14702ba068480616be4fdd2c6b0800
                                    • Instruction Fuzzy Hash: 2D014B71204205FFEB245FA6DC88D7B7BADFF89355720452AF849D2260DA35CD00CB60
                                    Function 000754E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00075502
                                    • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00075510
                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00075518
                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00075522
                                    • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0007555E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: PerformanceQuery$CounterSleep$Frequency
                                    • String ID:
                                    • API String ID: 2833360925-0
                                    • Opcode ID: 3e35552a7416e351617bc1607dba58db7d180be9df5660d75ce01ca91ff7bc05
                                    • Instruction ID: 57f6ee66ff699d276d043b6aaa426ad302180735d2c4b2b0c571c77880286fd9
                                    • Opcode Fuzzy Hash: 3e35552a7416e351617bc1607dba58db7d180be9df5660d75ce01ca91ff7bc05
                                    • Instruction Fuzzy Hash: 36015B31C00A1ADBDF00EFE8EC58AEDBB79FB09702F404156E905F2140DB789650C7A5
                                    Function 00067652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?,?,?,0006799D), ref: 0006766F
                                    • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?,?), ref: 0006768A
                                    • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?,?), ref: 00067698
                                    • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?), ref: 000676A8
                                    • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0006758C,80070057,?,?), ref: 000676B4
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: From$Prog$FreeStringTasklstrcmpi
                                    • String ID:
                                    • API String ID: 3897988419-0
                                    • Opcode ID: ff998a7ea23d70c35ccdfda49f56887f96ce6189ff33b0bc8f08cbac6611f458
                                    • Instruction ID: 2f206162d44a81ce05c310cbd30dc2da77f4cce62189781be8f44e1ff2b0b865
                                    • Opcode Fuzzy Hash: ff998a7ea23d70c35ccdfda49f56887f96ce6189ff33b0bc8f08cbac6611f458
                                    • Instruction Fuzzy Hash: 7801D472600605BBEB104F18DC08BAA7BEEFB44B55F100129FD09D2211EB75DE5087A0
                                    Function 000685F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00068608
                                    • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00068612
                                    • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00068621
                                    • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00068628
                                    • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0006863E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                    • String ID:
                                    • API String ID: 44706859-0
                                    • Opcode ID: c9e7d97fb0ac8d8f7cf8619e0df92504e196e435de800b07c905df37ced5ae04
                                    • Instruction ID: 41263225cf314ebccb961d8c90d35073bb40c879d23561ccf620415bb7068e9c
                                    • Opcode Fuzzy Hash: c9e7d97fb0ac8d8f7cf8619e0df92504e196e435de800b07c905df37ced5ae04
                                    • Instruction Fuzzy Hash: C3F04931241205AFEB101FA5DC89E7F3BEDFF8A758B10862AF949C6160CB659C51DBA0
                                    Function 00068652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00068669
                                    • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00068673
                                    • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00068682
                                    • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00068689
                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0006869F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                    • String ID:
                                    • API String ID: 44706859-0
                                    • Opcode ID: 9b1cf660e71acc49ba4e0f4afe16cbb58699f8c68dee5b1b6220e4da6582baf4
                                    • Instruction ID: 51d8eb47c73a4cfba9981c61336606f625ff8b1877f3329f97f897bd602a0a9c
                                    • Opcode Fuzzy Hash: 9b1cf660e71acc49ba4e0f4afe16cbb58699f8c68dee5b1b6220e4da6582baf4
                                    • Instruction Fuzzy Hash: 5DF0A970200205AFEB211FA4EC88E7B3BADFF89758B10022AF90AD2160CA659910DB60
                                    Function 0006C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetDlgItem.USER32(?,000003E9), ref: 0006C6BA
                                    • GetWindowTextW.USER32(00000000,?,00000100), ref: 0006C6D1
                                    • MessageBeep.USER32(00000000), ref: 0006C6E9
                                    • KillTimer.USER32(?,0000040A), ref: 0006C705
                                    • EndDialog.USER32(?,00000001), ref: 0006C71F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BeepDialogItemKillMessageTextTimerWindow
                                    • String ID:
                                    • API String ID: 3741023627-0
                                    • Opcode ID: c091d3c118e600ff7512d948214e9d3bc5d89b2dc9d8184d8961ff24290eef51
                                    • Instruction ID: 2ea00835feed31ec7bc7282c33b639a0f03b0965cdab82a6c909d7e8d2d3f57e
                                    • Opcode Fuzzy Hash: c091d3c118e600ff7512d948214e9d3bc5d89b2dc9d8184d8961ff24290eef51
                                    • Instruction Fuzzy Hash: 24014F70504705ABFB215B60ED4EFB677B9BB00705F04066AB596E14E1DBE8A9548A80
                                    Function 000113B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                    Download Yara Rule
                                    APIs
                                    • EndPath.GDI32(?), ref: 000113BF
                                    • StrokeAndFillPath.GDI32(?,?,0004BAD8,00000000,?), ref: 000113DB
                                    • SelectObject.GDI32(?,00000000), ref: 000113EE
                                    • DeleteObject.GDI32 ref: 00011401
                                    • StrokePath.GDI32(?), ref: 0001141C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Path$ObjectStroke$DeleteFillSelect
                                    • String ID:
                                    • API String ID: 2625713937-0
                                    • Opcode ID: 9cdf420061f01516d40e7252cea093bb3505c61603fd7aee5aad335f6aaa727f
                                    • Instruction ID: 6fd2a61041a87e08c8120ad8e3532e0aeac3e27c7742af8dc26b3e5fb927ac63
                                    • Opcode Fuzzy Hash: 9cdf420061f01516d40e7252cea093bb3505c61603fd7aee5aad335f6aaa727f
                                    • Instruction Fuzzy Hash: 41F0C930005309EBEB155FA6EC0C7A83BA8B741726F148326E969850F1CB3A59E5EF60
                                    Function 00022E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00030FF6: std::exception::exception.LIBCMT ref: 0003102C
                                      • Part of subcall function 00030FF6: __CxxThrowException@8.LIBCMT ref: 00031041
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 00017BB1: _memmove.LIBCMT ref: 00017C0B
                                    • __swprintf.LIBCMT ref: 0002302D
                                    Strings
                                    • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00022EC6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                    • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                    • API String ID: 1943609520-557222456
                                    • Opcode ID: 21ecddee0df301ea683bfffc6399d1d0bbd8ac145ceb4b9d6f261199ee47e240
                                    • Instruction ID: e88a7e3e7d4bb8793602d5fa1f71c01fed83cc12b58d8f436994825ffbb04c50
                                    • Opcode Fuzzy Hash: 21ecddee0df301ea683bfffc6399d1d0bbd8ac145ceb4b9d6f261199ee47e240
                                    • Instruction Fuzzy Hash: D8915D715083119FC728EF24D895DAFB7E8EF85740F44492DF8459B2A2DB21EE48CB62
                                    Function 0007BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000148AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000148A1,?,?,000137C0,?), ref: 000148CE
                                    • CoInitialize.OLE32(00000000), ref: 0007BC26
                                    • CoCreateInstance.OLE32(000A2D6C,00000000,00000001,000A2BDC,?), ref: 0007BC3F
                                    • CoUninitialize.OLE32 ref: 0007BC5C
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                    • String ID: .lnk
                                    • API String ID: 2126378814-24824748
                                    • Opcode ID: c33b1dff59dd746cbe9b3133d8dcd6ba8d1498364baaf6be325ae7142a50fb23
                                    • Instruction ID: d6154c72aca81bcd79bbdb20a59fc4e54e20be455ca1584142cf13de3dbb5695
                                    • Opcode Fuzzy Hash: c33b1dff59dd746cbe9b3133d8dcd6ba8d1498364baaf6be325ae7142a50fb23
                                    • Instruction Fuzzy Hash: D4A144756043019FCB10DF14C894EAABBE5FF89318F148998F8999B3A2CB35ED45CB91
                                    Function 0006B7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON
                                    Download Yara Rule
                                    APIs
                                    • OleSetContainedObject.OLE32(?,00000001), ref: 0006B981
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ContainedObject
                                    • String ID: AutoIt3GUI$Container$%
                                    • API String ID: 3565006973-313794888
                                    • Opcode ID: dfec34864b873a0a4db537d73813087814ecb50e6155e41112a5543e55ce527f
                                    • Instruction ID: b2145ac57ec89df0a83b4caa9ee496cd4a4cbde76ea2a5ca18a3d2258bdf71fd
                                    • Opcode Fuzzy Hash: dfec34864b873a0a4db537d73813087814ecb50e6155e41112a5543e55ce527f
                                    • Instruction Fuzzy Hash: 69916DB06002019FDB64DF68C884B6ABBF9FF48710F14856DF949CB691DB71E980CB60
                                    Function 0003524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                    Download Yara Rule
                                    APIs
                                    • __startOneArgErrorHandling.LIBCMT ref: 000352DD
                                      • Part of subcall function 00040340: __87except.LIBCMT ref: 0004037B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorHandling__87except__start
                                    • String ID: pow
                                    • API String ID: 2905807303-2276729525
                                    • Opcode ID: 1a9842f8accc3ff33c782f865ecb8aa7c166b63a03c4496a4b12852a4b92e1e8
                                    • Instruction ID: 2afc4c0fb48595f4ac899cd62efc90ee27b9608d35c204a8ac670f58c5b5c311
                                    • Opcode Fuzzy Hash: 1a9842f8accc3ff33c782f865ecb8aa7c166b63a03c4496a4b12852a4b92e1e8
                                    • Instruction Fuzzy Hash: F1518DF1A0DA0187D7627B14CD013BF2BD89B41752F208D78E6C5521F6EF788EC49A4A
                                    Function 0003023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: #$+
                                    • API String ID: 0-2552117581
                                    • Opcode ID: d838c398c5fc4b1f7a144fde93c3f5866632f38b41bb63842a2fed112a01e097
                                    • Instruction ID: 03865d2275615a9aa3be3a4d852fca1978a74965e5fa4789f6a9a0b770e251ca
                                    • Opcode Fuzzy Hash: d838c398c5fc4b1f7a144fde93c3f5866632f38b41bb63842a2fed112a01e097
                                    • Instruction Fuzzy Hash: AC513134105246CFDF369F28C8986FE7BEAEF1A311F184055E8919B2E1D7349D82CB60
                                    Function 000262F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memset$_memmove
                                    • String ID: ERCP
                                    • API String ID: 2532777613-1384759551
                                    • Opcode ID: 6bb26e95740d5316236ab5d4dbd9520fc5c3ab16be014bbdc14cbb1cfe0584b9
                                    • Instruction ID: b2cedc750928fd88e99053d39a244a299f861f8e4e06e14f8960a2336a6fd278
                                    • Opcode Fuzzy Hash: 6bb26e95740d5316236ab5d4dbd9520fc5c3ab16be014bbdc14cbb1cfe0584b9
                                    • Instruction Fuzzy Hash: C451D371900719DFDB24DF65D881BEABBF9EF04314F24856EE58ACB241E7729684CB80
                                    Function 00097648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 000976D0
                                    • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 000976E4
                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 00097708
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$Window
                                    • String ID: SysMonthCal32
                                    • API String ID: 2326795674-1439706946
                                    • Opcode ID: 3dbdf27193c50603f081dd860f9c1f44411a4027beb0d04536ef5e8f11d76ea2
                                    • Instruction ID: 68ff23066bdb88ee649b4d058af98bd9245329e8882e3127bcf95b99731e2b7a
                                    • Opcode Fuzzy Hash: 3dbdf27193c50603f081dd860f9c1f44411a4027beb0d04536ef5e8f11d76ea2
                                    • Instruction Fuzzy Hash: 2621D133514219BBDF15CFA4CC46FEA3BA9FF48724F110214FE19AB1D1DAB5A8509BA0
                                    Function 00096F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00096FAA
                                    • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00096FBA
                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00096FDF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend$MoveWindow
                                    • String ID: Listbox
                                    • API String ID: 3315199576-2633736733
                                    • Opcode ID: 92edd94fc8ddf74aaedc5ece50b0cae97fd0bea0279ac91f487eb78e082fccc6
                                    • Instruction ID: 9734abb4a2a1abe00d255dcc8e7926f87c4406e7e91d062ca556c6b484f4713f
                                    • Opcode Fuzzy Hash: 92edd94fc8ddf74aaedc5ece50b0cae97fd0bea0279ac91f487eb78e082fccc6
                                    • Instruction Fuzzy Hash: C821C5326101187FEF118F54EC85FFB37AAEF89750F018124F9149B190CA729C51D7A0
                                    Function 0009797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 000979E1
                                    • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 000979F6
                                    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00097A03
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend
                                    • String ID: msctls_trackbar32
                                    • API String ID: 3850602802-1010561917
                                    • Opcode ID: 260f56b2503ae83a7e41008fee35ed574b82f5d7eb91d06c626f6e0701335846
                                    • Instruction ID: 3df87cbf3809720771956c08cc6e561b4a37c912efeba64637d82fd4e0ad0ee6
                                    • Opcode Fuzzy Hash: 260f56b2503ae83a7e41008fee35ed574b82f5d7eb91d06c626f6e0701335846
                                    • Instruction Fuzzy Hash: B911E372254208BFEF249F64CC05FEB37A9EFC9764F010519FA45A6091D672D851DB60
                                    Function 00014C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,00014C2E), ref: 00014CA3
                                    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00014CB5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: GetNativeSystemInfo$kernel32.dll
                                    • API String ID: 2574300362-192647395
                                    • Opcode ID: 17d320f26f3d765ebef0f70a40626718632e94fd07c4138de151a2025094d819
                                    • Instruction ID: 03023721097141a497585ef678d3407e47c771d680f33d972644089cd624950a
                                    • Opcode Fuzzy Hash: 17d320f26f3d765ebef0f70a40626718632e94fd07c4138de151a2025094d819
                                    • Instruction Fuzzy Hash: C0D05B30511723CFDB605F31DD1965676D5FF05791B15C83ED885D6160D774D4C0CA90
                                    Function 00014D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,00014D2E,?,00014F4F,?,000D62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00014D6F
                                    • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00014D81
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                    • API String ID: 2574300362-3689287502
                                    • Opcode ID: 22ff7b0f7862234990afb5f00ea0c02e708cb37c632d422b58fe915df28f8a96
                                    • Instruction ID: 5eb1dbb3e71cf1f1f8eadb930395a621e21f44a0c3bd12206ff7a3019ec6dd34
                                    • Opcode Fuzzy Hash: 22ff7b0f7862234990afb5f00ea0c02e708cb37c632d422b58fe915df28f8a96
                                    • Instruction Fuzzy Hash: 62D01730610713CFEB209F31E81876676E8BF15352B21883ED48ADA260E7B4D8C0CB91
                                    Function 00014D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,00014CE1,?), ref: 00014DA2
                                    • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00014DB4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                    • API String ID: 2574300362-1355242751
                                    • Opcode ID: 65d345b881967c0091d47c2408512e1db4b179c7ce5b4291b2ad0ef91d9996bd
                                    • Instruction ID: 1b0aac65cbf5cd16f35b1d804c5829104685f5f727ba5f30d073bbd1eb364c44
                                    • Opcode Fuzzy Hash: 65d345b881967c0091d47c2408512e1db4b179c7ce5b4291b2ad0ef91d9996bd
                                    • Instruction Fuzzy Hash: 22D01231550713CFDB205F31E818A9676D4EF06355B11883ED8C5D6160D774D4C0CA51
                                    Function 00091072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(advapi32.dll,?,000912C1), ref: 00091080
                                    • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00091092
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: RegDeleteKeyExW$advapi32.dll
                                    • API String ID: 2574300362-4033151799
                                    • Opcode ID: 7dd77d4fdc207a4a91d9af967f255ae2603e69d21be4efe7306db147eefd6a4e
                                    • Instruction ID: a1365d26eb4bae808c02d99e8722897360ceba07ff346c1109233eb5ee01f616
                                    • Opcode Fuzzy Hash: 7dd77d4fdc207a4a91d9af967f255ae2603e69d21be4efe7306db147eefd6a4e
                                    • Instruction Fuzzy Hash: 6AD01230510713CFD7205F35D819A6A76E4EF45362F118C3EA489DA160D7B4C4C0C650
                                    Function 000893F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(kernel32.dll,00000001,00089009,?,0009F910), ref: 00089403
                                    • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00089415
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: GetModuleHandleExW$kernel32.dll
                                    • API String ID: 2574300362-199464113
                                    • Opcode ID: 88bc60c4f624dd103cf0ed3ed6f994ee76cb4451b47ee41305f074e04e255445
                                    • Instruction ID: 7464a4694ba6817ddfcd185e68820a164e87766a478db6c851f02faddd34adb5
                                    • Opcode Fuzzy Hash: 88bc60c4f624dd103cf0ed3ed6f994ee76cb4451b47ee41305f074e04e255445
                                    • Instruction Fuzzy Hash: 4ED0C730A00313CFEB20AF30D948A2672E4BF02341B14C83FA4C6CA560E7B4C8C0CB90
                                    Function 00051B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: LocalTime__swprintf
                                    • String ID: %.3d$WIN_XPe
                                    • API String ID: 2070861257-2409531811
                                    • Opcode ID: c38a511648f3c1bc438f64a8de7893640cfd2199af06b2f1561e52c6e8eec87b
                                    • Instruction ID: f318e3ba493623635f44f5f6c2f22025dea5771bf13d167cb0d9505fb6fd7aba
                                    • Opcode Fuzzy Hash: c38a511648f3c1bc438f64a8de7893640cfd2199af06b2f1561e52c6e8eec87b
                                    • Instruction Fuzzy Hash: 21D012B1808118EAEB249B908C44EFF737CAB04313F100592BD02D1040F3749B98DB21
                                    Function 000676C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b655bc1124668ccf2b41d7c5c0d9d73b8140f52971aacd9e6204df81edaaeb72
                                    • Instruction ID: 6036949878cf9bb655177abdcf776d1855fe07ee018551916f40f900cf8460dd
                                    • Opcode Fuzzy Hash: b655bc1124668ccf2b41d7c5c0d9d73b8140f52971aacd9e6204df81edaaeb72
                                    • Instruction Fuzzy Hash: 1EC18475A04216EFDB14CFA4C884EAEB7F6FF48718B118599E809EB251D731DE81CB90
                                    Function 0008E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CharLowerBuffW.USER32(?,?), ref: 0008E3D2
                                    • CharLowerBuffW.USER32(?,?), ref: 0008E415
                                      • Part of subcall function 0008DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0008DAD9
                                    • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0008E615
                                    • _memmove.LIBCMT ref: 0008E628
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: BuffCharLower$AllocVirtual_memmove
                                    • String ID:
                                    • API String ID: 3659485706-0
                                    • Opcode ID: 3943422f26433228b44636e14577692f51b0a70c5164241a210dcc5cf6dc9546
                                    • Instruction ID: 6e73eb5702edf5ecde6e011e6aeea04c49d477d770a1ab35b79050b510d992dc
                                    • Opcode Fuzzy Hash: 3943422f26433228b44636e14577692f51b0a70c5164241a210dcc5cf6dc9546
                                    • Instruction Fuzzy Hash: 6DC16B716083418FC754EF28C4909AABBE4FF88718F14896EF8999B352D731E945CF82
                                    Function 000883A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                    Download Yara Rule
                                    APIs
                                    • CoInitialize.OLE32(00000000), ref: 000883D8
                                    • CoUninitialize.OLE32 ref: 000883E3
                                      • Part of subcall function 0006DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0006DAC5
                                    • VariantInit.OLEAUT32(?), ref: 000883EE
                                    • VariantClear.OLEAUT32(?), ref: 000886BF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                    • String ID:
                                    • API String ID: 780911581-0
                                    • Opcode ID: b4e8596f5b6719c7a78f89d09624a8459de404b74dc0688e4aff4ada173b1e4f
                                    • Instruction ID: 187b79fbae9697bfc7d8338d5e7e11c02f2cbed20df9ffa10f560265042b3af7
                                    • Opcode Fuzzy Hash: b4e8596f5b6719c7a78f89d09624a8459de404b74dc0688e4aff4ada173b1e4f
                                    • Instruction Fuzzy Hash: 81A137752047019FDB10EF14C891AAEB7E5BF88324F54845DF99A9B3A2DB30ED44CB86
                                    Function 00066DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Variant$AllocClearCopyInitString
                                    • String ID:
                                    • API String ID: 2808897238-0
                                    • Opcode ID: 44302724f2e52aa2e4601a444bdf3c195b775cc24c0a7a50b9aeb638248efbcc
                                    • Instruction ID: f3729d330e327a5fa9203ae64b04c5238aef05d8c529b9a62038101625079a81
                                    • Opcode Fuzzy Hash: 44302724f2e52aa2e4601a444bdf3c195b775cc24c0a7a50b9aeb638248efbcc
                                    • Instruction Fuzzy Hash: 5851CB30604302DAEB70AF65D495ABDB3E6AF44314F70882FE55ACB292DB7198809B15
                                    Function 000797E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00015045: _fseek.LIBCMT ref: 0001505D
                                      • Part of subcall function 000799BE: _wcscmp.LIBCMT ref: 00079AAE
                                      • Part of subcall function 000799BE: _wcscmp.LIBCMT ref: 00079AC1
                                    • _free.LIBCMT ref: 0007992C
                                    • _free.LIBCMT ref: 00079933
                                    • _free.LIBCMT ref: 0007999E
                                      • Part of subcall function 00032F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00039C64), ref: 00032FA9
                                      • Part of subcall function 00032F95: GetLastError.KERNEL32(00000000,?,00039C64), ref: 00032FBB
                                    • _free.LIBCMT ref: 000799A6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                    • String ID:
                                    • API String ID: 1552873950-0
                                    • Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
                                    • Instruction ID: 83222d816e8b28a26f4cf7f711e83ca6ffb9e8c81521b7198dc19ffcbbf71357
                                    • Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
                                    • Instruction Fuzzy Hash: D6517FB1D04218AFDF259F64CC41ADEBBB9EF48300F0040AEB209A7242DB355E90CF58
                                    Function 00099A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetWindowRect.USER32(0118E3B0,?), ref: 00099AD2
                                    • ScreenToClient.USER32(00000002,00000002), ref: 00099B05
                                    • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00099B72
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$ClientMoveRectScreen
                                    • String ID:
                                    • API String ID: 3880355969-0
                                    • Opcode ID: 4481e21f3ffb940c5ca184866892d5807bca358ab3c788505200329cd6c88fc0
                                    • Instruction ID: 155294dabd63b71a7c51d9a904d2a1fe6be77c21b28e3e98d5702201dc630761
                                    • Opcode Fuzzy Hash: 4481e21f3ffb940c5ca184866892d5807bca358ab3c788505200329cd6c88fc0
                                    • Instruction Fuzzy Hash: A6512C35A00209AFDF10DF68D9809AE7BF5FB55320F14825EF9159B290D735AD81EB90
                                    Function 00086CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • socket.WSOCK32(00000002,00000002,00000011), ref: 00086CE4
                                    • WSAGetLastError.WSOCK32(00000000), ref: 00086CF4
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00086D58
                                    • WSAGetLastError.WSOCK32(00000000), ref: 00086D64
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ErrorLast$__itow__swprintfsocket
                                    • String ID:
                                    • API String ID: 2214342067-0
                                    • Opcode ID: c75dd958d0fb4ce46d3e3d0034707faf18af1c4148a6f5460f013588a4baf11a
                                    • Instruction ID: 49ac2c4afd5830047ef0d83650a0546fd348f65afaecbedc3f499e6d1f55c82c
                                    • Opcode Fuzzy Hash: c75dd958d0fb4ce46d3e3d0034707faf18af1c4148a6f5460f013588a4baf11a
                                    • Instruction Fuzzy Hash: 8541BF74B40200AFEB20AF24DC96FBA77E5AF04B14F448018FA599B2D3DA759D408B91
                                    Function 0008672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                    Download Yara Rule
                                    APIs
                                    • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0009F910), ref: 000867BA
                                    • _strlen.LIBCMT ref: 000867EC
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _strlen
                                    • String ID:
                                    • API String ID: 4218353326-0
                                    • Opcode ID: fae3c2dc4649a023a2c3425e4fce7a267843f1a706b4c642fe1a6e953f1b05cc
                                    • Instruction ID: 56fb19554078f2cebc49f94e0961c71eb6f2f2365cd19ed62eda912def4c2130
                                    • Opcode Fuzzy Hash: fae3c2dc4649a023a2c3425e4fce7a267843f1a706b4c642fe1a6e953f1b05cc
                                    • Instruction Fuzzy Hash: C641AD31A04105AFCB14FBA4DCD5EEEB3A9BF48314F158265F85A9B292DF31AD40CB91
                                    Function 0007BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0007BB09
                                    • GetLastError.KERNEL32(?,00000000), ref: 0007BB2F
                                    • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0007BB54
                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0007BB80
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CreateHardLink$DeleteErrorFileLast
                                    • String ID:
                                    • API String ID: 3321077145-0
                                    • Opcode ID: 89765bfa0d58c097efd3c4930f4bb178ac78cb48b92a9a9b094a495b5e1f1557
                                    • Instruction ID: a6f46792127d677b50cef48dba8185a6c15376988209d05557de5176da957325
                                    • Opcode Fuzzy Hash: 89765bfa0d58c097efd3c4930f4bb178ac78cb48b92a9a9b094a495b5e1f1557
                                    • Instruction Fuzzy Hash: D6412539600611DFCB11EF18C594A9DBBE1AF89314B09C498EC4A9B362CB38FD41CB91
                                    Function 00098AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                    Download Yara Rule
                                    APIs
                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00098B4D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: InvalidateRect
                                    • String ID:
                                    • API String ID: 634782764-0
                                    • Opcode ID: 92a6e88e8cf266184282f7787e801d34fab6395d2c08e36abe1f2c06880948e0
                                    • Instruction ID: 0ec93ec13c4b0d77410cd9ccf9e3b49199bfbd4728339e13be90e7fa9d5a0c32
                                    • Opcode Fuzzy Hash: 92a6e88e8cf266184282f7787e801d34fab6395d2c08e36abe1f2c06880948e0
                                    • Instruction Fuzzy Hash: C331AFB4604208BFEF609A18CC95FAD37A4EB07310F68C616FA55D73A1CF35A950AB51
                                    Function 0009ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • ClientToScreen.USER32(?,?), ref: 0009AE1A
                                    • GetWindowRect.USER32(?,?), ref: 0009AE90
                                    • PtInRect.USER32(?,?,0009C304), ref: 0009AEA0
                                    • MessageBeep.USER32(00000000), ref: 0009AF11
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Rect$BeepClientMessageScreenWindow
                                    • String ID:
                                    • API String ID: 1352109105-0
                                    • Opcode ID: f36eaf7aa8044dfec9a1d5ee145472051dfb304530d96d439120aa4aec866679
                                    • Instruction ID: 5b11ad4106fa5e3371fad0c821948e1d1aca130442b3583839befc132be26446
                                    • Opcode Fuzzy Hash: f36eaf7aa8044dfec9a1d5ee145472051dfb304530d96d439120aa4aec866679
                                    • Instruction Fuzzy Hash: 78416D70700219DFDF11CF58C894AA9BBF5FB4A350F1881AAE814DB251D735A942EFA2
                                    Function 00070FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00071037
                                    • SetKeyboardState.USER32(00000080,?,00000001), ref: 00071053
                                    • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 000710B9
                                    • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 0007110B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: KeyboardState$InputMessagePostSend
                                    • String ID:
                                    • API String ID: 432972143-0
                                    • Opcode ID: 2e3090cf4f573344e4a0b33dca76f6641583df8a93bc2cf62f61a1be4a646fe4
                                    • Instruction ID: 696947efc056014012040bd1b1d6b6c04e5b84346dcea08ea54a764715d074e8
                                    • Opcode Fuzzy Hash: 2e3090cf4f573344e4a0b33dca76f6641583df8a93bc2cf62f61a1be4a646fe4
                                    • Instruction Fuzzy Hash: 7B313970E44688AEFB308A6D8C05BFDBBE9AF44310F04C31AE588921D1C3BC49D497E9
                                    Function 00071121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00071176
                                    • SetKeyboardState.USER32(00000080,?,00008000), ref: 00071192
                                    • PostMessageW.USER32(00000000,00000101,00000000), ref: 000711F1
                                    • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00071243
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: KeyboardState$InputMessagePostSend
                                    • String ID:
                                    • API String ID: 432972143-0
                                    • Opcode ID: 1c36681c6978fc9bd635ab74c9757c68044da07619f522a448b1c05ab646a7e3
                                    • Instruction ID: 5a5ae562a9a101e4b32c05d163038d453c38e32e6de6e64358ffc89f1f4468a0
                                    • Opcode Fuzzy Hash: 1c36681c6978fc9bd635ab74c9757c68044da07619f522a448b1c05ab646a7e3
                                    • Instruction Fuzzy Hash: FE310730E4064CAAFF308A6D8815BFE7BEAAB49310F54C31BF688961D2C37C4D559759
                                    Function 00046415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0004644B
                                    • __isleadbyte_l.LIBCMT ref: 00046479
                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000464A7
                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000464DD
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                    • String ID:
                                    • API String ID: 3058430110-0
                                    • Opcode ID: e3e93a8833d2a9e764f44ba85ab7c9b80b3bcc96c909c68a5a7f396365bdaeac
                                    • Instruction ID: 680719525448272fecfea7943b4b45e110ab09c02f7325db579d5cb5c5ad297a
                                    • Opcode Fuzzy Hash: e3e93a8833d2a9e764f44ba85ab7c9b80b3bcc96c909c68a5a7f396365bdaeac
                                    • Instruction Fuzzy Hash: A731B0B1600246AFDF258F65C845BBA7BE9FF82310F154039E85487191FB32E890DB9A
                                    Function 00095175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetForegroundWindow.USER32 ref: 00095189
                                      • Part of subcall function 0007387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00073897
                                      • Part of subcall function 0007387D: GetCurrentThreadId.KERNEL32 ref: 0007389E
                                      • Part of subcall function 0007387D: AttachThreadInput.USER32(00000000,?,000752A7), ref: 000738A5
                                    • GetCaretPos.USER32(?), ref: 0009519A
                                    • ClientToScreen.USER32(00000000,?), ref: 000951D5
                                    • GetForegroundWindow.USER32 ref: 000951DB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                    • String ID:
                                    • API String ID: 2759813231-0
                                    • Opcode ID: 0c9833d6f7778e03441367fd263c57adea030b5ca37c811b55034a814611d06d
                                    • Instruction ID: 3fe0f16c6e0d023a901957bc01e9d9b81a2e17f0e0a252a4f954c422ec59b38a
                                    • Opcode Fuzzy Hash: 0c9833d6f7778e03441367fd263c57adea030b5ca37c811b55034a814611d06d
                                    • Instruction Fuzzy Hash: B2310D72D00108AFDB10EFA5CC85AEFB7F9EF98300F10406AE515E7252EA759E45CBA1
                                    Function 0009C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • GetCursorPos.USER32(?), ref: 0009C7C2
                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0004BBFB,?,?,?,?,?), ref: 0009C7D7
                                    • GetCursorPos.USER32(?), ref: 0009C824
                                    • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0004BBFB,?,?,?), ref: 0009C85E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Cursor$LongMenuPopupProcTrackWindow
                                    • String ID:
                                    • API String ID: 2864067406-0
                                    • Opcode ID: 313b5d7eb73d46124d19300184b8a668b3098ff234effe6ff19093effd7e7411
                                    • Instruction ID: 016a67c6429115824c426c659ca07701407a31bc0686c7c030fa619bfcc08e7c
                                    • Opcode Fuzzy Hash: 313b5d7eb73d46124d19300184b8a668b3098ff234effe6ff19093effd7e7411
                                    • Instruction Fuzzy Hash: 37317175A00418AFEF15CF58C898EEB7BF6FB49310F04416AF9058B261CB359D50EB60
                                    Function 00068B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00068652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00068669
                                      • Part of subcall function 00068652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00068673
                                      • Part of subcall function 00068652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00068682
                                      • Part of subcall function 00068652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00068689
                                      • Part of subcall function 00068652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0006869F
                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00068BEB
                                    • _memcmp.LIBCMT ref: 00068C0E
                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00068C44
                                    • HeapFree.KERNEL32(00000000), ref: 00068C4B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                    • String ID:
                                    • API String ID: 1592001646-0
                                    • Opcode ID: 56e2cd9c38413dd65b170537f4c07e3c3faf19e5bb88b0a88b5e886b15b7b15a
                                    • Instruction ID: 808d9df861480ad8d55bd8cbf25c2e728d681449ebbdd58fe560239626a06da6
                                    • Opcode Fuzzy Hash: 56e2cd9c38413dd65b170537f4c07e3c3faf19e5bb88b0a88b5e886b15b7b15a
                                    • Instruction Fuzzy Hash: 6C217A71E01209EFDB10DFA4C949BEEB7F9FF44364F148159E454A7241DB31AA06CBA0
                                    Function 00030BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                    Download Yara Rule
                                    APIs
                                    • __setmode.LIBCMT ref: 00030BF2
                                      • Part of subcall function 00015B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00077B20,?,?,00000000), ref: 00015B8C
                                      • Part of subcall function 00015B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00077B20,?,?,00000000,?,?), ref: 00015BB0
                                    • _fprintf.LIBCMT ref: 00030C29
                                    • OutputDebugStringW.KERNEL32(?), ref: 00066331
                                      • Part of subcall function 00034CDA: _flsall.LIBCMT ref: 00034CF3
                                    • __setmode.LIBCMT ref: 00030C5E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                    • String ID:
                                    • API String ID: 521402451-0
                                    • Opcode ID: 1cc1d601c1233a8dc0eb5ab174a1f792a3b2bd4a9a2c82b54dfebbeca2c313bf
                                    • Instruction ID: 12fbd99d2fb53a6d4537e1819c7d78bd0ccbd5d97b0bf81331b83997050c38fd
                                    • Opcode Fuzzy Hash: 1cc1d601c1233a8dc0eb5ab174a1f792a3b2bd4a9a2c82b54dfebbeca2c313bf
                                    • Instruction Fuzzy Hash: 99113632904208BADB06B7B49C87AFEBB6D9F81320F14411AF2049B2D3DF252D818395
                                    Function 00081A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00081A97
                                      • Part of subcall function 00081B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00081B40
                                      • Part of subcall function 00081B21: InternetCloseHandle.WININET(00000000), ref: 00081BDD
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Internet$CloseConnectHandleOpen
                                    • String ID:
                                    • API String ID: 1463438336-0
                                    • Opcode ID: 219622f3391e81492835eaab4b1405514e64c4d047efe4b713dc75077cfa9e5e
                                    • Instruction ID: d0325054d501d3abdf1d11485f96877ec5f4a86fa8f8f8c00453f5f88f1b0945
                                    • Opcode Fuzzy Hash: 219622f3391e81492835eaab4b1405514e64c4d047efe4b713dc75077cfa9e5e
                                    • Instruction Fuzzy Hash: 82218E35205A01BFEB25AF60CC01FFBB7ADFF48711F10001AFA9696651EB71D8129BA0
                                    Function 0006E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0006F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0006E1C4,?,?,?,0006EFB7,00000000,000000EF,00000119,?,?), ref: 0006F5BC
                                      • Part of subcall function 0006F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0006F5E2
                                      • Part of subcall function 0006F5AD: lstrcmpiW.KERNEL32(00000000,?,0006E1C4,?,?,?,0006EFB7,00000000,000000EF,00000119,?,?), ref: 0006F613
                                    • lstrlenW.KERNEL32(?,00000002,?,?,?,?,0006EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0006E1DD
                                    • lstrcpyW.KERNEL32(00000000,?), ref: 0006E203
                                    • lstrcmpiW.KERNEL32(00000002,cdecl,?,0006EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0006E237
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: lstrcmpilstrcpylstrlen
                                    • String ID: cdecl
                                    • API String ID: 4031866154-3896280584
                                    • Opcode ID: 8ccff62c9985c56cc25ae383a4c97fd83e4c72a1ac01318d80d5880fd1f50530
                                    • Instruction ID: 8aa60f7048cc49c7b0f7997ac7982b39ef1954d6d45fba08f7f478bedf2b6d82
                                    • Opcode Fuzzy Hash: 8ccff62c9985c56cc25ae383a4c97fd83e4c72a1ac01318d80d5880fd1f50530
                                    • Instruction Fuzzy Hash: 8811D33A100342EFDB25AF64DC45DBA77EAFF44310B40412AF906CB2A4EB719950D790
                                    Function 00045332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • _free.LIBCMT ref: 00045351
                                      • Part of subcall function 0003594C: __FF_MSGBANNER.LIBCMT ref: 00035963
                                      • Part of subcall function 0003594C: __NMSG_WRITE.LIBCMT ref: 0003596A
                                      • Part of subcall function 0003594C: RtlAllocateHeap.NTDLL(01170000,00000000,00000001,00000000,?,?,?,00031013,?), ref: 0003598F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: AllocateHeap_free
                                    • String ID:
                                    • API String ID: 614378929-0
                                    • Opcode ID: 32060a91fe9f90423f9a6dadf1865178b8e24adbbe8fea3cf5cc73554e7ac564
                                    • Instruction ID: a9f3ae740040774c0c07e39af2597b2c82cb6c7b6794bc8245d07fd25fca1086
                                    • Opcode Fuzzy Hash: 32060a91fe9f90423f9a6dadf1865178b8e24adbbe8fea3cf5cc73554e7ac564
                                    • Instruction Fuzzy Hash: 8C11C4B2504B15AFDB322F70AC446AD37D86F103A3F10447AF944961A3DE758F408754
                                    Function 00014531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00014560
                                      • Part of subcall function 0001410D: _memset.LIBCMT ref: 0001418D
                                      • Part of subcall function 0001410D: _wcscpy.LIBCMT ref: 000141E1
                                      • Part of subcall function 0001410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000141F1
                                    • KillTimer.USER32(?,00000001,?,?), ref: 000145B5
                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000145C4
                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0004D6CE
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                    • String ID:
                                    • API String ID: 1378193009-0
                                    • Opcode ID: edb2705d608566f237ef25c500c02b95bcc5689df6388ad44d5f4aa4866aaa18
                                    • Instruction ID: 2461e4a1b6ca369cfa524f17f7e1bedfb62d0c8a0df3a92a09d7ac2f7e28297b
                                    • Opcode Fuzzy Hash: edb2705d608566f237ef25c500c02b95bcc5689df6388ad44d5f4aa4866aaa18
                                    • Instruction Fuzzy Hash: 4921D7B0904784AFEB728B24D855BFBBBEDAF01304F04009FE69E97252C7745AC49B51
                                    Function 000740B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 000740D1
                                    • _memset.LIBCMT ref: 000740F2
                                    • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00074144
                                    • CloseHandle.KERNEL32(00000000), ref: 0007414D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CloseControlCreateDeviceFileHandle_memset
                                    • String ID:
                                    • API String ID: 1157408455-0
                                    • Opcode ID: a3a4773602a2a9d8156245cb4baf73668e852e620b1399d0bc226bc0a34bb5d4
                                    • Instruction ID: 60914983b85990e2872c92c66c706ede9950f8168815a73b3587f23290afc587
                                    • Opcode Fuzzy Hash: a3a4773602a2a9d8156245cb4baf73668e852e620b1399d0bc226bc0a34bb5d4
                                    • Instruction Fuzzy Hash: D211AB75D012287AE7305BA59C4DFABBBBCEF44760F104596F908D7180D6784E808BA4
                                    Function 0008667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00015B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00077B20,?,?,00000000), ref: 00015B8C
                                      • Part of subcall function 00015B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00077B20,?,?,00000000,?,?), ref: 00015BB0
                                    • gethostbyname.WSOCK32(?,?,?), ref: 000866AC
                                    • WSAGetLastError.WSOCK32(00000000), ref: 000866B7
                                    • _memmove.LIBCMT ref: 000866E4
                                    • inet_ntoa.WSOCK32(?), ref: 000866EF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                    • String ID:
                                    • API String ID: 1504782959-0
                                    • Opcode ID: 096c324336f5abbb69c361b220269e9f3725aadd274f0c084a9abfa1677c1e0e
                                    • Instruction ID: d293c136190487d2518c441d995f9a6f7d1aea591311692be8452e3818e00721
                                    • Opcode Fuzzy Hash: 096c324336f5abbb69c361b220269e9f3725aadd274f0c084a9abfa1677c1e0e
                                    • Instruction Fuzzy Hash: A3119035604509EFCB04FBA4DD96DEEB7B9BF48310B144025F502AB162DF31AE44CBA1
                                    Function 00069023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 00069043
                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00069055
                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0006906B
                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00069086
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend
                                    • String ID:
                                    • API String ID: 3850602802-0
                                    • Opcode ID: 3dd3949ee5979fbb15b5311f725477c081a83780f407c9636f67186de719412f
                                    • Instruction ID: 4ec2d576433df8c1cdfbd4f81e8ab533939b82ce90ff8a55813862e480316b2c
                                    • Opcode Fuzzy Hash: 3dd3949ee5979fbb15b5311f725477c081a83780f407c9636f67186de719412f
                                    • Instruction Fuzzy Hash: B7115A79900218FFEB10DFA5CD84EADBBB9FB48310F2040A5EA04B7290D6726E10DB90
                                    Function 00011290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00012612: GetWindowLongW.USER32(?,000000EB), ref: 00012623
                                    • DefDlgProcW.USER32(?,00000020,?), ref: 000112D8
                                    • GetClientRect.USER32(?,?), ref: 0004B84B
                                    • GetCursorPos.USER32(?), ref: 0004B855
                                    • ScreenToClient.USER32(?,?), ref: 0004B860
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Client$CursorLongProcRectScreenWindow
                                    • String ID:
                                    • API String ID: 4127811313-0
                                    • Opcode ID: be9059bd9dcab9e55939a87a792cb6e1230ca5d659ddc4c165761eb56810cc4d
                                    • Instruction ID: efe9bc4fcc775e884392c0857f617feb173d51e2368cbf6c388c85c536ab121c
                                    • Opcode Fuzzy Hash: be9059bd9dcab9e55939a87a792cb6e1230ca5d659ddc4c165761eb56810cc4d
                                    • Instruction Fuzzy Hash: 9F114C35A0111AAFDF14EF98D8859FE77B8FB06301F100456FA01E7251C738BAA19BA5
                                    Function 00071652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000701FD,?,00071250,?,00008000), ref: 0007166F
                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,000701FD,?,00071250,?,00008000), ref: 00071694
                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000701FD,?,00071250,?,00008000), ref: 0007169E
                                    • Sleep.KERNEL32(?,?,?,?,?,?,?,000701FD,?,00071250,?,00008000), ref: 000716D1
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CounterPerformanceQuerySleep
                                    • String ID:
                                    • API String ID: 2875609808-0
                                    • Opcode ID: e5c79ce7af77a87c1946a7bf33866d6665bd660a53b7cdcef643eb60f749d635
                                    • Instruction ID: 02052dc75bc6f5bade2a4aa16498c12abf8beb4dd0715c351516196d16d48265
                                    • Opcode Fuzzy Hash: e5c79ce7af77a87c1946a7bf33866d6665bd660a53b7cdcef643eb60f749d635
                                    • Instruction Fuzzy Hash: 4D118231E0051DD7CF00AFA9E848AFEBF78FF09701F058056D984B2180CB3855508BDA
                                    Function 00047207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                    • String ID:
                                    • API String ID: 3016257755-0
                                    • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                    • Instruction ID: 0a7fc358e0b132cbab6d11b4674b3fae87810770624db030075e1acbb5974510
                                    • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                    • Instruction Fuzzy Hash: 850180B204814ABBCF566E84CD018EE3F62BF19340B498625FA1C58031C377C9B1AB85
                                    Function 0009B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetWindowRect.USER32(?,?), ref: 0009B59E
                                    • ScreenToClient.USER32(?,?), ref: 0009B5B6
                                    • ScreenToClient.USER32(?,?), ref: 0009B5DA
                                    • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0009B5F5
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClientRectScreen$InvalidateWindow
                                    • String ID:
                                    • API String ID: 357397906-0
                                    • Opcode ID: 7005fa23142f46b49b40495efee6db802cd3198bb517f15308723c162711bc13
                                    • Instruction ID: 2f6374954a2c3c4e682ef3300f685a5d4e48c31ea1a229c64b6184d4109dd95e
                                    • Opcode Fuzzy Hash: 7005fa23142f46b49b40495efee6db802cd3198bb517f15308723c162711bc13
                                    • Instruction Fuzzy Hash: 201146B5D0020AEFDB41DF99D544AEEFBF5FB08310F104166E914E3220D735AA559F50
                                    Function 0009B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 0009B8FE
                                    • _memset.LIBCMT ref: 0009B90D
                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,000D7F20,000D7F64), ref: 0009B93C
                                    • CloseHandle.KERNEL32 ref: 0009B94E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _memset$CloseCreateHandleProcess
                                    • String ID:
                                    • API String ID: 3277943733-0
                                    • Opcode ID: 325bbb4160a04dc2d04a266d85820efa64471c369e78013e76d503d4fc91de10
                                    • Instruction ID: a183de8dddc084a49928b2413affc93340f78b1625310d34ac8f764164a4394e
                                    • Opcode Fuzzy Hash: 325bbb4160a04dc2d04a266d85820efa64471c369e78013e76d503d4fc91de10
                                    • Instruction Fuzzy Hash: 20F05EB26493007BF2202771AC49FBB3B9CEB08354F404432BE0CD5292E77D490087B8
                                    Function 00076E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                    Download Yara Rule
                                    APIs
                                    • EnterCriticalSection.KERNEL32(?), ref: 00076E88
                                      • Part of subcall function 0007794E: _memset.LIBCMT ref: 00077983
                                    • _memmove.LIBCMT ref: 00076EAB
                                    • _memset.LIBCMT ref: 00076EB8
                                    • LeaveCriticalSection.KERNEL32(?), ref: 00076EC8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CriticalSection_memset$EnterLeave_memmove
                                    • String ID:
                                    • API String ID: 48991266-0
                                    • Opcode ID: 4835be5816a9205a3f09a0527b4e63986c8ca5564816a3ad2909c713eaa72b5a
                                    • Instruction ID: 55d1e788d610630b356d797a1d6bdc6ac955c2e4fd5ee55f020324a41d198419
                                    • Opcode Fuzzy Hash: 4835be5816a9205a3f09a0527b4e63986c8ca5564816a3ad2909c713eaa72b5a
                                    • Instruction Fuzzy Hash: A9F0543A100200ABCF016F55DC85B9ABB29EF45360F04C065FE0C9E217C735A911CBB4
                                    Function 0009C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 000112F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0001134D
                                      • Part of subcall function 000112F3: SelectObject.GDI32(?,00000000), ref: 0001135C
                                      • Part of subcall function 000112F3: BeginPath.GDI32(?), ref: 00011373
                                      • Part of subcall function 000112F3: SelectObject.GDI32(?,00000000), ref: 0001139C
                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0009C030
                                    • LineTo.GDI32(00000000,?,?), ref: 0009C03D
                                    • EndPath.GDI32(00000000), ref: 0009C04D
                                    • StrokePath.GDI32(00000000), ref: 0009C05B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                    • String ID:
                                    • API String ID: 1539411459-0
                                    • Opcode ID: 05783bdcd074b6aa7dcd3825be2b716291540dd0a6ef2fff32e042d0526c8a87
                                    • Instruction ID: dee6714bfdb7390aa38a10be425a018dfc0cd6dca3f031589a1a264d8facb5f5
                                    • Opcode Fuzzy Hash: 05783bdcd074b6aa7dcd3825be2b716291540dd0a6ef2fff32e042d0526c8a87
                                    • Instruction Fuzzy Hash: C3F05E3100525ABBEB226F95EC0AFDE3F99BF45311F144102FA11A10E2CB795661DFE5
                                    Function 0006A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0006A399
                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0006A3AC
                                    • GetCurrentThreadId.KERNEL32 ref: 0006A3B3
                                    • AttachThreadInput.USER32(00000000), ref: 0006A3BA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                    • String ID:
                                    • API String ID: 2710830443-0
                                    • Opcode ID: e4a1068d04e0067859b4a2c8e0011f614f3aa4a868a3f5139d458c37e89afe74
                                    • Instruction ID: 21a95b02b273f838a5a066f502e2ff41cf2885f531f534945b8926be3e332711
                                    • Opcode Fuzzy Hash: e4a1068d04e0067859b4a2c8e0011f614f3aa4a868a3f5139d458c37e89afe74
                                    • Instruction Fuzzy Hash: F4E0C972645339BAEB206BA2DC0DEEB7F5DFF167A1F008026F609E5060C6758640DBA1
                                    Function 00012218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetSysColor.USER32(00000008), ref: 00012231
                                    • SetTextColor.GDI32(?,000000FF), ref: 0001223B
                                    • SetBkMode.GDI32(?,00000001), ref: 00012250
                                    • GetStockObject.GDI32(00000005), ref: 00012258
                                    • GetWindowDC.USER32(?,00000000), ref: 0004C0D3
                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0004C0E0
                                    • GetPixel.GDI32(00000000,?,00000000), ref: 0004C0F9
                                    • GetPixel.GDI32(00000000,00000000,?), ref: 0004C112
                                    • GetPixel.GDI32(00000000,?,?), ref: 0004C132
                                    • ReleaseDC.USER32(?,00000000), ref: 0004C13D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                    • String ID:
                                    • API String ID: 1946975507-0
                                    • Opcode ID: 24116d4b481bee2625759cd7fc8a630832f37ec3303136d989e0ef6447d2f720
                                    • Instruction ID: d90ec150d7fc595f814cdfb65c078e81cbe427559f2998d1320923bdcbba4ebf
                                    • Opcode Fuzzy Hash: 24116d4b481bee2625759cd7fc8a630832f37ec3303136d989e0ef6447d2f720
                                    • Instruction Fuzzy Hash: 94E03972204245EAEB615F64EC09BE83B50EB06332F108377FA79880E187754990DB51
                                    Function 00068C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCurrentThread.KERNEL32 ref: 00068C63
                                    • OpenThreadToken.ADVAPI32(00000000,?,?,?,0006882E), ref: 00068C6A
                                    • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0006882E), ref: 00068C77
                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,0006882E), ref: 00068C7E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CurrentOpenProcessThreadToken
                                    • String ID:
                                    • API String ID: 3974789173-0
                                    • Opcode ID: fe383d1a564d15a67d66f264fbcc17611ad64a942c2210911a0c3c081a4b02a3
                                    • Instruction ID: c3fe622df7783fde9729b739f9975681cc26e8d076e2fd7ea14b30d1bf597507
                                    • Opcode Fuzzy Hash: fe383d1a564d15a67d66f264fbcc17611ad64a942c2210911a0c3c081a4b02a3
                                    • Instruction Fuzzy Hash: B3E08676642212DBE7605FB06D0DB663BACFF907A2F148929B245D9080DA788441CB61
                                    Function 00052187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetDesktopWindow.USER32 ref: 00052187
                                    • GetDC.USER32(00000000), ref: 00052191
                                    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 000521B1
                                    • ReleaseDC.USER32(?), ref: 000521D2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CapsDesktopDeviceReleaseWindow
                                    • String ID:
                                    • API String ID: 2889604237-0
                                    • Opcode ID: 0616a80e7fe8e5e801555361533cdd8cd43fdf524bb043650f60de3dae14647e
                                    • Instruction ID: 771467f3c0838a1ffa8f0af4bab0a4ef30f5da8fc807e66303a25af2a6253162
                                    • Opcode Fuzzy Hash: 0616a80e7fe8e5e801555361533cdd8cd43fdf524bb043650f60de3dae14647e
                                    • Instruction Fuzzy Hash: 20E0E575840705EFEB119FA0C808AAE7BB5FF5C351F208426F95AD7260CB7881819F40
                                    Function 0005219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetDesktopWindow.USER32 ref: 0005219B
                                    • GetDC.USER32(00000000), ref: 000521A5
                                    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 000521B1
                                    • ReleaseDC.USER32(?), ref: 000521D2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CapsDesktopDeviceReleaseWindow
                                    • String ID:
                                    • API String ID: 2889604237-0
                                    • Opcode ID: 26eae292f244d928117bcea613885653227e19100209326a6c74fb2fd99582a4
                                    • Instruction ID: 9ec48c46a5052eecc01e6698cce0647847a8c01b34220b9102407ae1c45a5623
                                    • Opcode Fuzzy Hash: 26eae292f244d928117bcea613885653227e19100209326a6c74fb2fd99582a4
                                    • Instruction Fuzzy Hash: 89E0E575800305AFEB119FA0C8086AD7BA5BB4C310F208426F95AD7260CB7891419F40
                                    Function 000163A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: %
                                    • API String ID: 0-3960974693
                                    • Opcode ID: 6ee7ed382505607db55a1ad38bda3c62d47eb805a9e828dfba333513f1fe8baf
                                    • Instruction ID: b842ed96b154c268eb1b977bb3a7c682fcc2f2627a75f106f2518ef83dc2ea8e
                                    • Opcode Fuzzy Hash: 6ee7ed382505607db55a1ad38bda3c62d47eb805a9e828dfba333513f1fe8baf
                                    • Instruction Fuzzy Hash: F4B1A1719002099BCF24EF98CC859FEB7B9FF44310F50412AE906A7296DB329EC2CB55
                                    Function 0008B1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __itow_s
                                    • String ID: xr$xr
                                    • API String ID: 3653519197-3936046849
                                    • Opcode ID: 556d87fb3ad0ba4bef46a9ad799843f0d1f8cfab6641aba1674b7bdd5cd03507
                                    • Instruction ID: 700710305d83ad432abcecb282752ebba9bafc22e379f02563c2c5a03eaf5c5d
                                    • Opcode Fuzzy Hash: 556d87fb3ad0ba4bef46a9ad799843f0d1f8cfab6641aba1674b7bdd5cd03507
                                    • Instruction Fuzzy Hash: 04B14070A04205AFDB24EF54C891EEEB7F9FF58300F148459F9859B252EB75EA81CB60
                                    Function 0007B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0002FEC6: _wcscpy.LIBCMT ref: 0002FEE9
                                      • Part of subcall function 00019997: __itow.LIBCMT ref: 000199C2
                                      • Part of subcall function 00019997: __swprintf.LIBCMT ref: 00019A0C
                                    • __wcsnicmp.LIBCMT ref: 0007B298
                                    • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0007B361
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                    • String ID: LPT
                                    • API String ID: 3222508074-1350329615
                                    • Opcode ID: 20c772eb7078d0eeca13810fcaedbbaf0691ddb3db58483d4df91d6319597f8b
                                    • Instruction ID: d06dce225ba8786d00b9beed975dbbd5e717fff1b25c5776f8c8a04028231cd2
                                    • Opcode Fuzzy Hash: 20c772eb7078d0eeca13810fcaedbbaf0691ddb3db58483d4df91d6319597f8b
                                    • Instruction Fuzzy Hash: 80615175E00215AFCB14DF94C895FEEB7F4AF08310F11816AF54AAB252DB74AE80CB55
                                    Function 00022AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • Sleep.KERNEL32(00000000), ref: 00022AC8
                                    • GlobalMemoryStatusEx.KERNEL32(?), ref: 00022AE1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: GlobalMemorySleepStatus
                                    • String ID: @
                                    • API String ID: 2783356886-2766056989
                                    • Opcode ID: 7b089668d416741b3afdc462f399fdfa0b9f3436dd23ae2360fba80d2ed7b88a
                                    • Instruction ID: 1c9af53ceb66044446c607f45e588ec51a5b581bbb619c357068032e3cb7c6a8
                                    • Opcode Fuzzy Hash: 7b089668d416741b3afdc462f399fdfa0b9f3436dd23ae2360fba80d2ed7b88a
                                    • Instruction Fuzzy Hash: 965147714187449BE320AF10DC96BEBBBF8FF84310F82885DF2D9411A2DB358569CB66
                                    Function 000799BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0001506B: __fread_nolock.LIBCMT ref: 00015089
                                    • _wcscmp.LIBCMT ref: 00079AAE
                                    • _wcscmp.LIBCMT ref: 00079AC1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: _wcscmp$__fread_nolock
                                    • String ID: FILE
                                    • API String ID: 4029003684-3121273764
                                    • Opcode ID: 941a5880834fda8e17e65128ef08abd25a2be9e4f5962ec75a73ec7e59f87467
                                    • Instruction ID: 5bf0e914898c8b8a1234a5119bcee01841c7c415887a942287c4080011d5bbfd
                                    • Opcode Fuzzy Hash: 941a5880834fda8e17e65128ef08abd25a2be9e4f5962ec75a73ec7e59f87467
                                    • Instruction Fuzzy Hash: 7641F671A00609BADF219BA4CC86FEFB7FDDF49710F004069B904AB182DB75AA4487A5
                                    Function 0005099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClearVariant
                                    • String ID: Dt$Dt
                                    • API String ID: 1473721057-673896520
                                    • Opcode ID: b632d72debaa5482d4fd408f8cfeb09a11367fc4bb86cd676962b6766525187c
                                    • Instruction ID: eb645c64f532c945552c49d289f03c19e4cf33766507a36886e19119f1f00598
                                    • Opcode Fuzzy Hash: b632d72debaa5482d4fd408f8cfeb09a11367fc4bb86cd676962b6766525187c
                                    • Instruction Fuzzy Hash: BD51E47870A3428FD794CF19C580A6ABBE1BF9A354F54485DF9858B321E331EC85CB92
                                    Function 00082882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00082892
                                    • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 000828C8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CrackInternet_memset
                                    • String ID: |
                                    • API String ID: 1413715105-2343686810
                                    • Opcode ID: c6e846b12368ed58b57f6b65906fb6facac799c865b440688eecfae5f3984024
                                    • Instruction ID: 293d7dc406d7167815488d76e6d3229c8cdb3527ebdb6a539afe35176fffa03f
                                    • Opcode Fuzzy Hash: c6e846b12368ed58b57f6b65906fb6facac799c865b440688eecfae5f3984024
                                    • Instruction Fuzzy Hash: CD312D71801119AFCF11EFA1CC85EEEBFB9FF09310F10406AF855A6166DB315A96DBA0
                                    Function 00096CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                    Download Yara Rule
                                    APIs
                                    • DestroyWindow.USER32(?,?,?,?), ref: 00096D86
                                    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00096DC2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$DestroyMove
                                    • String ID: static
                                    • API String ID: 2139405536-2160076837
                                    • Opcode ID: 1bab251e5c9750c7f03f5bfdcd57ae842260ea0e94328df21567b123ce15c737
                                    • Instruction ID: 1d49b526f69000b1455a0b8f637c47ce677732e313bfe4c63881005dda24ef7d
                                    • Opcode Fuzzy Hash: 1bab251e5c9750c7f03f5bfdcd57ae842260ea0e94328df21567b123ce15c737
                                    • Instruction Fuzzy Hash: 1D31AD71600604AEEF109F68CC80AFB73B9FF48720F508619F9A5C7191CA32AC91EB60
                                    Function 00072D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00072E00
                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00072E3B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: InfoItemMenu_memset
                                    • String ID: 0
                                    • API String ID: 2223754486-4108050209
                                    • Opcode ID: 9ad1b93d56c3af17ca7df704db302a0b33ca35e6f4931264932fc61fb0532c48
                                    • Instruction ID: f229bbdd77b80dbc62cc0abad83d2299fe0591117e7920c4e181d7c8503c9d5b
                                    • Opcode Fuzzy Hash: 9ad1b93d56c3af17ca7df704db302a0b33ca35e6f4931264932fc61fb0532c48
                                    • Instruction Fuzzy Hash: F931D731E00305ABEB758F58C8457EEBBF9FF05350F14842AE9C9961A1D778A980CB59
                                    Function 00096943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 000969D0
                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 000969DB
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: MessageSend
                                    • String ID: Combobox
                                    • API String ID: 3850602802-2096851135
                                    • Opcode ID: 27ceeb95326029ad3bd7dc7efbf9f9b2ca7e50a77e2cb9a81f0a1dad68d34e80
                                    • Instruction ID: 909c8a8d1c5cb3fe6c9276f3c50a3941259ab6ff4536da53fcea31f857298c1a
                                    • Opcode Fuzzy Hash: 27ceeb95326029ad3bd7dc7efbf9f9b2ca7e50a77e2cb9a81f0a1dad68d34e80
                                    • Instruction Fuzzy Hash: 1711E2712002086FEF118F24CC80EFB37AEEB893A4F100125F9589B290D6329C50A7A0
                                    Function 00096E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00011D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00011D73
                                      • Part of subcall function 00011D35: GetStockObject.GDI32(00000011), ref: 00011D87
                                      • Part of subcall function 00011D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00011D91
                                    • GetWindowRect.USER32(00000000,?), ref: 00096EE0
                                    • GetSysColor.USER32(00000012), ref: 00096EFA
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Window$ColorCreateMessageObjectRectSendStock
                                    • String ID: static
                                    • API String ID: 1983116058-2160076837
                                    • Opcode ID: c323674da03baa6895a79363e81106c321d926144f4b059349e2ff2d798d0b17
                                    • Instruction ID: 0dc69a35855e4e38204ee94955cd2d8882237600e2191a1af8ad49bd9f630aa7
                                    • Opcode Fuzzy Hash: c323674da03baa6895a79363e81106c321d926144f4b059349e2ff2d798d0b17
                                    • Instruction Fuzzy Hash: D421447261020AAFDF04DFA8DD45AFA7BA8FB08314F014629FA55D2250E635A861AB60
                                    Function 00096B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetWindowTextLengthW.USER32(00000000), ref: 00096C11
                                    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00096C20
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: LengthMessageSendTextWindow
                                    • String ID: edit
                                    • API String ID: 2978978980-2167791130
                                    • Opcode ID: d805faf07e3bf75d2b1c6f181ba698cb9e4b4b27aafd676fcf14d26e6277d35f
                                    • Instruction ID: 542cb0b15f0d83c327dde6e4577d95ef6efd919932dc46b712fa6fc2554f0807
                                    • Opcode Fuzzy Hash: d805faf07e3bf75d2b1c6f181ba698cb9e4b4b27aafd676fcf14d26e6277d35f
                                    • Instruction Fuzzy Hash: DE11BCB1100208ABEF508E64DC41EFB37A9EB04378F204724FA60D71E0D736DC90AB60
                                    Function 00072E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • _memset.LIBCMT ref: 00072F11
                                    • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00072F30
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: InfoItemMenu_memset
                                    • String ID: 0
                                    • API String ID: 2223754486-4108050209
                                    • Opcode ID: 050300cc3ef93b06eb74eb1791dfdd9880eae145a627e6a2b34cc670e0191403
                                    • Instruction ID: 98c8fb646d73b4df735c8b4ac514b5f33501b9c28efc0c7a18e4690e108be81c
                                    • Opcode Fuzzy Hash: 050300cc3ef93b06eb74eb1791dfdd9880eae145a627e6a2b34cc670e0191403
                                    • Instruction Fuzzy Hash: 8311E631D01154ABDB60EB58DC44BAE73F9EB01310F1580B6EC48A72A0DBB8AD04CB99
                                    Function 000824CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00082520
                                    • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00082549
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Internet$OpenOption
                                    • String ID: <local>
                                    • API String ID: 942729171-4266983199
                                    • Opcode ID: e3b8f8b4047bd7e07b20790e1202e1d0367a76d7f10da1a46969a1358beefb2a
                                    • Instruction ID: 83d21ba88d728d6bdc37d4a0a5cc7e661dbb5bad23ddd7bb68e97ca8cf1c66df
                                    • Opcode Fuzzy Hash: e3b8f8b4047bd7e07b20790e1202e1d0367a76d7f10da1a46969a1358beefb2a
                                    • Instruction Fuzzy Hash: D51102B0140625BADB24AF518C98FBBFFA8FF06361F10812AF98586040D2706990DBF0
                                    Function 000880A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0008830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,000880C8,?,00000000,?,?), ref: 00088322
                                    • inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000880CB
                                    • htons.WSOCK32(00000000,?,00000000), ref: 00088108
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWidehtonsinet_addr
                                    • String ID: 255.255.255.255
                                    • API String ID: 2496851823-2422070025
                                    • Opcode ID: 30df67e5b81c0566a6ebe7e7f0d10a965b60db98e00ffd1201b8aa4d02186e09
                                    • Instruction ID: 32d51acc8e3d58b6ebcbde0ca31a0d691aa94402f7769399fc2131e3e678ea05
                                    • Opcode Fuzzy Hash: 30df67e5b81c0566a6ebe7e7f0d10a965b60db98e00ffd1201b8aa4d02186e09
                                    • Instruction Fuzzy Hash: 0E118234604205ABDB20AFA4CC46FFDB365FF45310F508516E951972D2DE72A815CB95
                                    Function 00020A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00013C26,000D62F8,?,?,?), ref: 00020ACE
                                      • Part of subcall function 00017D2C: _memmove.LIBCMT ref: 00017D66
                                    • _wcscat.LIBCMT ref: 000550E1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: FullNamePath_memmove_wcscat
                                    • String ID: c
                                    • API String ID: 257928180-3562065989
                                    • Opcode ID: 18c0421323cecd2965cd2998db92ff2a95ab0305c84cb8d4d5a7abea68229ad1
                                    • Instruction ID: a8849bf7b3eb7b47ee8d12f61c51036a15c764a169a7191f7f09e873201e6a58
                                    • Opcode Fuzzy Hash: 18c0421323cecd2965cd2998db92ff2a95ab0305c84cb8d4d5a7abea68229ad1
                                    • Instruction Fuzzy Hash: CF11527590431C9BCB51EBA4EC41ADD77F8EF08350B0040A6B94CD7253EA759B888B61
                                    Function 000692E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 0006B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0006B0E7
                                    • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00069355
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClassMessageNameSend_memmove
                                    • String ID: ComboBox$ListBox
                                    • API String ID: 372448540-1403004172
                                    • Opcode ID: be0c733ad89e69f1774effd0b759bed4591cc33e576e5e1d8095351dc1abd78e
                                    • Instruction ID: a985891b3586709bc56e37d9e79e54260c1de0e207de4c99df5f95fb4746cf57
                                    • Opcode Fuzzy Hash: be0c733ad89e69f1774effd0b759bed4591cc33e576e5e1d8095351dc1abd78e
                                    • Instruction Fuzzy Hash: 2A01B171A45224ABCB04EBA4CC91CFF77AEBF46320B540619F9329B3D2DB3159488750
                                    Function 000691DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 0006B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0006B0E7
                                    • SendMessageW.USER32(?,00000180,00000000,?), ref: 0006924D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClassMessageNameSend_memmove
                                    • String ID: ComboBox$ListBox
                                    • API String ID: 372448540-1403004172
                                    • Opcode ID: 3e4b874769f5ac5fa94a88c6a3d44b7a740b43a18f6f18b009685f5b46645aaf
                                    • Instruction ID: 730b4a285c193621706a4197970923fb1c3e7a64a0a0e64a4920f8c8426fbcb0
                                    • Opcode Fuzzy Hash: 3e4b874769f5ac5fa94a88c6a3d44b7a740b43a18f6f18b009685f5b46645aaf
                                    • Instruction Fuzzy Hash: 1101F771A41205BBCB14EBA0C8A2EFF77AD9F45300F140129B91267682EB205F0C8271
                                    Function 00069264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00017F41: _memmove.LIBCMT ref: 00017F82
                                      • Part of subcall function 0006B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0006B0E7
                                    • SendMessageW.USER32(?,00000182,?,00000000), ref: 000692D0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClassMessageNameSend_memmove
                                    • String ID: ComboBox$ListBox
                                    • API String ID: 372448540-1403004172
                                    • Opcode ID: 83c9a72032e026f8c59437122fefa4f11919929495e7dde26d2a261a8382730b
                                    • Instruction ID: 39557d0320d01d6bd4b4d811b767eeef8c94aceca919a7979e6d6d8433277de9
                                    • Opcode Fuzzy Hash: 83c9a72032e026f8c59437122fefa4f11919929495e7dde26d2a261a8382730b
                                    • Instruction Fuzzy Hash: CC01D6B1A81209B7DF14EBA0C992EFF77AD9F11300F640129B912A7683DB315F4C9672
                                    Function 00036DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: __calloc_crt
                                    • String ID: @R
                                    • API String ID: 3494438863-2045188025
                                    • Opcode ID: 564703b293026feb8a9a410c232b025e6aa064c9423de8cf532d1f7a5a86ac19
                                    • Instruction ID: eedb33a677f157921d1ab16babd8400f6b03b3ccacffb520b92ce6fddb9c0f6a
                                    • Opcode Fuzzy Hash: 564703b293026feb8a9a410c232b025e6aa064c9423de8cf532d1f7a5a86ac19
                                    • Instruction Fuzzy Hash: 61F04F71709B16ABF7258B59FD01BB52799E711720F10842BE500CA291EF7A988186A5
                                    Function 000751CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: ClassName_wcscmp
                                    • String ID: #32770
                                    • API String ID: 2292705959-463685578
                                    • Opcode ID: 57c48a4ec96dd66d98f6c3b9331a4c9ba26460acdf15aeefcc7ba511e0d1becf
                                    • Instruction ID: a6bf2f4e8b85eab8d016f48d77ebe8f460606210fbd7e87c5a642aa07278edb5
                                    • Opcode Fuzzy Hash: 57c48a4ec96dd66d98f6c3b9331a4c9ba26460acdf15aeefcc7ba511e0d1becf
                                    • Instruction Fuzzy Hash: 78E06832A0432D2BE3209B99AC4AFE7F7ECEB41771F00006BFD18D7051E5A49A058BE1
                                    Function 000681BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 000681CA
                                      • Part of subcall function 00033598: _doexit.LIBCMT ref: 000335A2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: Message_doexit
                                    • String ID: AutoIt$Error allocating memory.
                                    • API String ID: 1993061046-4017498283
                                    • Opcode ID: a597501e1128be148221ecd4fa2387d20095cc168a460584e5314daa1add3cbf
                                    • Instruction ID: 25b57a0484a829fb71ed831427393ea30eae895bd847e34259a3c7ba69c083ba
                                    • Opcode Fuzzy Hash: a597501e1128be148221ecd4fa2387d20095cc168a460584e5314daa1add3cbf
                                    • Instruction Fuzzy Hash: F3D05B323C531832D21533E56C0BFC9758C4B09B52F004026BB08995D38ED555D142D9
                                    Function 0004B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 0004B564: _memset.LIBCMT ref: 0004B571
                                      • Part of subcall function 00030B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0004B540,?,?,?,0001100A), ref: 00030B89
                                    • IsDebuggerPresent.KERNEL32(?,?,?,0001100A), ref: 0004B544
                                    • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0001100A), ref: 0004B553
                                    Strings
                                    • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0004B54E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2810003201.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true
                                    • Associated: 00000000.00000002.2809859170.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.000000000009F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810114706.00000000000C5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810289009.00000000000CF000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2810310523.00000000000D8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_10000_cnaniAxghZ.jbxd
                                    Similarity
                                    • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                    • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                    • API String ID: 3158253471-631824599
                                    • Opcode ID: 0b968948c1e16c32ad93c5c248f92e1c20d869de18dfd0397fc26ef54ff830ce
                                    • Instruction ID: e36667b26aa6976d91abfaefc7b74c33fa4f9da1d0bf695f12971d6ca2218599
                                    • Opcode Fuzzy Hash: 0b968948c1e16c32ad93c5c248f92e1c20d869de18dfd0397fc26ef54ff830ce
                                    • Instruction Fuzzy Hash: EDE06DB0200B118BE321DF29D404392BBE4AB04744F00893DE496C6661D7B9D444CB61