Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1lAxaLKP7E.exe

Overview

General Information

Sample name:1lAxaLKP7E.exe
renamed because original name is a hash value
Original sample name:91b60b1ae0b37343c671b632eb3e358d9a5029c9c6405556ba835528c67fd6d8.exe
Analysis ID:1504860
MD5:98c1a12ce79248bbdb4c8a65fc227e58
SHA1:259ae7a3d239a352db772433075f649d5fbda8e7
SHA256:91b60b1ae0b37343c671b632eb3e358d9a5029c9c6405556ba835528c67fd6d8
Tags:exe
Infos:

Detection

FormBook, XRed
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected XRed
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Contains functionality to detect sleep reduction / modifications
Found API chain indicative of sandbox detection
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May check if the current machine is a sandbox (GetTickCount - Sleep)
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries the installation date of Windows
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 1lAxaLKP7E.exe (PID: 6700 cmdline: "C:\Users\user\Desktop\1lAxaLKP7E.exe" MD5: 98C1A12CE79248BBDB4C8A65FC227E58)
    • svchost.exe (PID: 6888 cmdline: "C:\Users\user\Desktop\1lAxaLKP7E.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • ._cache_svchost.exe (PID: 7028 cmdline: "C:\Users\user\Desktop\._cache_svchost.exe" MD5: 8A4835835C59FDB159CF2F3EF7CF2907)
      • Synaptics.exe (PID: 7112 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
  • Synaptics.exe (PID: 6456 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_XRedYara detected XRedJoe Security
    00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
      00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x2ddc3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0x15ed2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_XRedYara detected XRedJoe Security
          Click to see the 6 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          2.2.._cache_svchost.exe.630000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.._cache_svchost.exe.630000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2dfc3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x160d2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
            0.2.1lAxaLKP7E.exe.3640000.1.unpackJoeSecurity_XRedYara detected XRedJoe Security
              0.2.1lAxaLKP7E.exe.3640000.1.unpackJoeSecurity_DelphiSystemParamCountDetected Delphi use of System.ParamCount()Joe Security
                1.2.svchost.exe.400000.0.raw.unpackJoeSecurity_XRedYara detected XRedJoe Security
                  Click to see the 5 entries

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: Uncommon Svchost Parent Process
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\1lAxaLKP7E.exe", CommandLine: "C:\Users\user\Desktop\1lAxaLKP7E.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\1lAxaLKP7E.exe", ParentImage: C:\Users\user\Desktop\1lAxaLKP7E.exe, ParentProcessId: 6700, ParentProcessName: 1lAxaLKP7E.exe, ProcessCommandLine: "C:\Users\user\Desktop\1lAxaLKP7E.exe", ProcessId: 6888, ProcessName: svchost.exe
                  Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6888, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver
                  Sigma detected: Windows Processes Suspicious Parent Directory
                  Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\1lAxaLKP7E.exe", CommandLine: "C:\Users\user\Desktop\1lAxaLKP7E.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\1lAxaLKP7E.exe", ParentImage: C:\Users\user\Desktop\1lAxaLKP7E.exe, ParentProcessId: 6700, ParentProcessName: 1lAxaLKP7E.exe, ProcessCommandLine: "C:\Users\user\Desktop\1lAxaLKP7E.exe", ProcessId: 6888, ProcessName: svchost.exe

                  Suricata Signatures

                  ⊘No Suricata rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus detection for URL or domain
                  Source: http://xred.site50.net/syn/SSLLibrary.dllAvira URL Cloud: Label: malware
                  Antivirus detection for dropped file
                  Source: C:\Users\user\Desktop\._cache_svchost.exeAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
                  Multi AV Scanner detection for dropped file
                  Source: C:\Users\user\Desktop\._cache_svchost.exeReversingLabs: Detection: 87%
                  Multi AV Scanner detection for submitted file
                  Source: 1lAxaLKP7E.exeReversingLabs: Detection: 65%
                  Yara detected FormBook
                  Source: Yara matchFile source: 2.2.._cache_svchost.exe.630000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Machine Learning detection for dropped file
                  Source: C:\Users\user\Desktop\._cache_svchost.exeJoe Sandbox ML: detected
                  Machine Learning detection for sample
                  Source: 1lAxaLKP7E.exeJoe Sandbox ML: detected
                  Source: 1lAxaLKP7E.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: Binary string: wntdll.pdbUGP source: 1lAxaLKP7E.exe, 00000000.00000003.1814634487.0000000003860000.00000004.00001000.00020000.00000000.sdmp, 1lAxaLKP7E.exe, 00000000.00000003.1813379686.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000003.2147879512.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.0000000001190000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.000000000132E000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000003.2145891846.0000000000D25000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: 1lAxaLKP7E.exe, 00000000.00000003.1814634487.0000000003860000.00000004.00001000.00020000.00000000.sdmp, 1lAxaLKP7E.exe, 00000000.00000003.1813379686.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, ._cache_svchost.exe, 00000002.00000003.2147879512.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.0000000001190000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.000000000132E000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000003.2145891846.0000000000D25000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: svchost.pdb source: svchost.exe, 00000001.00000003.1819565454.0000000003099000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1823129114.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe, 00000007.00000002.1946319184.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe.1.dr
                  Source: Binary string: svchost.pdbUGP source: svchost.exe, 00000001.00000003.1819565454.0000000003099000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1823129114.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe, 00000007.00000002.1946319184.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe.1.dr
                  Source: 1lAxaLKP7E.exe, 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: [autorun]
                  Source: 1lAxaLKP7E.exe, 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: [autorun]
                  Source: 1lAxaLKP7E.exe, 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: autorun.inf
                  Source: svchost.exeBinary or memory string: autorun.inf
                  Source: svchost.exeBinary or memory string: [autorun]
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: [autorun]
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: [autorun]
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: autorun.inf
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_006DDBBE
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E68EE FindFirstFileW,FindClose,0_2_006E68EE
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_006E698F
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006DD076
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006DD3A9
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006E9642
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006E979D
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_006E9B2B
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_006E5C97
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004099E0 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,1_2_004099E0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00406018 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,1_2_00406018
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00409B1C FindFirstFileA,GetLastError,1_2_00409B1C
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\userJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet ExplorerJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.iniJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppDataJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006ECE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_006ECE44
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmp, svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xred.site50.net/syn/SUpdate.iniH)
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloX
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=T
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl
                  Source: svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
                  Source: svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006EEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_006EEAFF
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006EED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_006EED6A
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006EEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_006EEAFF
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00429040 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,1_2_00429040
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_006DAA57
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00709576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00709576
                  Source: Yara matchFile source: Process Memory Space: 1lAxaLKP7E.exe PID: 6700, type: MEMORYSTR

                  E-Banking Fraud

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 2.2.._cache_svchost.exe.630000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: 2.2.._cache_svchost.exe.630000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                  Source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                  Source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                  Binary is likely a compiled AutoIt script file
                  Source: 1lAxaLKP7E.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                  Source: 1lAxaLKP7E.exe, 00000000.00000000.1725274560.0000000000732000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_95e16eda-3
                  Source: 1lAxaLKP7E.exe, 00000000.00000000.1725274560.0000000000732000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_089325fa-6
                  Source: 1lAxaLKP7E.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_b4728bad-d
                  Source: 1lAxaLKP7E.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_c48f032d-1
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0043F118 NtdllDefWindowProc_A,GetCapture,1_2_0043F118
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004598AC NtdllDefWindowProc_A,1_2_004598AC
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0045A054 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,1_2_0045A054
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0045A104 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,1_2_0045A104
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0045E9EC SHGetPathFromIDList,SHGetPathFromIDList,NtdllDefWindowProc_A,1_2_0045E9EC
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0044EA40 GetSubMenu,SaveDC,RestoreDC,GetWindowDC,SaveDC,RestoreDC,NtdllDefWindowProc_A,1_2_0044EA40
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042F60C NtdllDefWindowProc_A,1_2_0042F60C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0065C083 NtClose,2_2_0065C083
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202B60 NtClose,LdrInitializeThunk,2_2_01202B60
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_01202DF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_01202C70
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012035C0 NtCreateMutant,LdrInitializeThunk,2_2_012035C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01204340 NtSetContextThread,2_2_01204340
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01204650 NtSuspendThread,2_2_01204650
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202BA0 NtEnumerateValueKey,2_2_01202BA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202B80 NtQueryInformationFile,2_2_01202B80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202BE0 NtQueryValueKey,2_2_01202BE0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202BF0 NtAllocateVirtualMemory,2_2_01202BF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202AB0 NtWaitForSingleObject,2_2_01202AB0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202AF0 NtWriteFile,2_2_01202AF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202AD0 NtReadFile,2_2_01202AD0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202D30 NtUnmapViewOfSection,2_2_01202D30
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202D00 NtSetInformationFile,2_2_01202D00
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202D10 NtMapViewOfSection,2_2_01202D10
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202DB0 NtEnumerateKey,2_2_01202DB0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202DD0 NtDelayExecution,2_2_01202DD0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202C00 NtQueryInformationProcess,2_2_01202C00
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202C60 NtCreateKey,2_2_01202C60
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202CA0 NtQueryInformationToken,2_2_01202CA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202CF0 NtOpenProcess,2_2_01202CF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202CC0 NtQueryVirtualMemory,2_2_01202CC0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202F30 NtCreateSection,2_2_01202F30
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202F60 NtCreateProcessEx,2_2_01202F60
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202FA0 NtQuerySection,2_2_01202FA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202FB0 NtResumeThread,2_2_01202FB0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202F90 NtProtectVirtualMemory,2_2_01202F90
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202FE0 NtCreateFile,2_2_01202FE0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202E30 NtWriteVirtualMemory,2_2_01202E30
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202EA0 NtAdjustPrivilegesToken,2_2_01202EA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202E80 NtReadVirtualMemory,2_2_01202E80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202EE0 NtQueueApcThread,2_2_01202EE0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01203010 NtOpenDirectoryObject,2_2_01203010
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01203090 NtSetValueKey,2_2_01203090
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012039B0 NtGetContextThread,2_2_012039B0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01203D10 NtOpenProcessToken,2_2_01203D10
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01203D70 NtOpenThread,2_2_01203D70
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DD5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_006DD5EB
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_006D1201
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_006DE8F6
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0067CAF00_2_0067CAF0
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0067BF400_2_0067BF40
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006780600_2_00678060
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E20460_2_006E2046
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D82980_2_006D8298
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006AE4FF0_2_006AE4FF
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006A676B0_2_006A676B
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_007048730_2_00704873
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0069CAA00_2_0069CAA0
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0068CC390_2_0068CC39
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006A6DD90_2_006A6DD9
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0068D0650_2_0068D065
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0068B1190_2_0068B119
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006791C00_2_006791C0
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006913940_2_00691394
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006917060_2_00691706
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0069781B0_2_0069781B
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0068997D0_2_0068997D
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006779200_2_00677920
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006919B00_2_006919B0
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00697A4A0_2_00697A4A
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00691C770_2_00691C77
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00697CA70_2_00697CA7
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006FBE440_2_006FBE44
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006A9EEE0_2_006A9EEE
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00691F320_2_00691F32
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00CA35D00_2_00CA35D0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004601F01_2_004601F0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0046C7CC1_2_0046C7CC
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0048C7F41_2_0048C7F4
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0044EA401_2_0044EA40
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00496E181_2_00496E18
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0046B1E41_2_0046B1E4
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0045FCC81_2_0045FCC8
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00453DA41_2_00453DA4
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_006310002_2_00631000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0063F8A32_2_0063F8A3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_006311302_2_00631130
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_006462432_2_00646243
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0063FAC32_2_0063FAC3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_006312802_2_00631280
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0063DB432_2_0063DB43
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_00631BF72_2_00631BF7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_006324202_2_00632420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_00631C002_2_00631C00
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0065E6B32_2_0065E6B3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_00632FA02_2_00632FA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C01002_2_011C0100
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126A1182_2_0126A118
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012581582_2_01258158
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012901AA2_2_012901AA
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012881CC2_2_012881CC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012620002_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128A3522_2_0128A352
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012903E62_2_012903E6
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE3F02_2_011DE3F0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012702742_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012502C02_2_012502C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D05352_2_011D0535
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012905912_2_01290591
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012744202_2_01274420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012824462_2_01282446
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127E4F62_2_0127E4F6
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F47502_2_011F4750
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D07702_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CC7C02_2_011CC7C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EC6E02_2_011EC6E0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E69622_2_011E6962
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0129A9A62_2_0129A9A6
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A02_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DA8402_2_011DA840
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D28402_2_011D2840
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B68B82_2_011B68B8
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE8F02_2_011FE8F0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128AB402_2_0128AB40
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01286BD72_2_01286BD7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA802_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DAD002_2_011DAD00
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126CD1F2_2_0126CD1F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E8DBF2_2_011E8DBF
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CADE02_2_011CADE0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0C002_2_011D0C00
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270CB52_2_01270CB5
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0CF22_2_011C0CF2
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01212F282_2_01212F28
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01272F302_2_01272F30
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F0F302_2_011F0F30
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01244F402_2_01244F40
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124EFA02_2_0124EFA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C2FC82_2_011C2FC8
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128EE262_2_0128EE26
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0E592_2_011D0E59
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E2E902_2_011E2E90
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128CE932_2_0128CE93
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128EEDB2_2_0128EEDB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0129B16B2_2_0129B16B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0120516C2_2_0120516C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BF1722_2_011BF172
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DB1B02_2_011DB1B0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012870E92_2_012870E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128F0E02_2_0128F0E0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D70C02_2_011D70C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127F0CC2_2_0127F0CC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128132D2_2_0128132D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BD34C2_2_011BD34C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0121739A2_2_0121739A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D52A02_2_011D52A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012712ED2_2_012712ED
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EB2C02_2_011EB2C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012875712_2_01287571
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126D5B02_2_0126D5B0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128F43F2_2_0128F43F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C14602_2_011C1460
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128F7B02_2_0128F7B0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012816CC2_2_012816CC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012659102_2_01265910
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D99502_2_011D9950
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EB9502_2_011EB950
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123D8002_2_0123D800
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D38E02_2_011D38E0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128FB762_2_0128FB76
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EFB802_2_011EFB80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01245BF02_2_01245BF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0120DBF92_2_0120DBF9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01243A6C2_2_01243A6C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128FA492_2_0128FA49
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01287A462_2_01287A46
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01215AA02_2_01215AA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01271AA32_2_01271AA3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126DAAC2_2_0126DAAC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127DAC62_2_0127DAC6
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01287D732_2_01287D73
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D3D402_2_011D3D40
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01281D5A2_2_01281D5A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EFDC02_2_011EFDC0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01249C322_2_01249C32
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128FCF22_2_0128FCF2
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128FF092_2_0128FF09
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D1F922_2_011D1F92
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128FFB12_2_0128FFB1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D9EB02_2_011D9EB0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0049058C appears 56 times
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 004109E8 appears 34 times
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 004049C0 appears 73 times
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 004070F0 appears 81 times
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 00404CCC appears 54 times
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: String function: 01205130 appears 58 times
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: String function: 0123EA12 appears 86 times
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: String function: 0124F290 appears 105 times
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: String function: 01217E54 appears 100 times
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: String function: 011BB970 appears 265 times
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: String function: 00690A30 appears 46 times
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: String function: 0068F9F2 appears 31 times
                  Source: ._cache_svchost.exe.1.drStatic PE information: No import functions for PE file found
                  Source: 1lAxaLKP7E.exe, 00000000.00000003.1813235075.0000000003873000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 1lAxaLKP7E.exe
                  Source: 1lAxaLKP7E.exe, 00000000.00000003.1814350551.0000000003B2D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 1lAxaLKP7E.exe
                  Source: 1lAxaLKP7E.exe, 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs 1lAxaLKP7E.exe
                  Source: 1lAxaLKP7E.exe, 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameb! vs 1lAxaLKP7E.exe
                  Source: 1lAxaLKP7E.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: 2.2.._cache_svchost.exe.630000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                  Source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                  Source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                  Source: ._cache_svchost.exe.1.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: ._cache_svchost.exe.1.drStatic PE information: Section .text
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@8/6@0/0
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E37B5 GetLastError,FormatMessageW,0_2_006E37B5
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D10BF AdjustTokenPrivileges,CloseHandle,0_2_006D10BF
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_006D16C3
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00475958 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,GetLastError,1_2_00475958
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_006E51CD
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006FA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_006FA67C
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_006E648E
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006742A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_006742A2
                  Source: C:\Windows\SysWOW64\svchost.exeFile created: C:\Users\user\Desktop\._cache_svchost.exeJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeMutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeFile created: C:\Users\user\AppData\Local\Temp\aut6951.tmpJump to behavior
                  Source: Yara matchFile source: 0.2.1lAxaLKP7E.exe.3640000.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.1lAxaLKP7E.exe.3640000.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: 1lAxaLKP7E.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: C:\Windows\SysWOW64\svchost.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: 1lAxaLKP7E.exeReversingLabs: Detection: 65%
                  Source: unknownProcess created: C:\Users\user\Desktop\1lAxaLKP7E.exe "C:\Users\user\Desktop\1lAxaLKP7E.exe"
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\1lAxaLKP7E.exe"
                  Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Users\user\Desktop\._cache_svchost.exe "C:\Users\user\Desktop\._cache_svchost.exe"
                  Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                  Source: unknownProcess created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\1lAxaLKP7E.exe"Jump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Users\user\Desktop\._cache_svchost.exe "C:\Users\user\Desktop\._cache_svchost.exe" Jump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: wsock32.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: winmm.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wsock32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: twext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: ntshrui.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: cscapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: shacct.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: idstore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: starttiledata.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: acppage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: aepic.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: samlib.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wlidprov.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: samcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: provsvc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: twext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: ntshrui.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: starttiledata.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: acppage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: aepic.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Users\user\Desktop\._cache_svchost.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: 1lAxaLKP7E.exeStatic file information: File size 1904640 > 1048576
                  Source: 1lAxaLKP7E.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                  Source: 1lAxaLKP7E.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                  Source: 1lAxaLKP7E.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                  Source: 1lAxaLKP7E.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: 1lAxaLKP7E.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                  Source: 1lAxaLKP7E.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                  Source: 1lAxaLKP7E.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: wntdll.pdbUGP source: 1lAxaLKP7E.exe, 00000000.00000003.1814634487.0000000003860000.00000004.00001000.00020000.00000000.sdmp, 1lAxaLKP7E.exe, 00000000.00000003.1813379686.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000003.2147879512.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.0000000001190000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.000000000132E000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000003.2145891846.0000000000D25000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: 1lAxaLKP7E.exe, 00000000.00000003.1814634487.0000000003860000.00000004.00001000.00020000.00000000.sdmp, 1lAxaLKP7E.exe, 00000000.00000003.1813379686.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, ._cache_svchost.exe, 00000002.00000003.2147879512.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.0000000001190000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000002.2179114739.000000000132E000.00000040.00001000.00020000.00000000.sdmp, ._cache_svchost.exe, 00000002.00000003.2145891846.0000000000D25000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: svchost.pdb source: svchost.exe, 00000001.00000003.1819565454.0000000003099000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1823129114.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe, 00000007.00000002.1946319184.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe.1.dr
                  Source: Binary string: svchost.pdbUGP source: svchost.exe, 00000001.00000003.1819565454.0000000003099000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.1823129114.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe, 00000007.00000002.1946319184.0000000000071000.00000020.00000001.01000000.00000006.sdmp, Synaptics.exe.1.dr
                  Source: 1lAxaLKP7E.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                  Source: 1lAxaLKP7E.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                  Source: 1lAxaLKP7E.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                  Source: 1lAxaLKP7E.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                  Source: 1lAxaLKP7E.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006742DE
                  Source: Synaptics.exe.1.drStatic PE information: section name: .didat
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00690A76 push ecx; ret 0_2_00690A89
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00446564 push 004465F1h; ret 1_2_004465E9
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00406B3C push 00406B8Dh; ret 1_2_00406B85
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00478CB0 push 00478D2Dh; ret 1_2_00478D25
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00422044 push ecx; mov dword ptr [esp], edx1_2_00422049
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042E010 push 0042E03Ch; ret 1_2_0042E034
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0046C0B0 push ecx; mov dword ptr [esp], eax1_2_0046C0B2
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004761F8 push 0047623Bh; ret 1_2_00476233
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0049419C push 004941CFh; ret 1_2_004941C7
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042E1BC push 0042E1E8h; ret 1_2_0042E1E0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00480210 push 0048023Ch; ret 1_2_00480234
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004842DC push 00484308h; ret 1_2_00484300
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0048036C push 00480398h; ret 1_2_00480390
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C3D0 push 0042C3FCh; ret 1_2_0042C3F4
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00432468 push 004324B4h; ret 1_2_004324AC
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00486408 push 004864ADh; ret 1_2_004864A5
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0047C404 push 0047C430h; ret 1_2_0047C428
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00432404 push 00432447h; ret 1_2_0043243F
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004324C0 push 0043250Bh; ret 1_2_00432503
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C4C4 push 0042C4F0h; ret 1_2_0042C4E8
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004464FC push 00446562h; ret 1_2_0044655A
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00490554 push 00490580h; ret 1_2_00490578
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0047A514 push 0047A540h; ret 1_2_0047A538
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00432518 push 00432544h; ret 1_2_0043253C
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00496530 push 00496586h; ret 1_2_0049657E
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0048859C push 004885DEh; ret 1_2_004885D6
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00432650 push 004326C6h; ret 1_2_004326BE
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0049A6BC push 0049A745h; ret 1_2_0049A73D
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00480744 push 00480770h; ret 1_2_00480768
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0049A750 push 0049A776h; ret 1_2_0049A76E
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0048077C push 004807A8h; ret 1_2_004807A0
                  Source: ._cache_svchost.exe.1.drStatic PE information: section name: .text entropy: 7.99501507091198
                  Source: C:\Windows\SysWOW64\svchost.exeFile created: C:\Users\user\Desktop\._cache_svchost.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\svchost.exeFile created: C:\ProgramData\Synaptics\Synaptics.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\svchost.exeFile created: C:\ProgramData\Synaptics\Synaptics.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\svchost.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device DriverJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device DriverJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0068F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_0068F98E
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00701C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00701C41
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00459934 PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,1_2_00459934
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0045A054 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,1_2_0045A054
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0045A104 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,1_2_0045A104
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C6FC IsIconic,GetWindowPlacement,GetWindowRect,1_2_0042C6FC
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0044083C IsIconic,GetCapture,1_2_0044083C
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0045695C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,1_2_0045695C
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004410F0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,1_2_004410F0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00441A14 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,1_2_00441A14
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042E3B4 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_0042E3B4
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Contains functionality to detect sleep reduction / modifications
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00435BD41_2_00435BD4
                  Found API chain indicative of sandbox detection
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-95645
                  Switches to a custom stack to bypass stack traces
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeAPI/Special instruction interceptor: Address: CA31F4
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0120096E rdtsc 2_2_0120096E
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,1_2_00458EA4
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeAPI coverage: 4.2 %
                  Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 7.3 %
                  Source: C:\Users\user\Desktop\._cache_svchost.exeAPI coverage: 0.7 %
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00435BD41_2_00435BD4
                  Source: C:\Users\user\Desktop\._cache_svchost.exe TID: 7036Thread sleep time: -30000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_006DDBBE
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E68EE FindFirstFileW,FindClose,0_2_006E68EE
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_006E698F
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006DD076
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_006DD3A9
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006E9642
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_006E979D
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_006E9B2B
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_006E5C97
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004099E0 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,1_2_004099E0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00406018 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,1_2_00406018
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00409B1C FindFirstFileA,GetLastError,1_2_00409B1C
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006742DE
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\userJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet ExplorerJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.iniJump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeFile opened: C:\Users\user\AppDataJump to behavior
                  Source: svchost.exe, 00000001.00000002.1824644371.0000000003061000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                  Source: C:\Users\user\Desktop\._cache_svchost.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\._cache_svchost.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0120096E rdtsc 2_2_0120096E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_006471F3 LdrLoadDll,2_2_006471F3
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006EEAA2 BlockInput,0_2_006EEAA2
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006A2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_006A2622
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006742DE
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00694CE8 mov eax, dword ptr fs:[00000030h]0_2_00694CE8
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00CA34C0 mov eax, dword ptr fs:[00000030h]0_2_00CA34C0
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00CA3460 mov eax, dword ptr fs:[00000030h]0_2_00CA3460
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00CA1E70 mov eax, dword ptr fs:[00000030h]0_2_00CA1E70
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov eax, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov ecx, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov eax, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov eax, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov ecx, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov eax, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov eax, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov ecx, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov eax, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E10E mov ecx, dword ptr fs:[00000030h]2_2_0126E10E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F0124 mov eax, dword ptr fs:[00000030h]2_2_011F0124
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01280115 mov eax, dword ptr fs:[00000030h]2_2_01280115
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126A118 mov ecx, dword ptr fs:[00000030h]2_2_0126A118
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126A118 mov eax, dword ptr fs:[00000030h]2_2_0126A118
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126A118 mov eax, dword ptr fs:[00000030h]2_2_0126A118
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126A118 mov eax, dword ptr fs:[00000030h]2_2_0126A118
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6154 mov eax, dword ptr fs:[00000030h]2_2_011C6154
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6154 mov eax, dword ptr fs:[00000030h]2_2_011C6154
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BC156 mov eax, dword ptr fs:[00000030h]2_2_011BC156
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01254144 mov eax, dword ptr fs:[00000030h]2_2_01254144
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01254144 mov eax, dword ptr fs:[00000030h]2_2_01254144
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01254144 mov ecx, dword ptr fs:[00000030h]2_2_01254144
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01254144 mov eax, dword ptr fs:[00000030h]2_2_01254144
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01254144 mov eax, dword ptr fs:[00000030h]2_2_01254144
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01258158 mov eax, dword ptr fs:[00000030h]2_2_01258158
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BA197 mov eax, dword ptr fs:[00000030h]2_2_011BA197
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BA197 mov eax, dword ptr fs:[00000030h]2_2_011BA197
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BA197 mov eax, dword ptr fs:[00000030h]2_2_011BA197
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01200185 mov eax, dword ptr fs:[00000030h]2_2_01200185
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01264180 mov eax, dword ptr fs:[00000030h]2_2_01264180
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01264180 mov eax, dword ptr fs:[00000030h]2_2_01264180
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127C188 mov eax, dword ptr fs:[00000030h]2_2_0127C188
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127C188 mov eax, dword ptr fs:[00000030h]2_2_0127C188
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124019F mov eax, dword ptr fs:[00000030h]2_2_0124019F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124019F mov eax, dword ptr fs:[00000030h]2_2_0124019F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124019F mov eax, dword ptr fs:[00000030h]2_2_0124019F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124019F mov eax, dword ptr fs:[00000030h]2_2_0124019F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012961E5 mov eax, dword ptr fs:[00000030h]2_2_012961E5
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F01F8 mov eax, dword ptr fs:[00000030h]2_2_011F01F8
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012861C3 mov eax, dword ptr fs:[00000030h]2_2_012861C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012861C3 mov eax, dword ptr fs:[00000030h]2_2_012861C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E1D0 mov eax, dword ptr fs:[00000030h]2_2_0123E1D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E1D0 mov eax, dword ptr fs:[00000030h]2_2_0123E1D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E1D0 mov ecx, dword ptr fs:[00000030h]2_2_0123E1D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E1D0 mov eax, dword ptr fs:[00000030h]2_2_0123E1D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E1D0 mov eax, dword ptr fs:[00000030h]2_2_0123E1D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE016 mov eax, dword ptr fs:[00000030h]2_2_011DE016
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE016 mov eax, dword ptr fs:[00000030h]2_2_011DE016
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE016 mov eax, dword ptr fs:[00000030h]2_2_011DE016
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE016 mov eax, dword ptr fs:[00000030h]2_2_011DE016
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01256030 mov eax, dword ptr fs:[00000030h]2_2_01256030
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01244000 mov ecx, dword ptr fs:[00000030h]2_2_01244000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01262000 mov eax, dword ptr fs:[00000030h]2_2_01262000
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BA020 mov eax, dword ptr fs:[00000030h]2_2_011BA020
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BC020 mov eax, dword ptr fs:[00000030h]2_2_011BC020
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C2050 mov eax, dword ptr fs:[00000030h]2_2_011C2050
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EC073 mov eax, dword ptr fs:[00000030h]2_2_011EC073
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246050 mov eax, dword ptr fs:[00000030h]2_2_01246050
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012580A8 mov eax, dword ptr fs:[00000030h]2_2_012580A8
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012860B8 mov eax, dword ptr fs:[00000030h]2_2_012860B8
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012860B8 mov ecx, dword ptr fs:[00000030h]2_2_012860B8
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C208A mov eax, dword ptr fs:[00000030h]2_2_011C208A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012460E0 mov eax, dword ptr fs:[00000030h]2_2_012460E0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012020F0 mov ecx, dword ptr fs:[00000030h]2_2_012020F0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BC0F0 mov eax, dword ptr fs:[00000030h]2_2_011BC0F0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C80E9 mov eax, dword ptr fs:[00000030h]2_2_011C80E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BA0E3 mov ecx, dword ptr fs:[00000030h]2_2_011BA0E3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012420DE mov eax, dword ptr fs:[00000030h]2_2_012420DE
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BC310 mov ecx, dword ptr fs:[00000030h]2_2_011BC310
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E0310 mov ecx, dword ptr fs:[00000030h]2_2_011E0310
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA30B mov eax, dword ptr fs:[00000030h]2_2_011FA30B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA30B mov eax, dword ptr fs:[00000030h]2_2_011FA30B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA30B mov eax, dword ptr fs:[00000030h]2_2_011FA30B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126437C mov eax, dword ptr fs:[00000030h]2_2_0126437C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01242349 mov eax, dword ptr fs:[00000030h]2_2_01242349
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01268350 mov ecx, dword ptr fs:[00000030h]2_2_01268350
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124035C mov eax, dword ptr fs:[00000030h]2_2_0124035C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124035C mov eax, dword ptr fs:[00000030h]2_2_0124035C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124035C mov eax, dword ptr fs:[00000030h]2_2_0124035C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124035C mov ecx, dword ptr fs:[00000030h]2_2_0124035C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124035C mov eax, dword ptr fs:[00000030h]2_2_0124035C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124035C mov eax, dword ptr fs:[00000030h]2_2_0124035C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128A352 mov eax, dword ptr fs:[00000030h]2_2_0128A352
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B8397 mov eax, dword ptr fs:[00000030h]2_2_011B8397
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B8397 mov eax, dword ptr fs:[00000030h]2_2_011B8397
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B8397 mov eax, dword ptr fs:[00000030h]2_2_011B8397
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E438F mov eax, dword ptr fs:[00000030h]2_2_011E438F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E438F mov eax, dword ptr fs:[00000030h]2_2_011E438F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BE388 mov eax, dword ptr fs:[00000030h]2_2_011BE388
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BE388 mov eax, dword ptr fs:[00000030h]2_2_011BE388
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BE388 mov eax, dword ptr fs:[00000030h]2_2_011BE388
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA3C0 mov eax, dword ptr fs:[00000030h]2_2_011CA3C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA3C0 mov eax, dword ptr fs:[00000030h]2_2_011CA3C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA3C0 mov eax, dword ptr fs:[00000030h]2_2_011CA3C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA3C0 mov eax, dword ptr fs:[00000030h]2_2_011CA3C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA3C0 mov eax, dword ptr fs:[00000030h]2_2_011CA3C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA3C0 mov eax, dword ptr fs:[00000030h]2_2_011CA3C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C83C0 mov eax, dword ptr fs:[00000030h]2_2_011C83C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C83C0 mov eax, dword ptr fs:[00000030h]2_2_011C83C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C83C0 mov eax, dword ptr fs:[00000030h]2_2_011C83C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C83C0 mov eax, dword ptr fs:[00000030h]2_2_011C83C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F63FF mov eax, dword ptr fs:[00000030h]2_2_011F63FF
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012463C0 mov eax, dword ptr fs:[00000030h]2_2_012463C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127C3CD mov eax, dword ptr fs:[00000030h]2_2_0127C3CD
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE3F0 mov eax, dword ptr fs:[00000030h]2_2_011DE3F0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE3F0 mov eax, dword ptr fs:[00000030h]2_2_011DE3F0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE3F0 mov eax, dword ptr fs:[00000030h]2_2_011DE3F0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012643D4 mov eax, dword ptr fs:[00000030h]2_2_012643D4
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012643D4 mov eax, dword ptr fs:[00000030h]2_2_012643D4
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D03E9 mov eax, dword ptr fs:[00000030h]2_2_011D03E9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E3DB mov eax, dword ptr fs:[00000030h]2_2_0126E3DB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E3DB mov eax, dword ptr fs:[00000030h]2_2_0126E3DB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E3DB mov ecx, dword ptr fs:[00000030h]2_2_0126E3DB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126E3DB mov eax, dword ptr fs:[00000030h]2_2_0126E3DB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B823B mov eax, dword ptr fs:[00000030h]2_2_011B823B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6259 mov eax, dword ptr fs:[00000030h]2_2_011C6259
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BA250 mov eax, dword ptr fs:[00000030h]2_2_011BA250
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01270274 mov eax, dword ptr fs:[00000030h]2_2_01270274
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01248243 mov eax, dword ptr fs:[00000030h]2_2_01248243
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01248243 mov ecx, dword ptr fs:[00000030h]2_2_01248243
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B826B mov eax, dword ptr fs:[00000030h]2_2_011B826B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127A250 mov eax, dword ptr fs:[00000030h]2_2_0127A250
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127A250 mov eax, dword ptr fs:[00000030h]2_2_0127A250
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C4260 mov eax, dword ptr fs:[00000030h]2_2_011C4260
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C4260 mov eax, dword ptr fs:[00000030h]2_2_011C4260
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C4260 mov eax, dword ptr fs:[00000030h]2_2_011C4260
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012562A0 mov eax, dword ptr fs:[00000030h]2_2_012562A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012562A0 mov ecx, dword ptr fs:[00000030h]2_2_012562A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012562A0 mov eax, dword ptr fs:[00000030h]2_2_012562A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012562A0 mov eax, dword ptr fs:[00000030h]2_2_012562A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012562A0 mov eax, dword ptr fs:[00000030h]2_2_012562A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012562A0 mov eax, dword ptr fs:[00000030h]2_2_012562A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE284 mov eax, dword ptr fs:[00000030h]2_2_011FE284
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE284 mov eax, dword ptr fs:[00000030h]2_2_011FE284
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01240283 mov eax, dword ptr fs:[00000030h]2_2_01240283
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01240283 mov eax, dword ptr fs:[00000030h]2_2_01240283
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01240283 mov eax, dword ptr fs:[00000030h]2_2_01240283
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D02A0 mov eax, dword ptr fs:[00000030h]2_2_011D02A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D02A0 mov eax, dword ptr fs:[00000030h]2_2_011D02A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA2C3 mov eax, dword ptr fs:[00000030h]2_2_011CA2C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA2C3 mov eax, dword ptr fs:[00000030h]2_2_011CA2C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA2C3 mov eax, dword ptr fs:[00000030h]2_2_011CA2C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA2C3 mov eax, dword ptr fs:[00000030h]2_2_011CA2C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA2C3 mov eax, dword ptr fs:[00000030h]2_2_011CA2C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D02E1 mov eax, dword ptr fs:[00000030h]2_2_011D02E1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D02E1 mov eax, dword ptr fs:[00000030h]2_2_011D02E1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D02E1 mov eax, dword ptr fs:[00000030h]2_2_011D02E1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE53E mov eax, dword ptr fs:[00000030h]2_2_011EE53E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE53E mov eax, dword ptr fs:[00000030h]2_2_011EE53E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE53E mov eax, dword ptr fs:[00000030h]2_2_011EE53E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE53E mov eax, dword ptr fs:[00000030h]2_2_011EE53E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE53E mov eax, dword ptr fs:[00000030h]2_2_011EE53E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01256500 mov eax, dword ptr fs:[00000030h]2_2_01256500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0535 mov eax, dword ptr fs:[00000030h]2_2_011D0535
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0535 mov eax, dword ptr fs:[00000030h]2_2_011D0535
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0535 mov eax, dword ptr fs:[00000030h]2_2_011D0535
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0535 mov eax, dword ptr fs:[00000030h]2_2_011D0535
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0535 mov eax, dword ptr fs:[00000030h]2_2_011D0535
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0535 mov eax, dword ptr fs:[00000030h]2_2_011D0535
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294500 mov eax, dword ptr fs:[00000030h]2_2_01294500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294500 mov eax, dword ptr fs:[00000030h]2_2_01294500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294500 mov eax, dword ptr fs:[00000030h]2_2_01294500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294500 mov eax, dword ptr fs:[00000030h]2_2_01294500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294500 mov eax, dword ptr fs:[00000030h]2_2_01294500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294500 mov eax, dword ptr fs:[00000030h]2_2_01294500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294500 mov eax, dword ptr fs:[00000030h]2_2_01294500
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8550 mov eax, dword ptr fs:[00000030h]2_2_011C8550
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8550 mov eax, dword ptr fs:[00000030h]2_2_011C8550
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F656A mov eax, dword ptr fs:[00000030h]2_2_011F656A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F656A mov eax, dword ptr fs:[00000030h]2_2_011F656A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F656A mov eax, dword ptr fs:[00000030h]2_2_011F656A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE59C mov eax, dword ptr fs:[00000030h]2_2_011FE59C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012405A7 mov eax, dword ptr fs:[00000030h]2_2_012405A7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012405A7 mov eax, dword ptr fs:[00000030h]2_2_012405A7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012405A7 mov eax, dword ptr fs:[00000030h]2_2_012405A7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F4588 mov eax, dword ptr fs:[00000030h]2_2_011F4588
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C2582 mov eax, dword ptr fs:[00000030h]2_2_011C2582
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C2582 mov ecx, dword ptr fs:[00000030h]2_2_011C2582
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E45B1 mov eax, dword ptr fs:[00000030h]2_2_011E45B1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E45B1 mov eax, dword ptr fs:[00000030h]2_2_011E45B1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C65D0 mov eax, dword ptr fs:[00000030h]2_2_011C65D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA5D0 mov eax, dword ptr fs:[00000030h]2_2_011FA5D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA5D0 mov eax, dword ptr fs:[00000030h]2_2_011FA5D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE5CF mov eax, dword ptr fs:[00000030h]2_2_011FE5CF
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE5CF mov eax, dword ptr fs:[00000030h]2_2_011FE5CF
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC5ED mov eax, dword ptr fs:[00000030h]2_2_011FC5ED
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC5ED mov eax, dword ptr fs:[00000030h]2_2_011FC5ED
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE5E7 mov eax, dword ptr fs:[00000030h]2_2_011EE5E7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C25E0 mov eax, dword ptr fs:[00000030h]2_2_011C25E0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246420 mov eax, dword ptr fs:[00000030h]2_2_01246420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246420 mov eax, dword ptr fs:[00000030h]2_2_01246420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246420 mov eax, dword ptr fs:[00000030h]2_2_01246420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246420 mov eax, dword ptr fs:[00000030h]2_2_01246420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246420 mov eax, dword ptr fs:[00000030h]2_2_01246420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246420 mov eax, dword ptr fs:[00000030h]2_2_01246420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01246420 mov eax, dword ptr fs:[00000030h]2_2_01246420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F8402 mov eax, dword ptr fs:[00000030h]2_2_011F8402
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F8402 mov eax, dword ptr fs:[00000030h]2_2_011F8402
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F8402 mov eax, dword ptr fs:[00000030h]2_2_011F8402
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA430 mov eax, dword ptr fs:[00000030h]2_2_011FA430
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BE420 mov eax, dword ptr fs:[00000030h]2_2_011BE420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BE420 mov eax, dword ptr fs:[00000030h]2_2_011BE420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BE420 mov eax, dword ptr fs:[00000030h]2_2_011BE420
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BC427 mov eax, dword ptr fs:[00000030h]2_2_011BC427
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E245A mov eax, dword ptr fs:[00000030h]2_2_011E245A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124C460 mov ecx, dword ptr fs:[00000030h]2_2_0124C460
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B645D mov eax, dword ptr fs:[00000030h]2_2_011B645D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FE443 mov eax, dword ptr fs:[00000030h]2_2_011FE443
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EA470 mov eax, dword ptr fs:[00000030h]2_2_011EA470
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EA470 mov eax, dword ptr fs:[00000030h]2_2_011EA470
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EA470 mov eax, dword ptr fs:[00000030h]2_2_011EA470
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127A456 mov eax, dword ptr fs:[00000030h]2_2_0127A456
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124A4B0 mov eax, dword ptr fs:[00000030h]2_2_0124A4B0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F44B0 mov ecx, dword ptr fs:[00000030h]2_2_011F44B0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C64AB mov eax, dword ptr fs:[00000030h]2_2_011C64AB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0127A49A mov eax, dword ptr fs:[00000030h]2_2_0127A49A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C04E5 mov ecx, dword ptr fs:[00000030h]2_2_011C04E5
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0710 mov eax, dword ptr fs:[00000030h]2_2_011C0710
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F0710 mov eax, dword ptr fs:[00000030h]2_2_011F0710
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123C730 mov eax, dword ptr fs:[00000030h]2_2_0123C730
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC700 mov eax, dword ptr fs:[00000030h]2_2_011FC700
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F273C mov eax, dword ptr fs:[00000030h]2_2_011F273C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F273C mov ecx, dword ptr fs:[00000030h]2_2_011F273C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F273C mov eax, dword ptr fs:[00000030h]2_2_011F273C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC720 mov eax, dword ptr fs:[00000030h]2_2_011FC720
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC720 mov eax, dword ptr fs:[00000030h]2_2_011FC720
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0750 mov eax, dword ptr fs:[00000030h]2_2_011C0750
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F674D mov esi, dword ptr fs:[00000030h]2_2_011F674D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F674D mov eax, dword ptr fs:[00000030h]2_2_011F674D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F674D mov eax, dword ptr fs:[00000030h]2_2_011F674D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8770 mov eax, dword ptr fs:[00000030h]2_2_011C8770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0770 mov eax, dword ptr fs:[00000030h]2_2_011D0770
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202750 mov eax, dword ptr fs:[00000030h]2_2_01202750
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202750 mov eax, dword ptr fs:[00000030h]2_2_01202750
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01244755 mov eax, dword ptr fs:[00000030h]2_2_01244755
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124E75D mov eax, dword ptr fs:[00000030h]2_2_0124E75D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012747A0 mov eax, dword ptr fs:[00000030h]2_2_012747A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126678E mov eax, dword ptr fs:[00000030h]2_2_0126678E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C07AF mov eax, dword ptr fs:[00000030h]2_2_011C07AF
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124E7E1 mov eax, dword ptr fs:[00000030h]2_2_0124E7E1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CC7C0 mov eax, dword ptr fs:[00000030h]2_2_011CC7C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C47FB mov eax, dword ptr fs:[00000030h]2_2_011C47FB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C47FB mov eax, dword ptr fs:[00000030h]2_2_011C47FB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012407C3 mov eax, dword ptr fs:[00000030h]2_2_012407C3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E27ED mov eax, dword ptr fs:[00000030h]2_2_011E27ED
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E27ED mov eax, dword ptr fs:[00000030h]2_2_011E27ED
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E27ED mov eax, dword ptr fs:[00000030h]2_2_011E27ED
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D260B mov eax, dword ptr fs:[00000030h]2_2_011D260B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D260B mov eax, dword ptr fs:[00000030h]2_2_011D260B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D260B mov eax, dword ptr fs:[00000030h]2_2_011D260B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D260B mov eax, dword ptr fs:[00000030h]2_2_011D260B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D260B mov eax, dword ptr fs:[00000030h]2_2_011D260B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D260B mov eax, dword ptr fs:[00000030h]2_2_011D260B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D260B mov eax, dword ptr fs:[00000030h]2_2_011D260B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E609 mov eax, dword ptr fs:[00000030h]2_2_0123E609
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C262C mov eax, dword ptr fs:[00000030h]2_2_011C262C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01202619 mov eax, dword ptr fs:[00000030h]2_2_01202619
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DE627 mov eax, dword ptr fs:[00000030h]2_2_011DE627
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F6620 mov eax, dword ptr fs:[00000030h]2_2_011F6620
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F8620 mov eax, dword ptr fs:[00000030h]2_2_011F8620
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128866E mov eax, dword ptr fs:[00000030h]2_2_0128866E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128866E mov eax, dword ptr fs:[00000030h]2_2_0128866E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011DC640 mov eax, dword ptr fs:[00000030h]2_2_011DC640
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F2674 mov eax, dword ptr fs:[00000030h]2_2_011F2674
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA660 mov eax, dword ptr fs:[00000030h]2_2_011FA660
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA660 mov eax, dword ptr fs:[00000030h]2_2_011FA660
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C4690 mov eax, dword ptr fs:[00000030h]2_2_011C4690
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C4690 mov eax, dword ptr fs:[00000030h]2_2_011C4690
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F66B0 mov eax, dword ptr fs:[00000030h]2_2_011F66B0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC6A6 mov eax, dword ptr fs:[00000030h]2_2_011FC6A6
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E6F2 mov eax, dword ptr fs:[00000030h]2_2_0123E6F2
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E6F2 mov eax, dword ptr fs:[00000030h]2_2_0123E6F2
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E6F2 mov eax, dword ptr fs:[00000030h]2_2_0123E6F2
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E6F2 mov eax, dword ptr fs:[00000030h]2_2_0123E6F2
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012406F1 mov eax, dword ptr fs:[00000030h]2_2_012406F1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012406F1 mov eax, dword ptr fs:[00000030h]2_2_012406F1
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA6C7 mov ebx, dword ptr fs:[00000030h]2_2_011FA6C7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA6C7 mov eax, dword ptr fs:[00000030h]2_2_011FA6C7
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B8918 mov eax, dword ptr fs:[00000030h]2_2_011B8918
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B8918 mov eax, dword ptr fs:[00000030h]2_2_011B8918
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124892A mov eax, dword ptr fs:[00000030h]2_2_0124892A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0125892B mov eax, dword ptr fs:[00000030h]2_2_0125892B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E908 mov eax, dword ptr fs:[00000030h]2_2_0123E908
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123E908 mov eax, dword ptr fs:[00000030h]2_2_0123E908
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124C912 mov eax, dword ptr fs:[00000030h]2_2_0124C912
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0120096E mov eax, dword ptr fs:[00000030h]2_2_0120096E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0120096E mov edx, dword ptr fs:[00000030h]2_2_0120096E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0120096E mov eax, dword ptr fs:[00000030h]2_2_0120096E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124C97C mov eax, dword ptr fs:[00000030h]2_2_0124C97C
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01264978 mov eax, dword ptr fs:[00000030h]2_2_01264978
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01264978 mov eax, dword ptr fs:[00000030h]2_2_01264978
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01240946 mov eax, dword ptr fs:[00000030h]2_2_01240946
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E6962 mov eax, dword ptr fs:[00000030h]2_2_011E6962
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E6962 mov eax, dword ptr fs:[00000030h]2_2_011E6962
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E6962 mov eax, dword ptr fs:[00000030h]2_2_011E6962
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012489B3 mov esi, dword ptr fs:[00000030h]2_2_012489B3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012489B3 mov eax, dword ptr fs:[00000030h]2_2_012489B3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012489B3 mov eax, dword ptr fs:[00000030h]2_2_012489B3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C09AD mov eax, dword ptr fs:[00000030h]2_2_011C09AD
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C09AD mov eax, dword ptr fs:[00000030h]2_2_011C09AD
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D29A0 mov eax, dword ptr fs:[00000030h]2_2_011D29A0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124E9E0 mov eax, dword ptr fs:[00000030h]2_2_0124E9E0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA9D0 mov eax, dword ptr fs:[00000030h]2_2_011CA9D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA9D0 mov eax, dword ptr fs:[00000030h]2_2_011CA9D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA9D0 mov eax, dword ptr fs:[00000030h]2_2_011CA9D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA9D0 mov eax, dword ptr fs:[00000030h]2_2_011CA9D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA9D0 mov eax, dword ptr fs:[00000030h]2_2_011CA9D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CA9D0 mov eax, dword ptr fs:[00000030h]2_2_011CA9D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F49D0 mov eax, dword ptr fs:[00000030h]2_2_011F49D0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_012569C0 mov eax, dword ptr fs:[00000030h]2_2_012569C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F29F9 mov eax, dword ptr fs:[00000030h]2_2_011F29F9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F29F9 mov eax, dword ptr fs:[00000030h]2_2_011F29F9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128A9D3 mov eax, dword ptr fs:[00000030h]2_2_0128A9D3
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126483A mov eax, dword ptr fs:[00000030h]2_2_0126483A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126483A mov eax, dword ptr fs:[00000030h]2_2_0126483A
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E2835 mov eax, dword ptr fs:[00000030h]2_2_011E2835
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E2835 mov eax, dword ptr fs:[00000030h]2_2_011E2835
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E2835 mov eax, dword ptr fs:[00000030h]2_2_011E2835
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E2835 mov ecx, dword ptr fs:[00000030h]2_2_011E2835
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E2835 mov eax, dword ptr fs:[00000030h]2_2_011E2835
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E2835 mov eax, dword ptr fs:[00000030h]2_2_011E2835
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FA830 mov eax, dword ptr fs:[00000030h]2_2_011FA830
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124C810 mov eax, dword ptr fs:[00000030h]2_2_0124C810
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C4859 mov eax, dword ptr fs:[00000030h]2_2_011C4859
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C4859 mov eax, dword ptr fs:[00000030h]2_2_011C4859
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F0854 mov eax, dword ptr fs:[00000030h]2_2_011F0854
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01256870 mov eax, dword ptr fs:[00000030h]2_2_01256870
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01256870 mov eax, dword ptr fs:[00000030h]2_2_01256870
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124E872 mov eax, dword ptr fs:[00000030h]2_2_0124E872
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124E872 mov eax, dword ptr fs:[00000030h]2_2_0124E872
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D2840 mov ecx, dword ptr fs:[00000030h]2_2_011D2840
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0887 mov eax, dword ptr fs:[00000030h]2_2_011C0887
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124C89D mov eax, dword ptr fs:[00000030h]2_2_0124C89D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128A8E4 mov eax, dword ptr fs:[00000030h]2_2_0128A8E4
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EE8C0 mov eax, dword ptr fs:[00000030h]2_2_011EE8C0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC8F9 mov eax, dword ptr fs:[00000030h]2_2_011FC8F9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FC8F9 mov eax, dword ptr fs:[00000030h]2_2_011FC8F9
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01288B28 mov eax, dword ptr fs:[00000030h]2_2_01288B28
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01288B28 mov eax, dword ptr fs:[00000030h]2_2_01288B28
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123EB1D mov eax, dword ptr fs:[00000030h]2_2_0123EB1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EEB20 mov eax, dword ptr fs:[00000030h]2_2_011EEB20
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EEB20 mov eax, dword ptr fs:[00000030h]2_2_011EEB20
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01268B42 mov eax, dword ptr fs:[00000030h]2_2_01268B42
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01256B40 mov eax, dword ptr fs:[00000030h]2_2_01256B40
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01256B40 mov eax, dword ptr fs:[00000030h]2_2_01256B40
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011BCB7E mov eax, dword ptr fs:[00000030h]2_2_011BCB7E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0128AB40 mov eax, dword ptr fs:[00000030h]2_2_0128AB40
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01274B4B mov eax, dword ptr fs:[00000030h]2_2_01274B4B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01274B4B mov eax, dword ptr fs:[00000030h]2_2_01274B4B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126EB50 mov eax, dword ptr fs:[00000030h]2_2_0126EB50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01274BB0 mov eax, dword ptr fs:[00000030h]2_2_01274BB0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01274BB0 mov eax, dword ptr fs:[00000030h]2_2_01274BB0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0BBE mov eax, dword ptr fs:[00000030h]2_2_011D0BBE
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0BBE mov eax, dword ptr fs:[00000030h]2_2_011D0BBE
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0BCD mov eax, dword ptr fs:[00000030h]2_2_011C0BCD
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0BCD mov eax, dword ptr fs:[00000030h]2_2_011C0BCD
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0BCD mov eax, dword ptr fs:[00000030h]2_2_011C0BCD
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124CBF0 mov eax, dword ptr fs:[00000030h]2_2_0124CBF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E0BCB mov eax, dword ptr fs:[00000030h]2_2_011E0BCB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E0BCB mov eax, dword ptr fs:[00000030h]2_2_011E0BCB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E0BCB mov eax, dword ptr fs:[00000030h]2_2_011E0BCB
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EEBFC mov eax, dword ptr fs:[00000030h]2_2_011EEBFC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8BF0 mov eax, dword ptr fs:[00000030h]2_2_011C8BF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8BF0 mov eax, dword ptr fs:[00000030h]2_2_011C8BF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8BF0 mov eax, dword ptr fs:[00000030h]2_2_011C8BF0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126EBD0 mov eax, dword ptr fs:[00000030h]2_2_0126EBD0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FCA38 mov eax, dword ptr fs:[00000030h]2_2_011FCA38
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E4A35 mov eax, dword ptr fs:[00000030h]2_2_011E4A35
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011E4A35 mov eax, dword ptr fs:[00000030h]2_2_011E4A35
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011EEA2E mov eax, dword ptr fs:[00000030h]2_2_011EEA2E
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0124CA11 mov eax, dword ptr fs:[00000030h]2_2_0124CA11
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FCA24 mov eax, dword ptr fs:[00000030h]2_2_011FCA24
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0A5B mov eax, dword ptr fs:[00000030h]2_2_011D0A5B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011D0A5B mov eax, dword ptr fs:[00000030h]2_2_011D0A5B
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0126EA60 mov eax, dword ptr fs:[00000030h]2_2_0126EA60
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6A50 mov eax, dword ptr fs:[00000030h]2_2_011C6A50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6A50 mov eax, dword ptr fs:[00000030h]2_2_011C6A50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6A50 mov eax, dword ptr fs:[00000030h]2_2_011C6A50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6A50 mov eax, dword ptr fs:[00000030h]2_2_011C6A50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6A50 mov eax, dword ptr fs:[00000030h]2_2_011C6A50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6A50 mov eax, dword ptr fs:[00000030h]2_2_011C6A50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C6A50 mov eax, dword ptr fs:[00000030h]2_2_011C6A50
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123CA72 mov eax, dword ptr fs:[00000030h]2_2_0123CA72
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_0123CA72 mov eax, dword ptr fs:[00000030h]2_2_0123CA72
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FCA6F mov eax, dword ptr fs:[00000030h]2_2_011FCA6F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FCA6F mov eax, dword ptr fs:[00000030h]2_2_011FCA6F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FCA6F mov eax, dword ptr fs:[00000030h]2_2_011FCA6F
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01216AA4 mov eax, dword ptr fs:[00000030h]2_2_01216AA4
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F8A90 mov edx, dword ptr fs:[00000030h]2_2_011F8A90
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011CEA80 mov eax, dword ptr fs:[00000030h]2_2_011CEA80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01294A80 mov eax, dword ptr fs:[00000030h]2_2_01294A80
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8AA0 mov eax, dword ptr fs:[00000030h]2_2_011C8AA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C8AA0 mov eax, dword ptr fs:[00000030h]2_2_011C8AA0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011C0AD0 mov eax, dword ptr fs:[00000030h]2_2_011C0AD0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F4AD0 mov eax, dword ptr fs:[00000030h]2_2_011F4AD0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F4AD0 mov eax, dword ptr fs:[00000030h]2_2_011F4AD0
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01216ACC mov eax, dword ptr fs:[00000030h]2_2_01216ACC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01216ACC mov eax, dword ptr fs:[00000030h]2_2_01216ACC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01216ACC mov eax, dword ptr fs:[00000030h]2_2_01216ACC
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FAAEE mov eax, dword ptr fs:[00000030h]2_2_011FAAEE
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011FAAEE mov eax, dword ptr fs:[00000030h]2_2_011FAAEE
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011F4D1D mov eax, dword ptr fs:[00000030h]2_2_011F4D1D
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_01248D20 mov eax, dword ptr fs:[00000030h]2_2_01248D20
                  Source: C:\Users\user\Desktop\._cache_svchost.exeCode function: 2_2_011B6D10 mov eax, dword ptr fs:[00000030h]2_2_011B6D10
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_006D0B62
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006A2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_006A2622
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_0069083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0069083F
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006909D5 SetUnhandledExceptionFilter,0_2_006909D5
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00690C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00690C21

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Maps a DLL or memory area into another process
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                  Writes to foreign memory regions
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2A25008Jump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_006D1201
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006B2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_006B2BA5
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006DB226 SendInput,keybd_event,0_2_006DB226
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006F22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_006F22DA
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\1lAxaLKP7E.exe"Jump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Users\user\Desktop\._cache_svchost.exe "C:\Users\user\Desktop\._cache_svchost.exe" Jump to behavior
                  Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_006D0B62
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006D1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_006D1663
                  Source: 1lAxaLKP7E.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                  Source: 1lAxaLKP7E.exeBinary or memory string: Shell_TrayWnd
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_00690698 cpuid 0_2_00690698
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,1_2_004061D0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoA,GetACP,1_2_0040E088
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,1_2_004062DC
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoA,1_2_0040C964
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoA,1_2_0040C9B0
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoA,1_2_00406AC6
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: GetLocaleInfoA,1_2_00406AC8
                  Source: C:\Windows\SysWOW64\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006E8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_006E8195
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006CD27A GetUserNameW,0_2_006CD27A
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006ABB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_006ABB6F
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_006742DE

                  Stealing of Sensitive Information

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 2.2.._cache_svchost.exe.630000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Yara detected XRed
                  Source: Yara matchFile source: 0.2.1lAxaLKP7E.exe.3640000.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.1lAxaLKP7E.exe.3640000.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: 1lAxaLKP7E.exe PID: 6700, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 6888, type: MEMORYSTR
                  Source: 1lAxaLKP7E.exeBinary or memory string: WIN_81
                  Source: 1lAxaLKP7E.exeBinary or memory string: WIN_XP
                  Source: 1lAxaLKP7E.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
                  Source: 1lAxaLKP7E.exeBinary or memory string: WIN_XPe
                  Source: 1lAxaLKP7E.exeBinary or memory string: WIN_VISTA
                  Source: 1lAxaLKP7E.exeBinary or memory string: WIN_7
                  Source: 1lAxaLKP7E.exeBinary or memory string: WIN_8

                  Remote Access Functionality

                  barindex
                  Yara detected FormBook
                  Source: Yara matchFile source: 2.2.._cache_svchost.exe.630000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Yara detected XRed
                  Source: Yara matchFile source: 0.2.1lAxaLKP7E.exe.3640000.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.1lAxaLKP7E.exe.3640000.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: 1lAxaLKP7E.exe PID: 6700, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 6888, type: MEMORYSTR
                  Source: C:\Windows\SysWOW64\svchost.exeCode function: cmd.exe /C 1_2_00475384
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006F1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_006F1204
                  Source: C:\Users\user\Desktop\1lAxaLKP7E.exeCode function: 0_2_006F1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_006F1806

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire Infrastructure2
                  Valid Accounts                  		1
                  Native API                  		1
                  DLL Side-Loading                  		1
                  Exploitation for Privilege Escalation                  		1
                  Disable or Modify Tools                  		21
                  Input Capture                  		2
                  System Time Discovery                  		Remote Services1
                  Archive Collected Data                  		1
                  Ingress Tool Transfer                  		Exfiltration Over Other Network Medium1
                  System Shutdown/Reboot
                  CredentialsDomains1
                  Replication Through Removable Media                  		1
                  Command and Scripting Interpreter                  		2
                  Valid Accounts                  		1
                  DLL Side-Loading                  		1
                  Deobfuscate/Decode Files or Information                  		LSASS Memory1
                  Peripheral Device Discovery                  		Remote Desktop Protocol1
                  Screen Capture                  		1
                  Encrypted Channel                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAt1
                  Registry Run Keys / Startup Folder                  		2
                  Valid Accounts                  		3
                  Obfuscated Files or Information                  		Security Account Manager1
                  Account Discovery                  		SMB/Windows Admin Shares21
                  Input Capture                  		SteganographyAutomated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
                  Access Token Manipulation                  		2
                  Software Packing                  		NTDS3
                  File and Directory Discovery                  		Distributed Component Object Model3
                  Clipboard Data                  		Protocol ImpersonationTraffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script212
                  Process Injection                  		1
                  DLL Side-Loading                  		LSA Secrets135
                  System Information Discovery                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                  Registry Run Keys / Startup Folder                  		1
                  Masquerading                  		Cached Domain Credentials461
                  Security Software Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                  Valid Accounts                  		DCSync12
                  Virtualization/Sandbox Evasion                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job12
                  Virtualization/Sandbox Evasion                  		Proc Filesystem3
                  Process Discovery                  		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
                  Access Token Manipulation                  		/etc/passwd and /etc/shadow11
                  Application Window Discovery                  		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron212
                  Process Injection                  		Network Sniffing1
                  System Owner/User Discovery                  		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  1lAxaLKP7E.exe66%ReversingLabsWin32.Trojan.Leonem
                  1lAxaLKP7E.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Users\user\Desktop\._cache_svchost.exe100%AviraTR/Crypt.ZPACK.Gen
                  C:\Users\user\Desktop\._cache_svchost.exe100%Joe Sandbox ML
                  C:\ProgramData\Synaptics\Synaptics.exe0%ReversingLabs
                  C:\Users\user\Desktop\._cache_svchost.exe88%ReversingLabsWin32.Backdoor.FormBook

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=10%Avira URL Cloudsafe
                  https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=10%Avira URL Cloudsafe
                  http://xred.site50.net/syn/SSLLibrary.dl0%Avira URL Cloudsafe
                  https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl0%Avira URL Cloudsafe
                  http://xred.site50.net/syn/SUpdate.iniH)0%Avira URL Cloudsafe
                  https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=T0%Avira URL Cloudsafe
                  http://xred.site50.net/syn/SUpdate.ini0%Avira URL Cloudsafe
                  http://xred.site50.net/syn/Synaptics.rar0%Avira URL Cloudsafe
                  http://xred.site50.net/syn/SSLLibrary.dll100%Avira URL Cloudmalware
                  https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=10%Avira URL Cloudsafe
                  http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc6135629780%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  ⊘No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://xred.site50.net/syn/SSLLibrary.dlsvchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://xred.site50.net/syn/Synaptics.rarsvchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1svchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=Tsvchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://xred.site50.net/syn/SUpdate.iniH)svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://xred.site50.net/syn/SSLLibrary.dllsvchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://xred.site50.net/syn/SUpdate.inisvchost.exe, 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmp, svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlsvchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978svchost.exe, 00000001.00000003.1822907749.0000000004E00000.00000004.00001000.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown

                  World Map of Contacted IPs

                  ⊘No contacted IP infos

                  General Information

                  Joe Sandbox version:40.0.0 Tourmaline
                  Analysis ID:1504860
                  Start date and time:2024-09-05 14:30:10 +02:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:0h 7m 23s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:default.jbs
                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                  Number of analysed new started processes analysed:9
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:0
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample name:1lAxaLKP7E.exe
                  renamed because original name is a hash value
                  Original Sample Name:91b60b1ae0b37343c671b632eb3e358d9a5029c9c6405556ba835528c67fd6d8.exe
                  Detection:MAL
                  Classification:mal100.troj.spyw.evad.winEXE@8/6@0/0
                  EGA Information:
                  • Successful, ratio: 100%
                  HCA Information:
                  • Successful, ratio: 95%
                  • Number of executed functions: 54
                  • Number of non-executed functions: 289
                  Cookbook Comments:
                  • Found application associated with file extension: .exe

                  Warnings

                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                  • Not all processes where analyzed, report is missing behavior information
                  • Report creation exceeded maximum time and may have missing disassembly code information.
                  • Report size exceeded maximum capacity and may have missing disassembly code.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • VT rate limit hit for: 1lAxaLKP7E.exe

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  08:31:50API Interceptor3x Sleep call for process: ._cache_svchost.exe modified
                  13:31:20AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

                  Joe Sandbox View / Context

                  IPs

                  ⊘No context

                  Domains

                  ⊘No context

                  ASNs

                  ⊘No context

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  C:\ProgramData\Synaptics\Synaptics.exePI PDF.exeGet hashmaliciousDarkCloudBrowse
                    PI PDF.exeGet hashmaliciousDarkCloudBrowse
                      GZLA202403048 - revised copy.exeGet hashmaliciousRemcosBrowse
                        FHW PO5ED07 07.22.24.exeGet hashmaliciousRemcosBrowse

                          Created / dropped Files

                          C:\ProgramData\Synaptics\Synaptics.exe

                          Download File
                          Process:C:\Windows\SysWOW64\svchost.exe
                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):46504
                          Entropy (8bit):6.436985067856982
                          Encrypted:false
                          SSDEEP:768:xqUfJFJ/RhxThdVzNIKwx4ZCv8HVtNMblQ1PVRmuU9z6:xdJ7/RhxVdVz7wx4ZtrNYeP/d8z6
                          MD5:1ED18311E3DA35942DB37D15FA40CC5B
                          SHA1:3196F45B269A614A3926EFC032FC9D75017F27E8
                          SHA-256:7EFA956EE9141F3EB637511D029A77842EDA925CB8A84425D2CCDF8A8A677FE1
                          SHA-512:241EFB2011896B0A741E1415C25508AA62664C35E193B1EB00CEAD688907517710E01426A9D0A090DE3F473577918B98C9135B51473844513D784CC096A013F1
                          Malicious:false
                          Antivirus:
                          • Antivirus: ReversingLabs, Detection: 0%
                          Joe Sandbox View:
                          • Filename: PI PDF.exe, Detection: malicious, Browse
                          • Filename: PI PDF.exe, Detection: malicious, Browse
                          • Filename: GZLA202403048 - revised copy.exe, Detection: malicious, Browse
                          • Filename: FHW PO5ED07 07.22.24.exe, Detection: malicious, Browse
                          Reputation:low
                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V....................g.........h...............................Rich....................PE..L........................^...0.......2.......p....@.......................................@......@..........................d...X........................'......l.......T...............................................`....m..@....................text....].......^.................. ..`.data........p.......b..............@....idata..h............d..............@..@.didat...............z..............@....rsrc................|..............@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................................................................

                          C:\Users\user\AppData\Local\Temp\Melber

                          Download File
                          Process:C:\Users\user\Desktop\1lAxaLKP7E.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):1058304
                          Entropy (8bit):7.712843783462931
                          Encrypted:false
                          SSDEEP:24576:1PbzVMhwYMlbNX9KEsT6ADW5PmXfP+xhvPZLALi0Xr:z7pXpoMXZW5
                          MD5:2BD6688C3227C641442C971DF2A2BF24
                          SHA1:1EB076D65CC349356384E1F878A39DE883A1D5CC
                          SHA-256:42BDB93776F185B93E9EB0F4749F1B0161245F04EC577A5B59BF4E5130DBEFFC
                          SHA-512:92C665E8838199D05E770825C80715AC799DF6822A8CB5C5A98191B2738E0C75266B47EBD307D0A86E3BA6C464DA50345D50BB4B229952F62AFC55DCD3A83C81
                          Malicious:false
                          Reputation:low
                          Preview:.k.4@F77OVLT.4B.77KVCT1.4XF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF67K.ST?I.K...J..u..`*/D.;$,3C7Yb+BD?v!1.$A,fBY/31tf?Zqt:=oaCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1Vd.F7{J^CMo..BF77KVCT.V..M65RV.]1V.DF77KV..8V4RF77._CT1.4BV77KTCT5V4BF77KRCT1V4BF7.[VCP1V4BF75KVCT1F4B.77KVST1F4BF77KFCT1V4BF77KVCT;VvhF77K]CdLS4BF77KVCT1V4BF77KV.^1.BF77KVCT1V,.L7.KVCT1V4BF77K.IT)V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77K...tV4BF.BVCD1V4.O77OVCT1V4BF77KVCT.V4".vc.VCT1..BF7.BVCd1V4.O77KVCT1V4BF77.VC.s.gBF77K.RT1V.KF77KVC.8V4BF77KVCT1V4BF7.e?'5E74B..7KVC^1V.BF7.BVCT1V4BF77KVC.1V.l2[DKVCT!V4BF.=KVCT1V.KF77KVCT1V4BF77KV.zC2U6'77rVCT1.>BF57KV.]1V4BF77KVCT1VtBFg.93/;RV4..77K.IT1.4BF.>KVCT1V4BF77KV.T1..05ETKVCdLS4BF<7K(FT1.>BF77KVCT1V4BFw7K.CT1V4BF77KVCT!Z4BF77K.HT1V4BF77KVCT1.4B.77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KVCT1V4BF77KV

                          C:\Users\user\AppData\Local\Temp\aut6951.tmp

                          Download File
                          Process:C:\Users\user\Desktop\1lAxaLKP7E.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):922848
                          Entropy (8bit):7.984317222456412
                          Encrypted:false
                          SSDEEP:24576:aADST6RwL+bgNojHwiygr8IUYHiOXoWcHBamL/vlZKNwts:aA+TCm+bgNWHwiZr8IBH+l0mLlA+ts
                          MD5:5AF960A7E92481BDD5302E8C79E7C773
                          SHA1:3BA9EBD93B1BD03740EF99EBA81B81AB3C282000
                          SHA-256:E3D106E6889A2779189C6815D37A2E8304748A2103BED46009D03AC0F70060B2
                          SHA-512:B3DFE2C832E40270E656078D1D91C3C191242065F1BD042B50480D6FA9D7B7978D47CA2531E4F321F3166C614446C5C502B7B01E30DF0554AE7418A54ED6537F
                          Malicious:false
                          Reputation:low
                          Preview:EA06..&.....J..o7...Nv.iB.M......1.M+.`.... ...m7..*uI.'.K.....:..X%R.$^w$.L.sz.WB.O....FIA.Y.U.|.ct.O.W...{o..,~.......F...U..6.....k.V.p.i.J...j.* .....*.J..Y....T*...T..&.....,ko[.P...x..1.i..............N..k@.[]..).0._.'^......@..x.............".@.....U.t@.c.O..@.>..Zi".].p..f....0.......S..~.]Z....l.....,u)`.X.N..~?...'..f.J..:.,.5h.....<..I.[.l.V....Y..@....h.x;..eU.I..{...>.Q.........](Tk<fs3...Ui....,A.5I.......~..Rc..L&.Z........(.U&?...7.w.B.J~..h./..@._..LE....P...kF.P.....s/..'.P.f..k](T;.ZO%.T,.J...w....:..w.I.`.w...u..x]Z.S.N(.y.J..x.u<...y........w2...r..X.,.4.....5s....V...U...2..$....d..u....&.b.Q.r..N.....p..Gd..g....h.L,2.$.k_.n`Ti.....R..p9...0....q.\/.i......!.i...w...:...t.Plw.L.M7...*4.a...g.I...W..&.e...(r.......(T....8..hs...F....u..y...d.N$Ri.....;}Kw..@...-.'O.j.vJ......{...cV.c.`........I..w...r.B.0.l....$......v~..Z.X..0@,.....Gf.J...w...I....._.0....q.z/0i..?...*.J..KR..&...JE..W..&.*.u..$.*.j]W.\w5K.....[.T........X.[..

                          C:\Users\user\AppData\Local\Temp\aut6A3C.tmp

                          Download File
                          Process:C:\Users\user\Desktop\1lAxaLKP7E.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):43520
                          Entropy (8bit):7.825792863700142
                          Encrypted:false
                          SSDEEP:768:CgVbskUzkT4tmRHe5uW46Y86vrCN2G2c/I1WF+9gm++3Zu/EHjbxOsV7ZqoiiWj7:DtskakT4wRH718CCcUCWoZhZu/63xO8W
                          MD5:D242B4FC3CD4634554D81F7A2A737D16
                          SHA1:1AF4B23AA6DA25EDAB69AE9F0FC12FC22C9520ED
                          SHA-256:1638A8F9301C73821074EDE409260E6574CA1F019D33633E954DC83DB8870EC5
                          SHA-512:E72056469171BE580257A5B6B4F0B241F48017E46981BFF6508B30DFB243DF39BC55B8BBBAD1A70916E0DACED8AC887143DD6EF1A5383FF157269106BE86CA73
                          Malicious:false
                          Reputation:low
                          Preview:EA06..P...*.y."g5......6.Tf.Zd.gR..).9.:m5.M.tY..6..&s...eD..*.9.Bg0....Z..l..Q.szD.eA..(.9.bm2.L.....3.Sfs...Nf...3.V&s...iK.9g.Y..6.Sfs...mU..hs9..g0.........V.sj..mG..O..$.iV.M*s9..g6..).i..g7.L.T....mS.'.Ng0......3.Pfs.L.kW..k..,....L.....6........3.U...x.J.D..$...g5.l(.i..yY..h39.6g5..(.%...A....9.Fg6..0 ..jm4....i.,..Lj.!..._U.B*..\..V@.5N..k@.U^m5.......gC...%.P..O......`....6T...3..s..fm2...5.....Q...@.......e*g8...59..6.U.s...eG.L..i...X......<.....@(%.g6...U@..kT..j.9.>m2........C.f..(.H..U)...B..5...3..Z.9... .b...0.UE.6...T..!.L....*.9.T....).i.....O..:...T......g5 .FgM........B..HT).....I)si.Nl.RN@..4..Q..(.@..1Z..g..r.3....I.....?+.i.Jl....4..6..).I..3..@~.....U@l. ...DV.s..P...".3.... .?j.`..mD..h4.-...B.!T..j..o.T. 0h......W....C.0..mP..+.@....B...-.(....m.. ......qY......4...mK.B.9...l......+......8....H@6`.AE. @u..BiU.2.6*h....J0. .....{.$..........L..)`.. ...........!.o`......06..}..EUp;...!V@H .....L..`..N..@.p..N.....0.....T.%..

                          C:\Users\user\AppData\Local\Temp\selectee

                          Download File
                          Process:C:\Users\user\Desktop\1lAxaLKP7E.exe
                          File Type:ASCII text, with very long lines (65536), with no line terminators
                          Category:dropped
                          Size (bytes):86022
                          Entropy (8bit):4.178944547569951
                          Encrypted:false
                          SSDEEP:1536:1BFej+WYxpZHoVTmfvXydXrbTjQtj1ueEu:1BFzzx2mf/yBcj1NP
                          MD5:75C99184982434A488C1FC86593E886C
                          SHA1:42FBBAF113BD3351D095786253D8AA5302450786
                          SHA-256:7FD40D14212C6505A194F2EB022BEE7ED787C21B8627CA75B3E7956CFF3329E3
                          SHA-512:3784A3BF25B646E6FA24CB9021ADFAE07FE91572036DFC520204ABAEE532560C3A4C933A53B06DDCF1C499F3D6DF6EC69C22A688B9081D2F7CFA54C8B1C2E013
                          Malicious:false
                          Reputation:low
                          Preview:30W78H35E35Q38E62Q65L63R38L31N65P63E63J63H30Y32D30V30P30F30F35B36F35G37H62A38G36X62J30I30Q30M30R30Q30M36H36C38X39V34K35B38E34B62M39P36U35C30K30G30A30X30F30Z36S36G38H39D34V64S38D36E62N61F37L32O30H30G30L30Y30S30U36N36Z38A39I35W35X38G38H62L38K36L65G30F30Y30U30T30S30O36G36C38C39P34A35S38F61X62Y39A36M35D30E30W30M30A30V30E36Q36Y38G39P34Z64N38L63K62Y61V36X63Y30P30W30Q30V30G30M36Y36C38C39N35Z35X38W65B62Y38A33C33T30J30V30O30V30J30P36E36K38G39I34Y35R39L30Y62U39Y33I32O30G30P30H30F30C30B36K36J38S39S34G64V39B32G62P61L32X65E30O30O30J30A30L30N36F36R38S39T35R35T39U34O62E38V36E34C30H30M30U30R30L30N36R36O38V39D34Q35N39E36C62S39O36J63F30L30E30U30R30O30T36S36D38C39S34V64C39V38U62Y61F36M63B30U30Y30A30J30J30Q36Q36S38X39P35E35Q39R61V33M33H63Y30D36R36T38V39B34F35H39K63S62O39Z36F65D30F30D30T30D30Z30E36Y36E38J39G38T64I34B34X66R66M66R66L66B66H62D61W37M34Z30Z30B30I30U30V30D36G36S38Z39M39H35P34F36A66J66B66T66F66D66E62M38D36Z34G30I30K30I30T30W30Z36B36G38M39F38D35G34W38L66L66S66E66P66A66T62O39L36E63X30L30J30X30L30D3

                          C:\Users\user\Desktop\._cache_svchost.exe

                          Download File
                          Process:C:\Windows\SysWOW64\svchost.exe
                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                          Category:dropped
                          Size (bytes):286720
                          Entropy (8bit):7.963765407781625
                          Encrypted:false
                          SSDEEP:6144:YDROfDbDjSYR8LqOzuyj6Ck6pXGfJhBtzTWQCOe2D:YDR2nSKFO5jM6GvBRWQ3e
                          MD5:8A4835835C59FDB159CF2F3EF7CF2907
                          SHA1:43EF2C70461814EA5BB6AE7EA6F28F3E6B9B87B2
                          SHA-256:4E1ECCC2E1AB923F3A969538565E31C6ECB3DC61207D6CD2107F2FB002CFDD83
                          SHA-512:137E9FBA7DB3E6AA3B9C49E93F60E0896FC7918DD79410BF31FC6B43D9C3539B00D79FDC1557D2F017EFA590D6383CFFE21DFA2EA9B31141CD0AFD03F466DABE
                          Malicious:true
                          Antivirus:
                          • Antivirus: Avira, Detection: 100%
                          • Antivirus: Joe Sandbox ML, Detection: 100%
                          • Antivirus: ReversingLabs, Detection: 88%
                          Reputation:low
                          Preview:MZER.....X......<......(..............................................!..L.!This program cannot be run in DOS mode....$.......y...=`g.=`g.=`g.....:`g.....<`g.....<`g.Rich=`g.........PE..L....:.U.................N...................`....@..........................`............@..........................................................................................................................................................text...4L.......N.................. ..`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                          Static File Info

                          General

                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                          Entropy (8bit):7.5507491163708
                          TrID:
                          • Win32 Executable (generic) a (10002005/4) 99.96%
                          • Generic Win/DOS Executable (2004/3) 0.02%
                          • DOS Executable Generic (2002/1) 0.02%
                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                          File name:1lAxaLKP7E.exe
                          File size:1'904'640 bytes
                          MD5:98c1a12ce79248bbdb4c8a65fc227e58
                          SHA1:259ae7a3d239a352db772433075f649d5fbda8e7
                          SHA256:91b60b1ae0b37343c671b632eb3e358d9a5029c9c6405556ba835528c67fd6d8
                          SHA512:a08eb3182c8cc7b3cc7880ff644de60951a3476dd0325b63d306f1c7f48cde40d21bfa76d85a23c6a6f545f16b30d99372f8bfb876d1c1ae928ad75e713a8c7e
                          SSDEEP:49152:tTvC/MTQYxsWR7a05iPEgLwJqejB/aWN7vaYz:BjTQYxsWR3gMJqWaAJ
                          TLSH:C495E10233D1C062FF9B95334F9AF65156BD6A260123E62F13A81C79BE701B1563E7A3
                          File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                          File Icon

                          Icon Hash:aaf3e3e3938382a0

                          Static PE Info

                          General

                          Entrypoint:0x420577
                          Entrypoint Section:.text
                          Digitally signed:false
                          Imagebase:0x400000
                          Subsystem:windows gui
                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                          DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                          Time Stamp:0x66CC5BD1 [Mon Aug 26 10:41:21 2024 UTC]
                          TLS Callbacks:
                          CLR (.Net) Version:
                          OS Version Major:5
                          OS Version Minor:1
                          File Version Major:5
                          File Version Minor:1
                          Subsystem Version Major:5
                          Subsystem Version Minor:1
                          Import Hash:948cc502fe9226992dce9417f952fce3

                          Entrypoint Preview

                          Instruction
                          call 00007FE1348EEDE3h
                          jmp 00007FE1348EE6EFh
                          push ebp
                          mov ebp, esp
                          push esi
                          push dword ptr [ebp+08h]
                          mov esi, ecx
                          call 00007FE1348EE8CDh
                          mov dword ptr [esi], 0049FDF0h
                          mov eax, esi
                          pop esi
                          pop ebp
                          retn 0004h
                          and dword ptr [ecx+04h], 00000000h
                          mov eax, ecx
                          and dword ptr [ecx+08h], 00000000h
                          mov dword ptr [ecx+04h], 0049FDF8h
                          mov dword ptr [ecx], 0049FDF0h
                          ret
                          push ebp
                          mov ebp, esp
                          push esi
                          push dword ptr [ebp+08h]
                          mov esi, ecx
                          call 00007FE1348EE89Ah
                          mov dword ptr [esi], 0049FE0Ch
                          mov eax, esi
                          pop esi
                          pop ebp
                          retn 0004h
                          and dword ptr [ecx+04h], 00000000h
                          mov eax, ecx
                          and dword ptr [ecx+08h], 00000000h
                          mov dword ptr [ecx+04h], 0049FE14h
                          mov dword ptr [ecx], 0049FE0Ch
                          ret
                          push ebp
                          mov ebp, esp
                          push esi
                          mov esi, ecx
                          lea eax, dword ptr [esi+04h]
                          mov dword ptr [esi], 0049FDD0h
                          and dword ptr [eax], 00000000h
                          and dword ptr [eax+04h], 00000000h
                          push eax
                          mov eax, dword ptr [ebp+08h]
                          add eax, 04h
                          push eax
                          call 00007FE1348F148Dh
                          pop ecx
                          pop ecx
                          mov eax, esi
                          pop esi
                          pop ebp
                          retn 0004h
                          lea eax, dword ptr [ecx+04h]
                          mov dword ptr [ecx], 0049FDD0h
                          push eax
                          call 00007FE1348F14D8h
                          pop ecx
                          ret
                          push ebp
                          mov ebp, esp
                          push esi
                          mov esi, ecx
                          lea eax, dword ptr [esi+04h]
                          mov dword ptr [esi], 0049FDD0h
                          push eax
                          call 00007FE1348F14C1h
                          test byte ptr [ebp+08h], 00000001h
                          pop ecx

                          Rich Headers

                          Programming Language:
                          • [ C ] VS2008 SP1 build 30729
                          • [IMP] VS2008 SP1 build 30729

                          Data Directories

                          NameVirtual AddressVirtual Size Is in Section
                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000xfa53c.rsrc
                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x1cf0000x7594.reloc
                          IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                          IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                          Sections

                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                          .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                          .rsrc0xd40000xfa53c0xfa600ec6dbe7af996d8b891d35e8baa493ec4False0.9739960371942087data7.978192152268509IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .reloc0x1cf0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                          Resources

                          NameRVASizeTypeLanguageCountryZLIB Complexity
                          RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                          RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                          RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                          RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                          RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                          RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                          RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                          RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                          RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                          RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                          RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                          RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                          RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                          RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                          RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                          RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                          RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                          RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                          RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                          RT_RCDATA0xdc7b80xf1802data1.000314399920743
                          RT_GROUP_ICON0x1cdfbc0x76dataEnglishGreat Britain0.6610169491525424
                          RT_GROUP_ICON0x1ce0340x14dataEnglishGreat Britain1.25
                          RT_GROUP_ICON0x1ce0480x14dataEnglishGreat Britain1.15
                          RT_GROUP_ICON0x1ce05c0x14dataEnglishGreat Britain1.25
                          RT_VERSION0x1ce0700xdcdataEnglishGreat Britain0.6181818181818182
                          RT_MANIFEST0x1ce14c0x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                          Imports

                          DLLImport
                          WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                          VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                          WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                          COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                          MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                          WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                          PSAPI.DLLGetProcessMemoryInfo
                          IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                          USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                          UxTheme.dllIsThemeActive
                          KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                          USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                          GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                          COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                          ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                          SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                          ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                          OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                          Possible Origin

                          Language of compilation systemCountry where language is spokenMap
                          EnglishGreat Britain

                          Network Behavior

                          ⊘No network behavior found

                          Statistics

                          CPU Usage

                          Click to jump to process

                          Memory Usage

                          Click to jump to process

                          High Level Behavior Distribution

                          Click to dive into process behavior distribution

                          Behavior

                          Click to jump to process

                          System Behavior

                          General

                          Target ID:0
                          Start time:08:31:06
                          Start date:05/09/2024
                          Path:C:\Users\user\Desktop\1lAxaLKP7E.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\Desktop\1lAxaLKP7E.exe"
                          Imagebase:0x670000
                          File size:1'904'640 bytes
                          MD5 hash:98C1A12CE79248BBDB4C8A65FC227E58
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000002.1815969856.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                          Reputation:low
                          Has exited:true

                          General

                          Target ID:1
                          Start time:08:31:15
                          Start date:05/09/2024
                          Path:C:\Windows\SysWOW64\svchost.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\Desktop\1lAxaLKP7E.exe"
                          Imagebase:0x520000
                          File size:46'504 bytes
                          MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:Borland Delphi
                          Yara matches:
                          • Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000002.1823152194.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:2
                          Start time:08:31:16
                          Start date:05/09/2024
                          Path:C:\Users\user\Desktop\._cache_svchost.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\Desktop\._cache_svchost.exe"
                          Imagebase:0x630000
                          File size:286'720 bytes
                          MD5 hash:8A4835835C59FDB159CF2F3EF7CF2907
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2178717615.0000000000631000.00000040.00000001.01000000.00000005.sdmp, Author: unknown
                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2178961116.0000000000E20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                          Antivirus matches:
                          • Detection: 100%, Avira
                          • Detection: 100%, Joe Sandbox ML
                          • Detection: 88%, ReversingLabs
                          Reputation:low
                          Has exited:true

                          General

                          Target ID:3
                          Start time:08:31:16
                          Start date:05/09/2024
                          Path:C:\ProgramData\Synaptics\Synaptics.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                          Imagebase:0x70000
                          File size:46'504 bytes
                          MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Antivirus matches:
                          • Detection: 0%, ReversingLabs
                          Reputation:high
                          Has exited:true

                          General

                          Target ID:7
                          Start time:08:31:28
                          Start date:05/09/2024
                          Path:C:\ProgramData\Synaptics\Synaptics.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\ProgramData\Synaptics\Synaptics.exe"
                          Imagebase:0x70000
                          File size:46'504 bytes
                          MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                          Has elevated privileges:false
                          Has administrator privileges:false
                          Programmed in:C, C++ or other language
                          Reputation:high
                          Has exited:true

                          Disassembly

                          Reset < >

                            Execution Graph

                            Execution Coverage:3.4%
                            Dynamic/Decrypted Code Coverage:0.4%
                            Signature Coverage:7.4%
                            Total number of Nodes:2000
                            Total number of Limit Nodes:72
                            execution_graph 94358 671044 94363 6710f3 94358->94363 94360 67104a 94399 6900a3 29 API calls __onexit 94360->94399 94362 671054 94400 671398 94363->94400 94367 67116a 94410 67a961 94367->94410 94370 67a961 22 API calls 94371 67117e 94370->94371 94372 67a961 22 API calls 94371->94372 94373 671188 94372->94373 94374 67a961 22 API calls 94373->94374 94375 6711c6 94374->94375 94376 67a961 22 API calls 94375->94376 94377 671292 94376->94377 94415 67171c 94377->94415 94381 6712c4 94382 67a961 22 API calls 94381->94382 94383 6712ce 94382->94383 94436 681940 94383->94436 94385 6712f9 94446 671aab 94385->94446 94387 671315 94388 671325 GetStdHandle 94387->94388 94389 67137a 94388->94389 94390 6b2485 94388->94390 94393 671387 OleInitialize 94389->94393 94390->94389 94391 6b248e 94390->94391 94453 68fddb 94391->94453 94393->94360 94394 6b2495 94463 6e011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 94394->94463 94396 6b249e 94464 6e0944 CreateThread 94396->94464 94398 6b24aa CloseHandle 94398->94389 94399->94362 94465 6713f1 94400->94465 94403 6713f1 22 API calls 94404 6713d0 94403->94404 94405 67a961 22 API calls 94404->94405 94406 6713dc 94405->94406 94472 676b57 94406->94472 94408 671129 94409 671bc3 6 API calls 94408->94409 94409->94367 94411 68fe0b 22 API calls 94410->94411 94412 67a976 94411->94412 94413 68fddb 22 API calls 94412->94413 94414 671174 94413->94414 94414->94370 94416 67a961 22 API calls 94415->94416 94417 67172c 94416->94417 94418 67a961 22 API calls 94417->94418 94419 671734 94418->94419 94420 67a961 22 API calls 94419->94420 94421 67174f 94420->94421 94422 68fddb 22 API calls 94421->94422 94423 67129c 94422->94423 94424 671b4a 94423->94424 94425 671b58 94424->94425 94426 67a961 22 API calls 94425->94426 94427 671b63 94426->94427 94428 67a961 22 API calls 94427->94428 94429 671b6e 94428->94429 94430 67a961 22 API calls 94429->94430 94431 671b79 94430->94431 94432 67a961 22 API calls 94431->94432 94433 671b84 94432->94433 94434 68fddb 22 API calls 94433->94434 94435 671b96 RegisterWindowMessageW 94434->94435 94435->94381 94437 68195d 94436->94437 94438 681981 94436->94438 94445 68196e 94437->94445 94519 690242 5 API calls __Init_thread_wait 94437->94519 94517 690242 5 API calls __Init_thread_wait 94438->94517 94440 68198b 94440->94437 94518 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94440->94518 94442 688727 94442->94445 94520 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94442->94520 94445->94385 94447 6b272d 94446->94447 94448 671abb 94446->94448 94521 6e3209 23 API calls 94447->94521 94449 68fddb 22 API calls 94448->94449 94451 671ac3 94449->94451 94451->94387 94452 6b2738 94456 68fde0 94453->94456 94454 69ea0c ___std_exception_copy 21 API calls 94454->94456 94455 68fdfa 94455->94394 94456->94454 94456->94455 94459 68fdfc 94456->94459 94522 694ead 7 API calls 2 library calls 94456->94522 94458 69066d 94524 6932a4 RaiseException 94458->94524 94459->94458 94523 6932a4 RaiseException 94459->94523 94462 69068a 94462->94394 94463->94396 94464->94398 94525 6e092a 28 API calls 94464->94525 94466 67a961 22 API calls 94465->94466 94467 6713fc 94466->94467 94468 67a961 22 API calls 94467->94468 94469 671404 94468->94469 94470 67a961 22 API calls 94469->94470 94471 6713c6 94470->94471 94471->94403 94473 676b67 _wcslen 94472->94473 94474 6b4ba1 94472->94474 94477 676ba2 94473->94477 94478 676b7d 94473->94478 94495 6793b2 94474->94495 94476 6b4baa 94476->94476 94479 68fddb 22 API calls 94477->94479 94484 676f34 22 API calls 94478->94484 94481 676bae 94479->94481 94485 68fe0b 94481->94485 94482 676b85 __fread_nolock 94482->94408 94484->94482 94487 68fddb 94485->94487 94488 68fdfa 94487->94488 94491 68fdfc 94487->94491 94499 69ea0c 94487->94499 94506 694ead 7 API calls 2 library calls 94487->94506 94488->94482 94490 69066d 94508 6932a4 RaiseException 94490->94508 94491->94490 94507 6932a4 RaiseException 94491->94507 94494 69068a 94494->94482 94496 6793c0 94495->94496 94497 6793c9 __fread_nolock 94495->94497 94496->94497 94511 67aec9 94496->94511 94497->94476 94497->94497 94504 6a3820 _abort 94499->94504 94500 6a385e 94510 69f2d9 20 API calls _abort 94500->94510 94502 6a3849 RtlAllocateHeap 94503 6a385c 94502->94503 94502->94504 94503->94487 94504->94500 94504->94502 94509 694ead 7 API calls 2 library calls 94504->94509 94506->94487 94507->94490 94508->94494 94509->94504 94510->94503 94512 67aedc 94511->94512 94513 67aed9 __fread_nolock 94511->94513 94514 68fddb 22 API calls 94512->94514 94513->94497 94515 67aee7 94514->94515 94516 68fe0b 22 API calls 94515->94516 94516->94513 94517->94440 94518->94437 94519->94442 94520->94445 94521->94452 94522->94456 94523->94458 94524->94462 94526 672de3 94527 672df0 __wsopen_s 94526->94527 94528 6b2c2b ___scrt_fastfail 94527->94528 94529 672e09 94527->94529 94531 6b2c47 GetOpenFileNameW 94528->94531 94542 673aa2 94529->94542 94533 6b2c96 94531->94533 94535 676b57 22 API calls 94533->94535 94537 6b2cab 94535->94537 94537->94537 94539 672e27 94570 6744a8 94539->94570 94599 6b1f50 94542->94599 94545 673ace 94547 676b57 22 API calls 94545->94547 94546 673ae9 94605 67a6c3 94546->94605 94549 673ada 94547->94549 94601 6737a0 94549->94601 94552 672da5 94553 6b1f50 __wsopen_s 94552->94553 94554 672db2 GetLongPathNameW 94553->94554 94555 676b57 22 API calls 94554->94555 94556 672dda 94555->94556 94557 673598 94556->94557 94558 67a961 22 API calls 94557->94558 94559 6735aa 94558->94559 94560 673aa2 23 API calls 94559->94560 94561 6735b5 94560->94561 94562 6b32eb 94561->94562 94563 6735c0 94561->94563 94568 6b330d 94562->94568 94623 68ce60 41 API calls 94562->94623 94611 67515f 94563->94611 94569 6735df 94569->94539 94624 674ecb 94570->94624 94573 6b3833 94646 6e2cf9 94573->94646 94575 674ecb 94 API calls 94577 6744e1 94575->94577 94576 6b3848 94578 6b3869 94576->94578 94579 6b384c 94576->94579 94577->94573 94580 6744e9 94577->94580 94582 68fe0b 22 API calls 94578->94582 94673 674f39 94579->94673 94583 6744f5 94580->94583 94584 6b3854 94580->94584 94598 6b38ae 94582->94598 94672 67940c 136 API calls 2 library calls 94583->94672 94679 6dda5a 82 API calls 94584->94679 94587 672e31 94588 6b3862 94588->94578 94589 674f39 68 API calls 94593 6b3a5f 94589->94593 94593->94589 94685 6d989b 82 API calls __wsopen_s 94593->94685 94595 679cb3 22 API calls 94595->94598 94598->94593 94598->94595 94680 6d967e 22 API calls __fread_nolock 94598->94680 94681 6d95ad 42 API calls _wcslen 94598->94681 94682 6e0b5a 22 API calls 94598->94682 94683 67a4a1 22 API calls __fread_nolock 94598->94683 94684 673ff7 22 API calls 94598->94684 94600 673aaf GetFullPathNameW 94599->94600 94600->94545 94600->94546 94602 6737ae 94601->94602 94603 6793b2 22 API calls 94602->94603 94604 672e12 94603->94604 94604->94552 94606 67a6d0 94605->94606 94607 67a6dd 94605->94607 94606->94549 94608 68fddb 22 API calls 94607->94608 94609 67a6e7 94608->94609 94610 68fe0b 22 API calls 94609->94610 94610->94606 94612 67516e 94611->94612 94616 67518f __fread_nolock 94611->94616 94614 68fe0b 22 API calls 94612->94614 94613 68fddb 22 API calls 94615 6735cc 94613->94615 94614->94616 94617 6735f3 94615->94617 94616->94613 94618 673605 94617->94618 94622 673624 __fread_nolock 94617->94622 94620 68fe0b 22 API calls 94618->94620 94619 68fddb 22 API calls 94621 67363b 94619->94621 94620->94622 94621->94569 94622->94619 94623->94562 94686 674e90 LoadLibraryA 94624->94686 94629 674ef6 LoadLibraryExW 94694 674e59 LoadLibraryA 94629->94694 94630 6b3ccf 94631 674f39 68 API calls 94630->94631 94633 6b3cd6 94631->94633 94635 674e59 3 API calls 94633->94635 94637 6b3cde 94635->94637 94716 6750f5 94637->94716 94638 674f20 94638->94637 94639 674f2c 94638->94639 94641 674f39 68 API calls 94639->94641 94642 6744cd 94641->94642 94642->94573 94642->94575 94645 6b3d05 94647 6e2d15 94646->94647 94648 67511f 64 API calls 94647->94648 94649 6e2d29 94648->94649 94987 6e2e66 94649->94987 94652 6750f5 40 API calls 94653 6e2d56 94652->94653 94654 6750f5 40 API calls 94653->94654 94655 6e2d66 94654->94655 94656 6750f5 40 API calls 94655->94656 94657 6e2d81 94656->94657 94658 6750f5 40 API calls 94657->94658 94659 6e2d9c 94658->94659 94660 67511f 64 API calls 94659->94660 94661 6e2db3 94660->94661 94662 69ea0c ___std_exception_copy 21 API calls 94661->94662 94663 6e2dba 94662->94663 94664 69ea0c ___std_exception_copy 21 API calls 94663->94664 94665 6e2dc4 94664->94665 94666 6750f5 40 API calls 94665->94666 94667 6e2dd8 94666->94667 94668 6e28fe 27 API calls 94667->94668 94670 6e2dee 94668->94670 94669 6e2d3f 94669->94576 94670->94669 94993 6e22ce 94670->94993 94672->94587 94674 674f43 94673->94674 94676 674f4a 94673->94676 94675 69e678 67 API calls 94674->94675 94675->94676 94677 674f6a FreeLibrary 94676->94677 94678 674f59 94676->94678 94677->94678 94678->94584 94679->94588 94680->94598 94681->94598 94682->94598 94683->94598 94684->94598 94685->94593 94687 674ec6 94686->94687 94688 674ea8 GetProcAddress 94686->94688 94691 69e5eb 94687->94691 94689 674eb8 94688->94689 94689->94687 94690 674ebf FreeLibrary 94689->94690 94690->94687 94724 69e52a 94691->94724 94693 674eea 94693->94629 94693->94630 94695 674e6e GetProcAddress 94694->94695 94696 674e8d 94694->94696 94697 674e7e 94695->94697 94699 674f80 94696->94699 94697->94696 94698 674e86 FreeLibrary 94697->94698 94698->94696 94700 68fe0b 22 API calls 94699->94700 94701 674f95 94700->94701 94792 675722 94701->94792 94703 674fa1 __fread_nolock 94704 6750a5 94703->94704 94705 6b3d1d 94703->94705 94715 674fdc 94703->94715 94795 6742a2 CreateStreamOnHGlobal 94704->94795 94806 6e304d 74 API calls 94705->94806 94708 6b3d22 94710 67511f 64 API calls 94708->94710 94709 6750f5 40 API calls 94709->94715 94711 6b3d45 94710->94711 94712 6750f5 40 API calls 94711->94712 94714 67506e ISource 94712->94714 94714->94638 94715->94708 94715->94709 94715->94714 94801 67511f 94715->94801 94717 675107 94716->94717 94718 6b3d70 94716->94718 94828 69e8c4 94717->94828 94721 6e28fe 94970 6e274e 94721->94970 94723 6e2919 94723->94645 94725 69e536 ___scrt_is_nonwritable_in_current_image 94724->94725 94726 69e544 94725->94726 94729 69e574 94725->94729 94749 69f2d9 20 API calls _abort 94726->94749 94728 69e549 94750 6a27ec 26 API calls pre_c_initialization 94728->94750 94731 69e579 94729->94731 94732 69e586 94729->94732 94751 69f2d9 20 API calls _abort 94731->94751 94741 6a8061 94732->94741 94735 69e58f 94736 69e5a2 94735->94736 94737 69e595 94735->94737 94753 69e5d4 LeaveCriticalSection __fread_nolock 94736->94753 94752 69f2d9 20 API calls _abort 94737->94752 94738 69e554 __fread_nolock 94738->94693 94742 6a806d ___scrt_is_nonwritable_in_current_image 94741->94742 94754 6a2f5e EnterCriticalSection 94742->94754 94744 6a807b 94755 6a80fb 94744->94755 94748 6a80ac __fread_nolock 94748->94735 94749->94728 94750->94738 94751->94738 94752->94738 94753->94738 94754->94744 94756 6a811e 94755->94756 94757 6a8177 94756->94757 94764 6a8088 94756->94764 94771 69918d EnterCriticalSection 94756->94771 94772 6991a1 LeaveCriticalSection 94756->94772 94773 6a4c7d 94757->94773 94762 6a8189 94762->94764 94786 6a3405 11 API calls 2 library calls 94762->94786 94768 6a80b7 94764->94768 94765 6a81a8 94787 69918d EnterCriticalSection 94765->94787 94791 6a2fa6 LeaveCriticalSection 94768->94791 94770 6a80be 94770->94748 94771->94756 94772->94756 94779 6a4c8a _abort 94773->94779 94774 6a4cca 94789 69f2d9 20 API calls _abort 94774->94789 94775 6a4cb5 RtlAllocateHeap 94777 6a4cc8 94775->94777 94775->94779 94780 6a29c8 94777->94780 94779->94774 94779->94775 94788 694ead 7 API calls 2 library calls 94779->94788 94781 6a29d3 RtlFreeHeap 94780->94781 94782 6a29fc __dosmaperr 94780->94782 94781->94782 94783 6a29e8 94781->94783 94782->94762 94790 69f2d9 20 API calls _abort 94783->94790 94785 6a29ee GetLastError 94785->94782 94786->94765 94787->94764 94788->94779 94789->94777 94790->94785 94791->94770 94793 68fddb 22 API calls 94792->94793 94794 675734 94793->94794 94794->94703 94796 6742bc FindResourceExW 94795->94796 94800 6742d9 94795->94800 94797 6b35ba LoadResource 94796->94797 94796->94800 94798 6b35cf SizeofResource 94797->94798 94797->94800 94799 6b35e3 LockResource 94798->94799 94798->94800 94799->94800 94800->94715 94802 67512e 94801->94802 94803 6b3d90 94801->94803 94807 69ece3 94802->94807 94806->94708 94810 69eaaa 94807->94810 94809 67513c 94809->94715 94812 69eab6 ___scrt_is_nonwritable_in_current_image 94810->94812 94811 69eac2 94823 69f2d9 20 API calls _abort 94811->94823 94812->94811 94814 69eae8 94812->94814 94825 69918d EnterCriticalSection 94814->94825 94816 69eac7 94824 6a27ec 26 API calls pre_c_initialization 94816->94824 94817 69eaf4 94826 69ec0a 62 API calls 2 library calls 94817->94826 94820 69eb08 94827 69eb27 LeaveCriticalSection __fread_nolock 94820->94827 94822 69ead2 __fread_nolock 94822->94809 94823->94816 94824->94822 94825->94817 94826->94820 94827->94822 94831 69e8e1 94828->94831 94830 675118 94830->94721 94832 69e8ed ___scrt_is_nonwritable_in_current_image 94831->94832 94833 69e92d 94832->94833 94834 69e900 ___scrt_fastfail 94832->94834 94835 69e925 __fread_nolock 94832->94835 94844 69918d EnterCriticalSection 94833->94844 94858 69f2d9 20 API calls _abort 94834->94858 94835->94830 94837 69e937 94845 69e6f8 94837->94845 94840 69e91a 94859 6a27ec 26 API calls pre_c_initialization 94840->94859 94844->94837 94849 69e70a ___scrt_fastfail 94845->94849 94851 69e727 94845->94851 94846 69e717 94933 69f2d9 20 API calls _abort 94846->94933 94848 69e71c 94934 6a27ec 26 API calls pre_c_initialization 94848->94934 94849->94846 94849->94851 94854 69e76a __fread_nolock 94849->94854 94860 69e96c LeaveCriticalSection __fread_nolock 94851->94860 94852 69e886 ___scrt_fastfail 94936 69f2d9 20 API calls _abort 94852->94936 94854->94851 94854->94852 94861 69d955 94854->94861 94868 6a8d45 94854->94868 94935 69cf78 26 API calls 4 library calls 94854->94935 94858->94840 94859->94835 94860->94835 94862 69d961 94861->94862 94863 69d976 94861->94863 94937 69f2d9 20 API calls _abort 94862->94937 94863->94854 94865 69d966 94938 6a27ec 26 API calls pre_c_initialization 94865->94938 94867 69d971 94867->94854 94869 6a8d6f 94868->94869 94870 6a8d57 94868->94870 94871 6a90d9 94869->94871 94877 6a8db4 94869->94877 94948 69f2c6 20 API calls _abort 94870->94948 94964 69f2c6 20 API calls _abort 94871->94964 94873 6a8d5c 94949 69f2d9 20 API calls _abort 94873->94949 94876 6a90de 94965 69f2d9 20 API calls _abort 94876->94965 94879 6a8dbf 94877->94879 94882 6a8d64 94877->94882 94886 6a8def 94877->94886 94950 69f2c6 20 API calls _abort 94879->94950 94880 6a8dcc 94966 6a27ec 26 API calls pre_c_initialization 94880->94966 94882->94854 94883 6a8dc4 94951 69f2d9 20 API calls _abort 94883->94951 94887 6a8e08 94886->94887 94888 6a8e4a 94886->94888 94889 6a8e2e 94886->94889 94887->94889 94895 6a8e15 94887->94895 94955 6a3820 21 API calls 2 library calls 94888->94955 94952 69f2c6 20 API calls _abort 94889->94952 94891 6a8e33 94953 69f2d9 20 API calls _abort 94891->94953 94939 6af89b 94895->94939 94896 6a8e61 94897 6a29c8 _free 20 API calls 94896->94897 94900 6a8e6a 94897->94900 94898 6a8e3a 94954 6a27ec 26 API calls pre_c_initialization 94898->94954 94899 6a8fb3 94902 6a9029 94899->94902 94905 6a8fcc GetConsoleMode 94899->94905 94903 6a29c8 _free 20 API calls 94900->94903 94904 6a902d ReadFile 94902->94904 94906 6a8e71 94903->94906 94907 6a90a1 GetLastError 94904->94907 94908 6a9047 94904->94908 94905->94902 94909 6a8fdd 94905->94909 94910 6a8e7b 94906->94910 94911 6a8e96 94906->94911 94912 6a90ae 94907->94912 94913 6a9005 94907->94913 94908->94907 94914 6a901e 94908->94914 94909->94904 94915 6a8fe3 ReadConsoleW 94909->94915 94956 69f2d9 20 API calls _abort 94910->94956 94958 6a9424 28 API calls __wsopen_s 94911->94958 94962 69f2d9 20 API calls _abort 94912->94962 94921 6a8e45 __fread_nolock 94913->94921 94959 69f2a3 20 API calls __dosmaperr 94913->94959 94914->94921 94927 6a906c 94914->94927 94928 6a9083 94914->94928 94915->94914 94920 6a8fff GetLastError 94915->94920 94916 6a29c8 _free 20 API calls 94916->94882 94920->94913 94921->94916 94922 6a8e80 94957 69f2c6 20 API calls _abort 94922->94957 94923 6a90b3 94963 69f2c6 20 API calls _abort 94923->94963 94960 6a8a61 31 API calls 3 library calls 94927->94960 94928->94921 94929 6a909a 94928->94929 94961 6a88a1 29 API calls __wsopen_s 94929->94961 94932 6a909f 94932->94921 94933->94848 94934->94851 94935->94854 94936->94848 94937->94865 94938->94867 94940 6af8a8 94939->94940 94941 6af8b5 94939->94941 94967 69f2d9 20 API calls _abort 94940->94967 94944 6af8c1 94941->94944 94968 69f2d9 20 API calls _abort 94941->94968 94943 6af8ad 94943->94899 94944->94899 94946 6af8e2 94969 6a27ec 26 API calls pre_c_initialization 94946->94969 94948->94873 94949->94882 94950->94883 94951->94880 94952->94891 94953->94898 94954->94921 94955->94896 94956->94922 94957->94921 94958->94895 94959->94921 94960->94921 94961->94932 94962->94923 94963->94921 94964->94876 94965->94880 94966->94882 94967->94943 94968->94946 94969->94943 94973 69e4e8 94970->94973 94972 6e275d 94972->94723 94976 69e469 94973->94976 94975 69e505 94975->94972 94977 69e478 94976->94977 94979 69e48c 94976->94979 94984 69f2d9 20 API calls _abort 94977->94984 94983 69e488 __alldvrm 94979->94983 94986 6a333f 11 API calls 2 library calls 94979->94986 94980 69e47d 94985 6a27ec 26 API calls pre_c_initialization 94980->94985 94983->94975 94984->94980 94985->94983 94986->94983 94992 6e2e7a 94987->94992 94988 6750f5 40 API calls 94988->94992 94989 6e2d3b 94989->94652 94989->94669 94990 6e28fe 27 API calls 94990->94992 94991 67511f 64 API calls 94991->94992 94992->94988 94992->94989 94992->94990 94992->94991 94994 6e22e7 94993->94994 94995 6e22d9 94993->94995 94997 6e232c 94994->94997 94998 69e5eb 29 API calls 94994->94998 95021 6e22f0 94994->95021 94996 69e5eb 29 API calls 94995->94996 94996->94994 95022 6e2557 94997->95022 95000 6e2311 94998->95000 95000->94997 95002 6e231a 95000->95002 95001 6e2370 95003 6e2374 95001->95003 95004 6e2395 95001->95004 95006 69e678 67 API calls 95002->95006 95002->95021 95005 6e2381 95003->95005 95009 69e678 67 API calls 95003->95009 95026 6e2171 95004->95026 95012 69e678 67 API calls 95005->95012 95005->95021 95006->95021 95008 6e239d 95010 6e23c3 95008->95010 95011 6e23a3 95008->95011 95009->95005 95033 6e23f3 95010->95033 95013 6e23b0 95011->95013 95015 69e678 67 API calls 95011->95015 95012->95021 95016 69e678 67 API calls 95013->95016 95013->95021 95015->95013 95016->95021 95017 6e23de 95020 69e678 67 API calls 95017->95020 95017->95021 95018 6e23ca 95018->95017 95041 69e678 95018->95041 95020->95021 95021->94669 95023 6e257c 95022->95023 95025 6e2565 __fread_nolock 95022->95025 95024 69e8c4 __fread_nolock 40 API calls 95023->95024 95024->95025 95025->95001 95027 69ea0c ___std_exception_copy 21 API calls 95026->95027 95028 6e217f 95027->95028 95029 69ea0c ___std_exception_copy 21 API calls 95028->95029 95030 6e2190 95029->95030 95031 69ea0c ___std_exception_copy 21 API calls 95030->95031 95032 6e219c 95031->95032 95032->95008 95040 6e2408 95033->95040 95034 6e24c0 95058 6e2724 95034->95058 95036 6e24c7 95036->95018 95037 6e21cc 40 API calls 95037->95040 95040->95034 95040->95036 95040->95037 95054 6e2606 95040->95054 95062 6e2269 40 API calls 95040->95062 95042 69e684 ___scrt_is_nonwritable_in_current_image 95041->95042 95043 69e6aa 95042->95043 95044 69e695 95042->95044 95053 69e6a5 __fread_nolock 95043->95053 95098 69918d EnterCriticalSection 95043->95098 95115 69f2d9 20 API calls _abort 95044->95115 95046 69e69a 95116 6a27ec 26 API calls pre_c_initialization 95046->95116 95049 69e6c6 95099 69e602 95049->95099 95051 69e6d1 95117 69e6ee LeaveCriticalSection __fread_nolock 95051->95117 95053->95017 95055 6e2617 95054->95055 95056 6e261d 95054->95056 95055->95056 95063 6e26d7 95055->95063 95056->95040 95059 6e2742 95058->95059 95060 6e2731 95058->95060 95059->95036 95061 69dbb3 65 API calls 95060->95061 95061->95059 95062->95040 95064 6e2714 95063->95064 95065 6e2703 95063->95065 95064->95055 95067 69dbb3 95065->95067 95068 69dbdd 95067->95068 95069 69dbc1 95067->95069 95068->95064 95069->95068 95070 69dbcd 95069->95070 95071 69dbe3 95069->95071 95079 69f2d9 20 API calls _abort 95070->95079 95076 69d9cc 95071->95076 95074 69dbd2 95080 6a27ec 26 API calls pre_c_initialization 95074->95080 95081 69d97b 95076->95081 95079->95074 95080->95068 95082 69d987 ___scrt_is_nonwritable_in_current_image 95081->95082 95089 69918d EnterCriticalSection 95082->95089 95084 69d995 95090 69d9f4 95084->95090 95089->95084 95091 6a49a1 27 API calls 95090->95091 95092 69da09 95091->95092 95093 69da3a 62 API calls 95092->95093 95094 69da24 95093->95094 95095 6a4a56 62 API calls 95094->95095 95098->95049 95100 69e60f 95099->95100 95101 69e624 95099->95101 95143 69f2d9 20 API calls _abort 95100->95143 95105 69e61f 95101->95105 95118 69dc0b 95101->95118 95104 69e614 95144 6a27ec 26 API calls pre_c_initialization 95104->95144 95105->95051 95110 69d955 __fread_nolock 26 API calls 95111 69e646 95110->95111 95128 6a862f 95111->95128 95115->95046 95116->95053 95117->95053 95119 69dc1f 95118->95119 95120 69dc23 95118->95120 95124 6a4d7a 95119->95124 95120->95119 95121 69d955 __fread_nolock 26 API calls 95120->95121 95122 69dc43 95121->95122 95145 6a59be 95122->95145 95125 6a4d90 95124->95125 95126 69e640 95124->95126 95125->95126 95127 6a29c8 _free 20 API calls 95125->95127 95126->95110 95127->95126 95129 6a863e 95128->95129 95130 6a8653 95128->95130 95268 69f2c6 20 API calls _abort 95129->95268 95132 6a868e 95130->95132 95137 6a867a 95130->95137 95265 6a8607 95137->95265 95143->95104 95144->95105 95146 6a59ca ___scrt_is_nonwritable_in_current_image 95145->95146 95147 6a59ea 95146->95147 95148 6a59d2 95146->95148 95150 6a5a88 95147->95150 95155 6a5a1f 95147->95155 95224 69f2c6 20 API calls _abort 95148->95224 95229 69f2c6 20 API calls _abort 95150->95229 95151 6a59d7 95170 6a5147 EnterCriticalSection 95155->95170 95159 6a5a25 95170->95159 95224->95151 95317 6a8402 95322 6a81be 95317->95322 95320 6a842a 95327 6a81ef try_get_first_available_module 95322->95327 95324 6a83ee 95341 6a27ec 26 API calls pre_c_initialization 95324->95341 95326 6a8343 95326->95320 95334 6b0984 95326->95334 95333 6a8338 95327->95333 95337 698e0b 40 API calls 2 library calls 95327->95337 95329 6a838c 95329->95333 95338 698e0b 40 API calls 2 library calls 95329->95338 95331 6a83ab 95331->95333 95339 698e0b 40 API calls 2 library calls 95331->95339 95333->95326 95340 69f2d9 20 API calls _abort 95333->95340 95342 6b0081 95334->95342 95336 6b099f 95336->95320 95337->95329 95338->95331 95339->95333 95340->95324 95341->95326 95345 6b008d ___scrt_is_nonwritable_in_current_image 95342->95345 95343 6b009b 95399 69f2d9 20 API calls _abort 95343->95399 95345->95343 95347 6b00d4 95345->95347 95346 6b00a0 95400 6a27ec 26 API calls pre_c_initialization 95346->95400 95353 6b065b 95347->95353 95352 6b00aa __fread_nolock 95352->95336 95354 6b0678 95353->95354 95355 6b068d 95354->95355 95356 6b06a6 95354->95356 95416 69f2c6 20 API calls _abort 95355->95416 95402 6a5221 95356->95402 95359 6b0692 95417 69f2d9 20 API calls _abort 95359->95417 95360 6b06ab 95361 6b06cb 95360->95361 95362 6b06b4 95360->95362 95415 6b039a CreateFileW 95361->95415 95418 69f2c6 20 API calls _abort 95362->95418 95366 6b00f8 95401 6b0121 LeaveCriticalSection __wsopen_s 95366->95401 95367 6b06b9 95419 69f2d9 20 API calls _abort 95367->95419 95368 6b0781 GetFileType 95371 6b078c GetLastError 95368->95371 95372 6b07d3 95368->95372 95370 6b0756 GetLastError 95421 69f2a3 20 API calls __dosmaperr 95370->95421 95422 69f2a3 20 API calls __dosmaperr 95371->95422 95424 6a516a 21 API calls 2 library calls 95372->95424 95373 6b0704 95373->95368 95373->95370 95420 6b039a CreateFileW 95373->95420 95377 6b079a CloseHandle 95377->95359 95380 6b07c3 95377->95380 95379 6b0749 95379->95368 95379->95370 95423 69f2d9 20 API calls _abort 95380->95423 95381 6b07f4 95384 6b0840 95381->95384 95425 6b05ab 72 API calls 3 library calls 95381->95425 95383 6b07c8 95383->95359 95388 6b086d 95384->95388 95426 6b014d 72 API calls 4 library calls 95384->95426 95387 6b0866 95387->95388 95389 6b087e 95387->95389 95390 6a86ae __wsopen_s 29 API calls 95388->95390 95389->95366 95391 6b08fc CloseHandle 95389->95391 95390->95366 95427 6b039a CreateFileW 95391->95427 95393 6b0927 95394 6b0931 GetLastError 95393->95394 95398 6b095d 95393->95398 95428 69f2a3 20 API calls __dosmaperr 95394->95428 95396 6b093d 95429 6a5333 21 API calls 2 library calls 95396->95429 95398->95366 95399->95346 95400->95352 95401->95352 95403 6a522d ___scrt_is_nonwritable_in_current_image 95402->95403 95430 6a2f5e EnterCriticalSection 95403->95430 95405 6a5259 95434 6a5000 95405->95434 95406 6a5234 95406->95405 95411 6a52c7 EnterCriticalSection 95406->95411 95414 6a527b 95406->95414 95409 6a52a4 __fread_nolock 95409->95360 95412 6a52d4 LeaveCriticalSection 95411->95412 95411->95414 95412->95406 95431 6a532a 95414->95431 95415->95373 95416->95359 95417->95366 95418->95367 95419->95359 95420->95379 95421->95359 95422->95377 95423->95383 95424->95381 95425->95384 95426->95387 95427->95393 95428->95396 95429->95398 95430->95406 95442 6a2fa6 LeaveCriticalSection 95431->95442 95433 6a5331 95433->95409 95435 6a4c7d _abort 20 API calls 95434->95435 95437 6a5012 95435->95437 95436 6a501f 95438 6a29c8 _free 20 API calls 95436->95438 95437->95436 95443 6a3405 11 API calls 2 library calls 95437->95443 95440 6a5071 95438->95440 95440->95414 95441 6a5147 EnterCriticalSection 95440->95441 95441->95414 95442->95433 95443->95437 95444 671cad SystemParametersInfoW 95445 67ddac 95448 67caf0 95445->95448 95447 67ddb7 95449 67cb69 95448->95449 95453 67cf89 95448->95453 95450 67cf73 95449->95450 95451 67cb8c 95449->95451 95571 68d336 40 API calls 95450->95571 95451->95453 95534 67bbe0 95451->95534 95607 6e359c 82 API calls __wsopen_s 95453->95607 95456 6c0ee7 95456->95456 95457 67cd88 95567 67b567 39 API calls 95457->95567 95458 67cba7 95458->95453 95458->95457 95459 67cbf6 95458->95459 95460 67cf10 95458->95460 95467 6c0abf 95458->95467 95462 67cc07 95459->95462 95463 6c0b1a 95459->95463 95570 67a81b 41 API calls 95460->95570 95466 67ec40 236 API calls 95462->95466 95463->95453 95469 67ec40 236 API calls 95463->95469 95482 67cc1e 95466->95482 95467->95463 95492 67ce8b 95467->95492 95572 6f79b6 236 API calls 95467->95572 95573 68a308 236 API calls 95467->95573 95470 6c0b41 95469->95470 95472 6c0b51 95470->95472 95473 6c0bbe 95470->95473 95470->95492 95496 6c0b63 95470->95496 95471 67cde8 95480 6c0daa 95471->95480 95484 67cdfe 95471->95484 95491 6c0e4c 95471->95491 95471->95492 95587 67aceb 23 API calls ISource 95472->95587 95475 6c0c0d 95473->95475 95478 6c0bfb 95473->95478 95585 6db59b 22 API calls 95473->95585 95474 67cc3a 95474->95453 95542 67ec40 95474->95542 95589 6f47d4 236 API calls 95475->95589 95588 679c6e 22 API calls 95478->95588 95600 6f4523 240 API calls ___scrt_fastfail 95480->95600 95481 6c0e4a 95606 67289a 23 API calls 95481->95606 95482->95453 95482->95474 95482->95492 95590 67a8c7 95482->95590 95484->95481 95484->95491 95568 67b649 54 API calls 95484->95568 95488 6c0bb9 95586 67aceb 23 API calls ISource 95488->95586 95604 6f5705 23 API calls 95491->95604 95492->95447 95494 67ce43 95494->95491 95497 6c0e77 95494->95497 95569 67b649 54 API calls 95494->95569 95495 6c0de7 95502 6c0e35 95495->95502 95503 6c0df5 95495->95503 95496->95478 95574 6804f0 95496->95574 95605 67b649 54 API calls 95497->95605 95501 67cc82 95501->95492 95509 67ec40 236 API calls 95501->95509 95517 67ccb2 95501->95517 95602 67aceb 23 API calls ISource 95502->95602 95601 679c6e 22 API calls 95503->95601 95504 6c0ba8 95504->95478 95511 6804f0 22 API calls 95504->95511 95507 67ce5f 95507->95481 95507->95491 95514 67ce84 95507->95514 95512 6c0cc3 95509->95512 95510 6c0e3e 95603 67aceb 23 API calls ISource 95510->95603 95511->95488 95512->95492 95594 67aceb 23 API calls ISource 95512->95594 95516 68fddb 22 API calls 95514->95516 95516->95492 95519 67ccf2 95517->95519 95521 6c0d06 95517->95521 95518 6c0d23 95597 68ad9c 39 API calls 95518->95597 95519->95453 95519->95460 95519->95518 95525 67cd2e 95519->95525 95520 6c0d19 95596 67b415 39 API calls 95520->95596 95521->95520 95595 68ad9c 39 API calls 95521->95595 95525->95518 95526 67cd45 95525->95526 95527 67cd4a 95525->95527 95566 67b415 39 API calls 95526->95566 95529 67cd74 95527->95529 95531 6c0d66 95527->95531 95529->95453 95529->95457 95530 6c0d7a 95599 67b415 39 API calls 95530->95599 95531->95530 95598 68ad9c 39 API calls 95531->95598 95535 67be27 95534->95535 95537 67bbf3 95534->95537 95535->95458 95538 67a961 22 API calls 95537->95538 95540 67bc9d 95537->95540 95608 690242 5 API calls __Init_thread_wait 95537->95608 95609 6900a3 29 API calls __onexit 95537->95609 95610 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95537->95610 95538->95537 95540->95458 95549 67ec76 ISource 95542->95549 95543 690242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95543->95549 95544 6900a3 29 API calls pre_c_initialization 95544->95549 95545 6c4beb 95616 6e359c 82 API calls __wsopen_s 95545->95616 95547 67fef7 95551 67ed9d ISource 95547->95551 95555 67a8c7 22 API calls 95547->95555 95548 68fddb 22 API calls 95548->95549 95549->95543 95549->95544 95549->95545 95549->95547 95549->95548 95549->95551 95552 6c4b0b 95549->95552 95556 6c4600 95549->95556 95557 67a8c7 22 API calls 95549->95557 95560 67fbe3 95549->95560 95561 67a961 22 API calls 95549->95561 95564 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 95549->95564 95565 67f3ae ISource 95549->95565 95611 6801e0 236 API calls 2 library calls 95549->95611 95612 6806a0 41 API calls ISource 95549->95612 95551->95501 95614 6e359c 82 API calls __wsopen_s 95552->95614 95555->95551 95556->95551 95558 67a8c7 22 API calls 95556->95558 95557->95549 95558->95551 95560->95551 95562 6c4bdc 95560->95562 95560->95565 95561->95549 95615 6e359c 82 API calls __wsopen_s 95562->95615 95564->95549 95565->95551 95613 6e359c 82 API calls __wsopen_s 95565->95613 95566->95527 95567->95471 95568->95494 95569->95507 95570->95457 95571->95453 95572->95467 95573->95467 95575 680502 95574->95575 95577 68050b 95575->95577 95623 68a732 22 API calls 95575->95623 95578 6805c0 95577->95578 95579 68fddb 22 API calls 95577->95579 95578->95504 95580 680629 95579->95580 95581 68fddb 22 API calls 95580->95581 95582 680632 95581->95582 95617 679cb3 95582->95617 95585->95488 95586->95472 95587->95478 95588->95475 95589->95482 95591 67a8ea __fread_nolock 95590->95591 95592 67a8db 95590->95592 95591->95474 95592->95591 95593 68fe0b 22 API calls 95592->95593 95593->95591 95594->95517 95595->95520 95596->95518 95597->95527 95598->95530 95599->95453 95600->95495 95601->95492 95602->95510 95603->95481 95604->95497 95605->95481 95606->95492 95607->95456 95608->95537 95609->95537 95610->95537 95611->95549 95612->95549 95613->95551 95614->95551 95615->95545 95616->95551 95618 679cc2 _wcslen 95617->95618 95619 68fe0b 22 API calls 95618->95619 95620 679cea __fread_nolock 95619->95620 95621 68fddb 22 API calls 95620->95621 95622 679d00 95621->95622 95622->95504 95623->95577 95624 6c2a00 95638 67d7b0 ISource 95624->95638 95625 67db11 PeekMessageW 95625->95638 95626 67d807 GetInputState 95626->95625 95626->95638 95627 6c1cbe TranslateAcceleratorW 95627->95638 95629 67db73 TranslateMessage DispatchMessageW 95630 67db8f PeekMessageW 95629->95630 95630->95638 95631 67da04 timeGetTime 95631->95638 95632 67dbaf Sleep 95650 67dbc0 95632->95650 95633 6c2b74 Sleep 95633->95650 95634 6c1dda timeGetTime 95805 68e300 23 API calls 95634->95805 95635 68e551 timeGetTime 95635->95650 95638->95625 95638->95626 95638->95627 95638->95629 95638->95630 95638->95631 95638->95632 95638->95633 95638->95634 95644 67d9d5 95638->95644 95652 67ec40 236 API calls 95638->95652 95656 67dd50 95638->95656 95663 67dfd0 95638->95663 95686 681310 95638->95686 95742 68edf6 95638->95742 95747 67bf40 95638->95747 95806 6e3a2a 23 API calls 95638->95806 95807 6e359c 82 API calls __wsopen_s 95638->95807 95639 6c2c0b GetExitCodeProcess 95641 6c2c37 CloseHandle 95639->95641 95642 6c2c21 WaitForSingleObject 95639->95642 95641->95650 95642->95638 95642->95641 95643 6c2a31 95643->95644 95645 7029bf GetForegroundWindow 95645->95650 95646 6c2ca9 Sleep 95646->95638 95650->95635 95650->95638 95650->95639 95650->95643 95650->95644 95650->95645 95650->95646 95808 6f5658 23 API calls 95650->95808 95809 6de97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 95650->95809 95810 6dd4dc 47 API calls 95650->95810 95652->95638 95657 67dd83 95656->95657 95658 67dd6f 95656->95658 95812 6e359c 82 API calls __wsopen_s 95657->95812 95811 67d260 236 API calls 2 library calls 95658->95811 95661 67dd7a 95661->95638 95662 6c2f75 95662->95662 95664 67e010 95663->95664 95681 67e0dc ISource 95664->95681 95815 690242 5 API calls __Init_thread_wait 95664->95815 95667 6c2fca 95669 67a961 22 API calls 95667->95669 95667->95681 95668 67a961 22 API calls 95668->95681 95670 6c2fe4 95669->95670 95816 6900a3 29 API calls __onexit 95670->95816 95674 6c2fee 95817 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95674->95817 95678 67ec40 236 API calls 95678->95681 95679 67a8c7 22 API calls 95679->95681 95680 6804f0 22 API calls 95680->95681 95681->95668 95681->95678 95681->95679 95681->95680 95682 6e359c 82 API calls 95681->95682 95683 67e3e1 95681->95683 95813 67a81b 41 API calls 95681->95813 95814 68a308 236 API calls 95681->95814 95818 690242 5 API calls __Init_thread_wait 95681->95818 95819 6900a3 29 API calls __onexit 95681->95819 95820 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95681->95820 95821 6f47d4 236 API calls 95681->95821 95822 6f68c1 236 API calls 95681->95822 95682->95681 95683->95638 95687 6817b0 95686->95687 95688 681376 95686->95688 95928 690242 5 API calls __Init_thread_wait 95687->95928 95690 681390 95688->95690 95691 6c6331 95688->95691 95694 681940 9 API calls 95690->95694 95933 6f709c 236 API calls 95691->95933 95693 6817ba 95696 6817fb 95693->95696 95698 679cb3 22 API calls 95693->95698 95697 6813a0 95694->95697 95695 6c633d 95695->95638 95702 6c6346 95696->95702 95703 68182c 95696->95703 95699 681940 9 API calls 95697->95699 95707 6817d4 95698->95707 95700 6813b6 95699->95700 95700->95696 95701 6813ec 95700->95701 95701->95702 95712 681408 __fread_nolock 95701->95712 95934 6e359c 82 API calls __wsopen_s 95702->95934 95930 67aceb 23 API calls ISource 95703->95930 95706 681839 95931 68d217 236 API calls 95706->95931 95929 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95707->95929 95710 6c636e 95935 6e359c 82 API calls __wsopen_s 95710->95935 95711 681872 95932 68faeb 23 API calls 95711->95932 95712->95706 95712->95710 95718 68fddb 22 API calls 95712->95718 95720 68fe0b 22 API calls 95712->95720 95725 67ec40 236 API calls 95712->95725 95726 68152f 95712->95726 95729 6c63b2 95712->95729 95734 6815c7 ISource 95712->95734 95714 68153c 95717 681940 9 API calls 95714->95717 95715 6c63d1 95937 6f5745 54 API calls _wcslen 95715->95937 95719 681549 95717->95719 95718->95712 95721 681940 9 API calls 95719->95721 95719->95734 95720->95712 95728 681563 95721->95728 95724 68171d 95724->95638 95725->95712 95726->95714 95726->95715 95727 68167b ISource 95727->95724 95927 68ce17 22 API calls ISource 95727->95927 95733 67a8c7 22 API calls 95728->95733 95728->95734 95936 6e359c 82 API calls __wsopen_s 95729->95936 95730 681940 9 API calls 95730->95734 95733->95734 95734->95711 95734->95727 95734->95730 95740 674f39 68 API calls 95734->95740 95823 6f958b 95734->95823 95826 6f959f 95734->95826 95829 6dd4ce 95734->95829 95832 6ef0ec 95734->95832 95841 6f9abb 95734->95841 95847 6e6ef1 95734->95847 95938 6e359c 82 API calls __wsopen_s 95734->95938 95740->95734 95743 68ee09 95742->95743 95746 68ee12 95742->95746 95743->95638 95744 68ee36 IsDialogMessageW 95744->95743 95744->95746 95745 6cefaf GetClassLongW 95745->95744 95745->95746 95746->95743 95746->95744 95746->95745 96367 67adf0 95747->96367 95749 67bf9d 95750 6c04b6 95749->95750 95751 67bfa9 95749->95751 96386 6e359c 82 API calls __wsopen_s 95750->96386 95753 6c04c6 95751->95753 95754 67c01e 95751->95754 96387 6e359c 82 API calls __wsopen_s 95753->96387 96372 67ac91 95754->96372 95757 6d7120 22 API calls 95773 67c039 ISource __fread_nolock 95757->95773 95758 67c7da 95763 68fe0b 22 API calls 95758->95763 95762 68fddb 22 API calls 95762->95773 95768 67c808 __fread_nolock 95763->95768 95765 6c04f5 95769 6c055a 95765->95769 96388 68d217 236 API calls 95765->96388 95772 68fe0b 22 API calls 95768->95772 95791 67c603 95769->95791 96389 6e359c 82 API calls __wsopen_s 95769->96389 95770 67af8a 22 API calls 95770->95773 95771 6c091a 96399 6e3209 23 API calls 95771->96399 95803 67c350 ISource __fread_nolock 95772->95803 95773->95757 95773->95758 95773->95762 95773->95765 95773->95768 95773->95769 95773->95770 95773->95771 95776 67ec40 236 API calls 95773->95776 95777 6c08a5 95773->95777 95781 6c0591 95773->95781 95784 6c08f6 95773->95784 95788 67c237 95773->95788 95773->95791 95792 68fe0b 22 API calls 95773->95792 95798 6c09bf 95773->95798 95801 67bbe0 40 API calls 95773->95801 96376 67ad81 95773->96376 96391 6d7099 22 API calls __fread_nolock 95773->96391 96392 6f5745 54 API calls _wcslen 95773->96392 96393 68aa42 22 API calls ISource 95773->96393 96394 6df05c 40 API calls 95773->96394 96395 67a993 41 API calls 95773->96395 96396 67aceb 23 API calls ISource 95773->96396 95776->95773 95778 67ec40 236 API calls 95777->95778 95780 6c08cf 95778->95780 95780->95791 96397 67a81b 41 API calls 95780->96397 96390 6e359c 82 API calls __wsopen_s 95781->96390 96398 6e359c 82 API calls __wsopen_s 95784->96398 95789 67c253 95788->95789 95790 67a8c7 22 API calls 95788->95790 95793 6c0976 95789->95793 95796 67c297 ISource 95789->95796 95790->95789 95791->95638 95792->95773 96400 67aceb 23 API calls ISource 95793->96400 95796->95798 96383 67aceb 23 API calls ISource 95796->96383 95798->95791 96401 6e359c 82 API calls __wsopen_s 95798->96401 95799 67c335 95799->95798 95800 67c342 95799->95800 96384 67a704 22 API calls ISource 95800->96384 95801->95773 95804 67c3ac 95803->95804 96385 68ce17 22 API calls ISource 95803->96385 95804->95638 95805->95638 95806->95638 95807->95638 95808->95650 95809->95650 95810->95650 95811->95661 95812->95662 95813->95681 95814->95681 95815->95667 95816->95674 95817->95681 95818->95681 95819->95681 95820->95681 95821->95681 95822->95681 95939 6f7f59 95823->95939 95825 6f959b 95825->95734 95827 6f7f59 120 API calls 95826->95827 95828 6f95af 95827->95828 95828->95734 96109 6ddbbe lstrlenW 95829->96109 95833 677510 53 API calls 95832->95833 95834 6ef126 95833->95834 96114 679e90 95834->96114 95836 6ef136 95837 67ec40 236 API calls 95836->95837 95838 6ef15b 95836->95838 95837->95838 95840 6ef15f 95838->95840 96142 679c6e 22 API calls 95838->96142 95840->95734 95842 677510 53 API calls 95841->95842 95843 6f9ad1 LoadLibraryW 95842->95843 95844 6f9af4 95843->95844 95845 6f9ae5 95843->95845 95844->95845 95846 6d417d 22 API calls 95844->95846 95845->95734 95846->95845 95848 67a961 22 API calls 95847->95848 95849 6e6f1d 95848->95849 95850 67a961 22 API calls 95849->95850 95851 6e6f26 95850->95851 95852 6e6f3a 95851->95852 96325 67b567 39 API calls 95851->96325 95854 677510 53 API calls 95852->95854 95857 6e6f57 _wcslen 95854->95857 95855 6e70bf 95859 674ecb 94 API calls 95855->95859 95856 6e6fbc 95858 677510 53 API calls 95856->95858 95857->95855 95857->95856 95926 6e70e9 95857->95926 95860 6e6fc8 95858->95860 95861 6e70d0 95859->95861 95864 67a8c7 22 API calls 95860->95864 95868 6e6fdb 95860->95868 95862 6e70e5 95861->95862 95865 674ecb 94 API calls 95861->95865 95863 67a961 22 API calls 95862->95863 95862->95926 95866 6e711a 95863->95866 95864->95868 95865->95862 95867 67a961 22 API calls 95866->95867 95871 6e7126 95867->95871 95869 6e7027 95868->95869 95872 6e7005 95868->95872 95876 67a8c7 22 API calls 95868->95876 95870 677510 53 API calls 95869->95870 95874 6e7034 95870->95874 95875 67a961 22 API calls 95871->95875 96326 6733c6 95872->96326 95878 6e703d 95874->95878 95879 6e7047 95874->95879 95880 6e712f 95875->95880 95876->95872 95877 6e700f 95881 677510 53 API calls 95877->95881 95882 67a8c7 22 API calls 95878->95882 96335 6de199 GetFileAttributesW 95879->96335 95884 67a961 22 API calls 95880->95884 95885 6e701b 95881->95885 95882->95879 95887 6e7138 95884->95887 95888 676350 22 API calls 95885->95888 95886 6e7050 95889 6e7063 95886->95889 95893 674c6d 22 API calls 95886->95893 95890 677510 53 API calls 95887->95890 95888->95869 95892 677510 53 API calls 95889->95892 95899 6e7069 95889->95899 95891 6e7145 95890->95891 96162 67525f 95891->96162 95895 6e70a0 95892->95895 95893->95889 96336 6dd076 57 API calls 95895->96336 95896 6e7166 96204 674c6d 95896->96204 95899->95926 95901 6e71a9 95903 67a8c7 22 API calls 95901->95903 95902 674c6d 22 API calls 95904 6e7186 95902->95904 95905 6e71ba 95903->95905 95904->95901 95908 676b57 22 API calls 95904->95908 96207 676350 95905->96207 95910 6e719b 95908->95910 95909 676350 22 API calls 95911 6e71d6 95909->95911 95912 676b57 22 API calls 95910->95912 95913 676350 22 API calls 95911->95913 95912->95901 95914 6e71e4 95913->95914 95915 677510 53 API calls 95914->95915 95916 6e71f0 95915->95916 96216 6dd7bc 95916->96216 95918 6e7201 95919 6dd4ce 4 API calls 95918->95919 95920 6e720b 95919->95920 95921 677510 53 API calls 95920->95921 95924 6e7239 95920->95924 95922 6e7229 95921->95922 96270 6e2947 95922->96270 95925 674f39 68 API calls 95924->95925 95925->95926 95926->95734 95927->95727 95928->95693 95929->95696 95930->95706 95931->95711 95932->95711 95933->95695 95934->95734 95935->95734 95936->95734 95937->95728 95938->95734 95977 677510 95939->95977 95943 6f844f 96063 6f8ee4 60 API calls 95943->96063 95946 6f7fd5 ISource 95946->95825 95947 6f845e 95949 6f846a 95947->95949 95950 6f828f 95947->95950 95948 6f8049 95948->95946 95951 677510 53 API calls 95948->95951 95965 6f8281 95948->95965 96054 6d417d 95948->96054 96060 6f851d 42 API calls _strftime 95948->96060 95949->95946 96013 6f7e86 95950->96013 95951->95948 95956 6f82c8 96028 68fc70 95956->96028 95959 6f82e8 96061 6e359c 82 API calls __wsopen_s 95959->96061 95960 6f8302 96032 6763eb 95960->96032 95964 6f82f3 GetCurrentProcess TerminateProcess 95964->95960 95965->95943 95965->95950 95968 6804f0 22 API calls 95970 6f8341 95968->95970 95969 6f84c5 95969->95946 95971 6f84d9 FreeLibrary 95969->95971 95972 6f8b7b 75 API calls 95970->95972 95971->95946 95976 6f8352 95972->95976 95973 6804f0 22 API calls 95973->95976 95976->95969 95976->95973 96043 6f8b7b 95976->96043 96062 67aceb 23 API calls ISource 95976->96062 95978 677525 95977->95978 95979 677522 95977->95979 95980 67752d 95978->95980 95981 67755b 95978->95981 95979->95946 96000 6f8cd3 95979->96000 96064 6951c6 26 API calls 95980->96064 95982 6b50f6 95981->95982 95985 67756d 95981->95985 95992 6b500f 95981->95992 96067 695183 26 API calls 95982->96067 96065 68fb21 51 API calls 95985->96065 95986 67753d 95989 68fddb 22 API calls 95986->95989 95987 6b510e 95987->95987 95991 677547 95989->95991 95993 679cb3 22 API calls 95991->95993 95994 68fe0b 22 API calls 95992->95994 95999 6b5088 95992->95999 95993->95979 95995 6b5058 95994->95995 95996 68fddb 22 API calls 95995->95996 95997 6b507f 95996->95997 95998 679cb3 22 API calls 95997->95998 95998->95999 96066 68fb21 51 API calls 95999->96066 96001 67aec9 22 API calls 96000->96001 96002 6f8cee CharLowerBuffW 96001->96002 96068 6d8e54 96002->96068 96006 67a961 22 API calls 96007 6f8d2a 96006->96007 96075 676d25 96007->96075 96009 6f8d3e 96011 6793b2 22 API calls 96009->96011 96010 6f8e5e _wcslen 96010->95948 96012 6f8d48 _wcslen 96011->96012 96012->96010 96088 6f851d 42 API calls _strftime 96012->96088 96014 6f7eec 96013->96014 96015 6f7ea1 96013->96015 96019 6f9096 96014->96019 96016 68fe0b 22 API calls 96015->96016 96017 6f7ec3 96016->96017 96017->96014 96018 68fddb 22 API calls 96017->96018 96018->96017 96020 6f92ab ISource 96019->96020 96027 6f90ba _strcat _wcslen 96019->96027 96020->95956 96021 67b567 39 API calls 96021->96027 96022 67b38f 39 API calls 96022->96027 96023 67b6b5 39 API calls 96023->96027 96024 677510 53 API calls 96024->96027 96025 69ea0c 21 API calls ___std_exception_copy 96025->96027 96027->96020 96027->96021 96027->96022 96027->96023 96027->96024 96027->96025 96092 6defae 24 API calls _wcslen 96027->96092 96029 68fc85 96028->96029 96030 68fd1d VirtualAlloc 96029->96030 96031 68fceb 96029->96031 96030->96031 96031->95959 96031->95960 96033 6763f3 96032->96033 96034 68fddb 22 API calls 96033->96034 96035 676401 96034->96035 96093 676a26 96035->96093 96038 676a50 96096 67b010 96038->96096 96040 676a60 96041 68fe0b 22 API calls 96040->96041 96042 676afc 96040->96042 96041->96042 96042->95968 96042->95976 96044 6f8b93 96043->96044 96045 6f8baf 96043->96045 96044->96045 96046 6f8bbb 96044->96046 96047 6f8b9a 96044->96047 96048 6f8c64 96044->96048 96045->95976 96107 679c6e 22 API calls 96046->96107 96105 6debd1 24 API calls _strlen 96047->96105 96108 6e0cdf 73 API calls ISource 96048->96108 96052 6f8ba4 96106 679c6e 22 API calls 96052->96106 96056 6d418f 96054->96056 96059 6d41b0 __fread_nolock 96054->96059 96055 68fddb 22 API calls 96057 6d41e2 96055->96057 96058 68fe0b 22 API calls 96056->96058 96057->95948 96058->96059 96059->96055 96060->95948 96061->95964 96062->95976 96063->95947 96064->95986 96065->95986 96066->95982 96067->95987 96070 6d8e74 _wcslen 96068->96070 96069 6d8f63 96069->96006 96069->96012 96070->96069 96071 6d8f68 96070->96071 96072 6d8ea9 96070->96072 96071->96069 96090 68ce60 41 API calls 96071->96090 96072->96069 96089 68ce60 41 API calls 96072->96089 96076 676d34 96075->96076 96077 676d91 96075->96077 96076->96077 96078 676d3f 96076->96078 96079 6793b2 22 API calls 96077->96079 96080 6b4c9d 96078->96080 96081 676d5a 96078->96081 96085 676d62 __fread_nolock 96079->96085 96082 68fddb 22 API calls 96080->96082 96091 676f34 22 API calls 96081->96091 96084 6b4ca7 96082->96084 96086 68fe0b 22 API calls 96084->96086 96085->96009 96087 6b4cda 96086->96087 96088->96010 96089->96072 96090->96071 96091->96085 96092->96027 96094 68fddb 22 API calls 96093->96094 96095 676409 96094->96095 96095->96038 96097 67b01b 96096->96097 96098 6bfb4d 96097->96098 96103 67b023 ISource 96097->96103 96099 68fddb 22 API calls 96098->96099 96100 6bfb59 96099->96100 96101 67b02a 96101->96040 96103->96101 96104 67b090 22 API calls ISource 96103->96104 96104->96103 96105->96052 96106->96045 96107->96045 96108->96045 96110 6ddbdc GetFileAttributesW 96109->96110 96111 6dd4d5 96109->96111 96110->96111 96112 6ddbe8 FindFirstFileW 96110->96112 96111->95734 96112->96111 96113 6ddbf9 FindClose 96112->96113 96113->96111 96143 676270 96114->96143 96116 679fd2 96149 67a4a1 22 API calls __fread_nolock 96116->96149 96118 679fec 96118->95836 96121 679eb5 96121->96116 96122 67a12c __fread_nolock 96121->96122 96123 6bf7c4 96121->96123 96125 67a4a1 22 API calls 96121->96125 96126 6bf699 96121->96126 96130 67a6c3 22 API calls 96121->96130 96134 67a405 96121->96134 96139 67aec9 22 API calls 96121->96139 96148 674573 41 API calls _wcslen 96121->96148 96150 67a587 96121->96150 96156 6748c8 23 API calls 96121->96156 96157 6749bd 22 API calls __fread_nolock 96121->96157 96158 67a673 22 API calls 96121->96158 96122->96123 96122->96134 96159 6d96e2 84 API calls __wsopen_s 96123->96159 96125->96121 96131 68fddb 22 API calls 96126->96131 96128 6bf7d2 96160 67a4a1 22 API calls __fread_nolock 96128->96160 96130->96121 96133 6bf754 96131->96133 96136 68fe0b 22 API calls 96133->96136 96134->96118 96161 6d96e2 84 API calls __wsopen_s 96134->96161 96135 6bf7e8 96135->96118 96136->96122 96140 67a0db CharUpperBuffW 96139->96140 96155 67a673 22 API calls 96140->96155 96142->95840 96144 68fe0b 22 API calls 96143->96144 96145 676295 96144->96145 96146 68fddb 22 API calls 96145->96146 96147 6762a3 96146->96147 96147->96121 96148->96121 96149->96118 96152 67a59d 96150->96152 96154 67a598 __fread_nolock 96150->96154 96151 6bf80f 96152->96151 96153 68fe0b 22 API calls 96152->96153 96153->96154 96154->96121 96155->96121 96156->96121 96157->96121 96158->96121 96159->96128 96160->96135 96161->96118 96163 67a961 22 API calls 96162->96163 96164 675275 96163->96164 96165 67a961 22 API calls 96164->96165 96166 67527d 96165->96166 96167 67a961 22 API calls 96166->96167 96168 675285 96167->96168 96169 67a961 22 API calls 96168->96169 96170 67528d 96169->96170 96171 6752c1 96170->96171 96172 6b3df5 96170->96172 96173 676d25 22 API calls 96171->96173 96174 67a8c7 22 API calls 96172->96174 96175 6752cf 96173->96175 96176 6b3dfe 96174->96176 96177 6793b2 22 API calls 96175->96177 96178 67a6c3 22 API calls 96176->96178 96179 6752d9 96177->96179 96180 675304 96178->96180 96179->96180 96181 676d25 22 API calls 96179->96181 96182 675349 96180->96182 96183 675325 96180->96183 96192 6b3e20 96180->96192 96185 6752fa 96181->96185 96184 676d25 22 API calls 96182->96184 96183->96182 96188 674c6d 22 API calls 96183->96188 96186 67535a 96184->96186 96187 6793b2 22 API calls 96185->96187 96189 675370 96186->96189 96195 67a8c7 22 API calls 96186->96195 96187->96180 96190 675332 96188->96190 96193 675384 96189->96193 96197 67a8c7 22 API calls 96189->96197 96190->96182 96196 676d25 22 API calls 96190->96196 96191 676b57 22 API calls 96199 6b3ee0 96191->96199 96192->96191 96194 67538f 96193->96194 96198 67a8c7 22 API calls 96193->96198 96200 67a8c7 22 API calls 96194->96200 96202 67539a 96194->96202 96195->96189 96196->96182 96197->96193 96198->96194 96199->96182 96201 674c6d 22 API calls 96199->96201 96337 6749bd 22 API calls __fread_nolock 96199->96337 96200->96202 96201->96199 96202->95896 96205 67aec9 22 API calls 96204->96205 96206 674c78 96205->96206 96206->95901 96206->95902 96208 676362 96207->96208 96209 6b4a51 96207->96209 96338 676373 96208->96338 96348 674a88 22 API calls __fread_nolock 96209->96348 96212 67636e 96212->95909 96213 6b4a5b 96214 6b4a67 96213->96214 96215 67a8c7 22 API calls 96213->96215 96215->96214 96217 6dd7d8 96216->96217 96218 6dd7f3 96217->96218 96219 6dd7dd 96217->96219 96220 67a961 22 API calls 96218->96220 96221 67a8c7 22 API calls 96219->96221 96269 6dd7ee 96219->96269 96222 6dd7fb 96220->96222 96221->96269 96223 67a961 22 API calls 96222->96223 96224 6dd803 96223->96224 96225 67a961 22 API calls 96224->96225 96226 6dd80e 96225->96226 96227 67a961 22 API calls 96226->96227 96228 6dd816 96227->96228 96229 67a961 22 API calls 96228->96229 96230 6dd81e 96229->96230 96231 67a961 22 API calls 96230->96231 96232 6dd826 96231->96232 96233 67a961 22 API calls 96232->96233 96234 6dd82e 96233->96234 96235 67a961 22 API calls 96234->96235 96236 6dd836 96235->96236 96237 67525f 22 API calls 96236->96237 96238 6dd84d 96237->96238 96239 67525f 22 API calls 96238->96239 96240 6dd866 96239->96240 96241 674c6d 22 API calls 96240->96241 96242 6dd872 96241->96242 96243 6dd885 96242->96243 96244 6793b2 22 API calls 96242->96244 96245 674c6d 22 API calls 96243->96245 96244->96243 96246 6dd88e 96245->96246 96247 6dd89e 96246->96247 96248 6793b2 22 API calls 96246->96248 96249 6dd8b0 96247->96249 96250 67a8c7 22 API calls 96247->96250 96248->96247 96251 676350 22 API calls 96249->96251 96250->96249 96252 6dd8bb 96251->96252 96349 6dd978 22 API calls 96252->96349 96254 6dd8ca 96350 6dd978 22 API calls 96254->96350 96256 6dd8dd 96257 674c6d 22 API calls 96256->96257 96258 6dd8e7 96257->96258 96259 6dd8ec 96258->96259 96260 6dd8fe 96258->96260 96262 6733c6 22 API calls 96259->96262 96261 674c6d 22 API calls 96260->96261 96263 6dd907 96261->96263 96264 6dd8f9 96262->96264 96265 6dd925 96263->96265 96266 6733c6 22 API calls 96263->96266 96267 676350 22 API calls 96264->96267 96268 676350 22 API calls 96265->96268 96266->96264 96267->96265 96268->96269 96269->95918 96271 6e2954 __wsopen_s 96270->96271 96272 68fe0b 22 API calls 96271->96272 96273 6e2971 96272->96273 96274 675722 22 API calls 96273->96274 96275 6e297b 96274->96275 96276 6e274e 27 API calls 96275->96276 96277 6e2986 96276->96277 96278 67511f 64 API calls 96277->96278 96279 6e299b 96278->96279 96280 6e29bf 96279->96280 96281 6e2a6c 96279->96281 96282 6e2e66 75 API calls 96280->96282 96283 6e2e66 75 API calls 96281->96283 96284 6e29c4 96282->96284 96298 6e2a38 96283->96298 96291 6e2a75 ISource 96284->96291 96355 69d583 26 API calls 96284->96355 96286 6750f5 40 API calls 96287 6e2a91 96286->96287 96288 6750f5 40 API calls 96287->96288 96290 6e2aa1 96288->96290 96289 6e29ed 96356 69d583 26 API calls 96289->96356 96292 6750f5 40 API calls 96290->96292 96291->95924 96294 6e2abc 96292->96294 96295 6750f5 40 API calls 96294->96295 96296 6e2acc 96295->96296 96297 6750f5 40 API calls 96296->96297 96299 6e2ae7 96297->96299 96298->96286 96298->96291 96300 6750f5 40 API calls 96299->96300 96301 6e2af7 96300->96301 96302 6750f5 40 API calls 96301->96302 96303 6e2b07 96302->96303 96304 6750f5 40 API calls 96303->96304 96305 6e2b17 96304->96305 96351 6e3017 GetTempPathW GetTempFileNameW 96305->96351 96307 6e2b22 96308 69e5eb 29 API calls 96307->96308 96318 6e2b33 96308->96318 96309 69e678 67 API calls 96310 6e2bf8 96309->96310 96312 6e2bfe DeleteFileW 96310->96312 96313 6e2c12 96310->96313 96311 6750f5 40 API calls 96311->96318 96312->96291 96314 6e2c91 CopyFileW 96313->96314 96319 6e2c18 96313->96319 96315 6e2cb9 DeleteFileW 96314->96315 96316 6e2ca7 DeleteFileW 96314->96316 96352 6e2fd8 CreateFileW 96315->96352 96316->96291 96318->96291 96318->96311 96320 69dbb3 65 API calls 96318->96320 96321 6e2bed 96318->96321 96322 6e22ce 79 API calls 96319->96322 96320->96318 96321->96309 96323 6e2c7c 96322->96323 96323->96315 96324 6e2c80 DeleteFileW 96323->96324 96324->96291 96325->95852 96327 6b30bb 96326->96327 96328 6733dd 96326->96328 96330 68fddb 22 API calls 96327->96330 96357 6733ee 96328->96357 96332 6b30c5 _wcslen 96330->96332 96331 6733e8 96331->95877 96333 68fe0b 22 API calls 96332->96333 96334 6b30fe __fread_nolock 96333->96334 96335->95886 96336->95899 96337->96199 96339 676382 96338->96339 96345 6763b6 __fread_nolock 96338->96345 96340 6b4a82 96339->96340 96341 6763a9 96339->96341 96339->96345 96342 68fddb 22 API calls 96340->96342 96343 67a587 22 API calls 96341->96343 96344 6b4a91 96342->96344 96343->96345 96346 68fe0b 22 API calls 96344->96346 96345->96212 96347 6b4ac5 __fread_nolock 96346->96347 96348->96213 96349->96254 96350->96256 96351->96307 96353 6e2fff SetFileTime CloseHandle 96352->96353 96354 6e3013 96352->96354 96353->96354 96354->96291 96355->96289 96356->96298 96358 6733fe _wcslen 96357->96358 96359 6b311d 96358->96359 96360 673411 96358->96360 96362 68fddb 22 API calls 96359->96362 96361 67a587 22 API calls 96360->96361 96363 67341e __fread_nolock 96361->96363 96364 6b3127 96362->96364 96363->96331 96365 68fe0b 22 API calls 96364->96365 96366 6b3157 __fread_nolock 96365->96366 96368 67ae01 96367->96368 96371 67ae1c ISource 96367->96371 96369 67aec9 22 API calls 96368->96369 96370 67ae09 CharUpperBuffW 96369->96370 96370->96371 96371->95749 96373 67acae 96372->96373 96374 67acd1 96373->96374 96402 6e359c 82 API calls __wsopen_s 96373->96402 96374->95773 96377 6bfadb 96376->96377 96378 67ad92 96376->96378 96379 68fddb 22 API calls 96378->96379 96380 67ad99 96379->96380 96403 67adcd 96380->96403 96383->95799 96384->95803 96385->95803 96386->95753 96387->95791 96388->95769 96389->95791 96390->95791 96391->95773 96392->95773 96393->95773 96394->95773 96395->95773 96396->95773 96397->95784 96398->95791 96399->95788 96400->95798 96401->95791 96402->96374 96406 67addd 96403->96406 96404 67adb6 96404->95773 96405 68fddb 22 API calls 96405->96406 96406->96404 96406->96405 96407 67a961 22 API calls 96406->96407 96408 67a8c7 22 API calls 96406->96408 96409 67adcd 22 API calls 96406->96409 96407->96406 96408->96406 96409->96406 96410 6b2ba5 96411 672b25 96410->96411 96412 6b2baf 96410->96412 96438 672b83 7 API calls 96411->96438 96453 673a5a 96412->96453 96416 6b2bb8 96418 679cb3 22 API calls 96416->96418 96420 6b2bc6 96418->96420 96419 672b2f 96426 672b44 96419->96426 96442 673837 96419->96442 96421 6b2bce 96420->96421 96422 6b2bf5 96420->96422 96424 6733c6 22 API calls 96421->96424 96423 6733c6 22 API calls 96422->96423 96427 6b2bf1 GetForegroundWindow ShellExecuteW 96423->96427 96428 6b2bd9 96424->96428 96429 672b5f 96426->96429 96452 6730f2 Shell_NotifyIconW ___scrt_fastfail 96426->96452 96433 6b2c26 96427->96433 96431 676350 22 API calls 96428->96431 96436 672b66 SetCurrentDirectoryW 96429->96436 96434 6b2be7 96431->96434 96433->96429 96435 6733c6 22 API calls 96434->96435 96435->96427 96437 672b7a 96436->96437 96460 672cd4 7 API calls 96438->96460 96440 672b2a 96441 672c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 96440->96441 96441->96419 96443 673862 ___scrt_fastfail 96442->96443 96461 674212 96443->96461 96446 6738e8 96448 673906 Shell_NotifyIconW 96446->96448 96449 6b3386 Shell_NotifyIconW 96446->96449 96465 673923 96448->96465 96451 67391c 96451->96426 96452->96429 96454 6b1f50 __wsopen_s 96453->96454 96455 673a67 GetModuleFileNameW 96454->96455 96456 679cb3 22 API calls 96455->96456 96457 673a8d 96456->96457 96458 673aa2 23 API calls 96457->96458 96459 673a97 96458->96459 96459->96416 96460->96440 96462 6738b7 96461->96462 96463 6b35a4 96461->96463 96462->96446 96487 6dc874 42 API calls _strftime 96462->96487 96463->96462 96464 6b35ad DestroyIcon 96463->96464 96464->96462 96466 673a13 96465->96466 96467 67393f 96465->96467 96466->96451 96468 676270 22 API calls 96467->96468 96469 67394d 96468->96469 96470 6b3393 LoadStringW 96469->96470 96471 67395a 96469->96471 96473 6b33ad 96470->96473 96472 676b57 22 API calls 96471->96472 96474 67396f 96472->96474 96478 67a8c7 22 API calls 96473->96478 96481 673994 ___scrt_fastfail 96473->96481 96475 6b33c9 96474->96475 96476 67397c 96474->96476 96477 676350 22 API calls 96475->96477 96476->96473 96479 673986 96476->96479 96482 6b33d7 96477->96482 96478->96481 96480 676350 22 API calls 96479->96480 96480->96481 96484 6739f9 Shell_NotifyIconW 96481->96484 96482->96481 96483 6733c6 22 API calls 96482->96483 96485 6b33f9 96483->96485 96484->96466 96486 6733c6 22 API calls 96485->96486 96486->96481 96487->96446 96488 672e37 96489 67a961 22 API calls 96488->96489 96490 672e4d 96489->96490 96567 674ae3 96490->96567 96492 672e6b 96493 673a5a 24 API calls 96492->96493 96494 672e7f 96493->96494 96495 679cb3 22 API calls 96494->96495 96496 672e8c 96495->96496 96497 674ecb 94 API calls 96496->96497 96498 672ea5 96497->96498 96499 672ead 96498->96499 96500 6b2cb0 96498->96500 96503 67a8c7 22 API calls 96499->96503 96501 6e2cf9 80 API calls 96500->96501 96502 6b2cc3 96501->96502 96504 6b2ccf 96502->96504 96506 674f39 68 API calls 96502->96506 96505 672ec3 96503->96505 96508 674f39 68 API calls 96504->96508 96581 676f88 22 API calls 96505->96581 96506->96504 96510 6b2ce5 96508->96510 96509 672ecf 96511 679cb3 22 API calls 96509->96511 96595 673084 22 API calls 96510->96595 96512 672edc 96511->96512 96582 67a81b 41 API calls 96512->96582 96515 672eec 96517 679cb3 22 API calls 96515->96517 96516 6b2d02 96596 673084 22 API calls 96516->96596 96519 672f12 96517->96519 96583 67a81b 41 API calls 96519->96583 96521 6b2d1e 96522 673a5a 24 API calls 96521->96522 96524 6b2d44 96522->96524 96523 672f21 96527 67a961 22 API calls 96523->96527 96597 673084 22 API calls 96524->96597 96526 6b2d50 96528 67a8c7 22 API calls 96526->96528 96529 672f3f 96527->96529 96530 6b2d5e 96528->96530 96584 673084 22 API calls 96529->96584 96598 673084 22 API calls 96530->96598 96533 672f4b 96585 694a28 40 API calls 3 library calls 96533->96585 96534 6b2d6d 96538 67a8c7 22 API calls 96534->96538 96536 672f59 96536->96510 96537 672f63 96536->96537 96586 694a28 40 API calls 3 library calls 96537->96586 96540 6b2d83 96538->96540 96599 673084 22 API calls 96540->96599 96541 672f6e 96541->96516 96543 672f78 96541->96543 96587 694a28 40 API calls 3 library calls 96543->96587 96545 6b2d90 96546 672f83 96546->96521 96547 672f8d 96546->96547 96588 694a28 40 API calls 3 library calls 96547->96588 96549 672f98 96550 672fdc 96549->96550 96589 673084 22 API calls 96549->96589 96550->96534 96551 672fe8 96550->96551 96551->96545 96553 6763eb 22 API calls 96551->96553 96555 672ff8 96553->96555 96554 672fbf 96556 67a8c7 22 API calls 96554->96556 96557 676a50 22 API calls 96555->96557 96558 672fcd 96556->96558 96559 673006 96557->96559 96590 673084 22 API calls 96558->96590 96591 6770b0 23 API calls 96559->96591 96564 673021 96565 673065 96564->96565 96592 676f88 22 API calls 96564->96592 96593 6770b0 23 API calls 96564->96593 96594 673084 22 API calls 96564->96594 96568 674af0 __wsopen_s 96567->96568 96569 676b57 22 API calls 96568->96569 96570 674b22 96568->96570 96569->96570 96571 674c6d 22 API calls 96570->96571 96580 674b58 96570->96580 96571->96570 96572 679cb3 22 API calls 96575 674c52 96572->96575 96573 674c5e 96573->96492 96574 679cb3 22 API calls 96574->96580 96576 67515f 22 API calls 96575->96576 96576->96573 96577 67515f 22 API calls 96577->96580 96578 674c29 96578->96572 96578->96573 96579 674c6d 22 API calls 96579->96580 96580->96574 96580->96577 96580->96578 96580->96579 96581->96509 96582->96515 96583->96523 96584->96533 96585->96536 96586->96541 96587->96546 96588->96549 96589->96554 96590->96550 96591->96564 96592->96564 96593->96564 96594->96564 96595->96516 96596->96521 96597->96526 96598->96534 96599->96545 96600 6a90fa 96601 6a911f 96600->96601 96602 6a9107 96600->96602 96608 6a917a 96601->96608 96614 6a9117 96601->96614 96652 6afdc4 21 API calls 2 library calls 96601->96652 96650 69f2d9 20 API calls _abort 96602->96650 96604 6a910c 96651 6a27ec 26 API calls pre_c_initialization 96604->96651 96607 69d955 __fread_nolock 26 API calls 96609 6a9192 96607->96609 96608->96607 96620 6a8c32 96609->96620 96611 6a9199 96612 69d955 __fread_nolock 26 API calls 96611->96612 96611->96614 96613 6a91c5 96612->96613 96613->96614 96615 69d955 __fread_nolock 26 API calls 96613->96615 96616 6a91d3 96615->96616 96616->96614 96617 69d955 __fread_nolock 26 API calls 96616->96617 96618 6a91e3 96617->96618 96619 69d955 __fread_nolock 26 API calls 96618->96619 96619->96614 96621 6a8c3e ___scrt_is_nonwritable_in_current_image 96620->96621 96622 6a8c5e 96621->96622 96623 6a8c46 96621->96623 96625 6a8d24 96622->96625 96628 6a8c97 96622->96628 96654 69f2c6 20 API calls _abort 96623->96654 96661 69f2c6 20 API calls _abort 96625->96661 96627 6a8c4b 96655 69f2d9 20 API calls _abort 96627->96655 96631 6a8cbb 96628->96631 96632 6a8ca6 96628->96632 96629 6a8d29 96662 69f2d9 20 API calls _abort 96629->96662 96653 6a5147 EnterCriticalSection 96631->96653 96656 69f2c6 20 API calls _abort 96632->96656 96636 6a8cb3 96663 6a27ec 26 API calls pre_c_initialization 96636->96663 96637 6a8cab 96657 69f2d9 20 API calls _abort 96637->96657 96638 6a8cc1 96640 6a8cdd 96638->96640 96641 6a8cf2 96638->96641 96658 69f2d9 20 API calls _abort 96640->96658 96645 6a8d45 __fread_nolock 38 API calls 96641->96645 96643 6a8c53 __fread_nolock 96643->96611 96646 6a8ced 96645->96646 96660 6a8d1c LeaveCriticalSection __wsopen_s 96646->96660 96647 6a8ce2 96659 69f2c6 20 API calls _abort 96647->96659 96650->96604 96651->96614 96652->96608 96653->96638 96654->96627 96655->96643 96656->96637 96657->96636 96658->96647 96659->96646 96660->96643 96661->96629 96662->96636 96663->96643 96664 6cd8dd GetTempPathW 96665 6cd8fa 96664->96665 96665->96665 96666 673156 96669 673170 96666->96669 96670 673187 96669->96670 96671 67318c 96670->96671 96672 6731eb 96670->96672 96673 6731e9 96670->96673 96674 673265 PostQuitMessage 96671->96674 96675 673199 96671->96675 96677 6b2dfb 96672->96677 96678 6731f1 96672->96678 96676 6731d0 DefWindowProcW 96673->96676 96682 67316a 96674->96682 96680 6731a4 96675->96680 96681 6b2e7c 96675->96681 96676->96682 96725 6718e2 10 API calls 96677->96725 96683 67321d SetTimer RegisterWindowMessageW 96678->96683 96684 6731f8 96678->96684 96688 6b2e68 96680->96688 96689 6731ae 96680->96689 96729 6dbf30 34 API calls ___scrt_fastfail 96681->96729 96683->96682 96690 673246 CreatePopupMenu 96683->96690 96685 673201 KillTimer 96684->96685 96686 6b2d9c 96684->96686 96721 6730f2 Shell_NotifyIconW ___scrt_fastfail 96685->96721 96698 6b2da1 96686->96698 96699 6b2dd7 MoveWindow 96686->96699 96687 6b2e1c 96726 68e499 42 API calls 96687->96726 96714 6dc161 96688->96714 96695 6b2e4d 96689->96695 96696 6731b9 96689->96696 96690->96682 96695->96676 96728 6d0ad7 22 API calls 96695->96728 96701 6731c4 96696->96701 96702 673253 96696->96702 96697 6b2e8e 96697->96676 96697->96682 96703 6b2da7 96698->96703 96704 6b2dc6 SetFocus 96698->96704 96699->96682 96700 673214 96722 673c50 DeleteObject DestroyWindow 96700->96722 96701->96676 96727 6730f2 Shell_NotifyIconW ___scrt_fastfail 96701->96727 96723 67326f 44 API calls ___scrt_fastfail 96702->96723 96703->96701 96708 6b2db0 96703->96708 96704->96682 96724 6718e2 10 API calls 96708->96724 96709 673263 96709->96682 96712 6b2e41 96713 673837 49 API calls 96712->96713 96713->96673 96715 6dc179 ___scrt_fastfail 96714->96715 96716 6dc276 96714->96716 96717 673923 24 API calls 96715->96717 96716->96682 96719 6dc1a0 96717->96719 96718 6dc25f KillTimer SetTimer 96718->96716 96719->96718 96720 6dc251 Shell_NotifyIconW 96719->96720 96720->96718 96721->96700 96722->96682 96723->96709 96724->96682 96725->96687 96726->96701 96727->96712 96728->96673 96729->96697 96730 6903fb 96731 690407 ___scrt_is_nonwritable_in_current_image 96730->96731 96759 68feb1 96731->96759 96733 69040e 96734 690561 96733->96734 96737 690438 96733->96737 96786 69083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 96734->96786 96736 690568 96787 694e52 28 API calls _abort 96736->96787 96748 690477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 96737->96748 96770 6a247d 96737->96770 96739 69056e 96788 694e04 28 API calls _abort 96739->96788 96743 690576 96744 690457 96747 6904de 96751 6904f3 96747->96751 96750 6904d8 96748->96750 96782 694e1a 38 API calls 2 library calls 96748->96782 96778 690959 96750->96778 96783 690992 GetModuleHandleW 96751->96783 96753 6904fa 96753->96736 96754 6904fe 96753->96754 96755 690507 96754->96755 96784 694df5 28 API calls _abort 96754->96784 96785 690040 13 API calls 2 library calls 96755->96785 96758 69050f 96758->96744 96760 68feba 96759->96760 96789 690698 IsProcessorFeaturePresent 96760->96789 96762 68fec6 96790 692c94 10 API calls 3 library calls 96762->96790 96764 68fecb 96769 68fecf 96764->96769 96791 6a2317 96764->96791 96767 68fee6 96767->96733 96769->96733 96771 6a2494 96770->96771 96772 690a8c CatchGuardHandler 5 API calls 96771->96772 96773 690451 96772->96773 96773->96744 96774 6a2421 96773->96774 96775 6a2450 96774->96775 96776 690a8c CatchGuardHandler 5 API calls 96775->96776 96777 6a2479 96776->96777 96777->96748 96834 692340 96778->96834 96780 69096c GetStartupInfoW 96781 69097f 96780->96781 96781->96747 96782->96750 96783->96753 96784->96755 96785->96758 96786->96736 96787->96739 96788->96743 96789->96762 96790->96764 96795 6ad1f6 96791->96795 96794 692cbd 8 API calls 3 library calls 96794->96769 96796 6ad213 96795->96796 96799 6ad20f 96795->96799 96796->96799 96801 6a4bfb 96796->96801 96797 690a8c CatchGuardHandler 5 API calls 96798 68fed8 96797->96798 96798->96767 96798->96794 96799->96797 96802 6a4c07 ___scrt_is_nonwritable_in_current_image 96801->96802 96813 6a2f5e EnterCriticalSection 96802->96813 96804 6a4c0e 96814 6a50af 96804->96814 96806 6a4c1d 96812 6a4c2c 96806->96812 96827 6a4a8f 29 API calls 96806->96827 96809 6a4c3d __fread_nolock 96809->96796 96810 6a4c27 96828 6a4b45 GetStdHandle GetFileType 96810->96828 96829 6a4c48 LeaveCriticalSection _abort 96812->96829 96813->96804 96815 6a50bb ___scrt_is_nonwritable_in_current_image 96814->96815 96816 6a50c8 96815->96816 96817 6a50df 96815->96817 96831 69f2d9 20 API calls _abort 96816->96831 96830 6a2f5e EnterCriticalSection 96817->96830 96820 6a50cd 96832 6a27ec 26 API calls pre_c_initialization 96820->96832 96822 6a5117 96833 6a513e LeaveCriticalSection _abort 96822->96833 96823 6a50d7 __fread_nolock 96823->96806 96824 6a50eb 96824->96822 96826 6a5000 __wsopen_s 21 API calls 96824->96826 96826->96824 96827->96810 96828->96812 96829->96809 96830->96824 96831->96820 96832->96823 96833->96823 96835 692357 96834->96835 96835->96780 96835->96835 96836 67fe73 96843 68ceb1 96836->96843 96838 67fe89 96852 68cf92 96838->96852 96840 67feb3 96864 6e359c 82 API calls __wsopen_s 96840->96864 96842 6c4ab8 96844 68cebf 96843->96844 96845 68ced2 96843->96845 96865 67aceb 23 API calls ISource 96844->96865 96847 68cf05 96845->96847 96848 68ced7 96845->96848 96866 67aceb 23 API calls ISource 96847->96866 96849 68fddb 22 API calls 96848->96849 96851 68cec9 96849->96851 96851->96838 96853 676270 22 API calls 96852->96853 96854 68cfc9 96853->96854 96855 679cb3 22 API calls 96854->96855 96857 68cffa 96854->96857 96856 6cd166 96855->96856 96858 676350 22 API calls 96856->96858 96857->96840 96859 6cd171 96858->96859 96867 68d2f0 40 API calls 96859->96867 96861 6cd184 96863 6cd188 96861->96863 96868 67aceb 23 API calls ISource 96861->96868 96863->96863 96864->96842 96865->96851 96866->96851 96867->96861 96868->96863 96869 671033 96874 674c91 96869->96874 96873 671042 96875 67a961 22 API calls 96874->96875 96876 674cff 96875->96876 96882 673af0 96876->96882 96879 674d9c 96880 671038 96879->96880 96885 6751f7 22 API calls __fread_nolock 96879->96885 96881 6900a3 29 API calls __onexit 96880->96881 96881->96873 96886 673b1c 96882->96886 96885->96879 96887 673b0f 96886->96887 96888 673b29 96886->96888 96887->96879 96888->96887 96889 673b30 RegOpenKeyExW 96888->96889 96889->96887 96890 673b4a RegQueryValueExW 96889->96890 96891 673b80 RegCloseKey 96890->96891 96892 673b6b 96890->96892 96891->96887 96892->96891 96893 67df10 96896 67b710 96893->96896 96897 67b72b 96896->96897 96898 6c00f8 96897->96898 96899 6c0146 96897->96899 96926 67b750 96897->96926 96902 6c0102 96898->96902 96903 6c010f 96898->96903 96898->96926 96938 6f58a2 236 API calls 2 library calls 96899->96938 96936 6f5d33 236 API calls 96902->96936 96922 67ba20 96903->96922 96937 6f61d0 236 API calls 2 library calls 96903->96937 96909 6c03d9 96909->96909 96911 68d336 40 API calls 96911->96926 96913 6c0322 96941 6f5c0c 82 API calls 96913->96941 96917 67ba4e 96921 67bbe0 40 API calls 96921->96926 96922->96917 96942 6e359c 82 API calls __wsopen_s 96922->96942 96923 67ec40 236 API calls 96923->96926 96924 67a8c7 22 API calls 96924->96926 96926->96911 96926->96913 96926->96917 96926->96921 96926->96922 96926->96923 96926->96924 96927 67a81b 41 API calls 96926->96927 96928 68d2f0 40 API calls 96926->96928 96929 68a01b 236 API calls 96926->96929 96930 690242 5 API calls __Init_thread_wait 96926->96930 96931 68edcd 22 API calls 96926->96931 96932 6900a3 29 API calls __onexit 96926->96932 96933 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96926->96933 96934 68ee53 82 API calls 96926->96934 96935 68e5ca 236 API calls 96926->96935 96939 67aceb 23 API calls ISource 96926->96939 96940 6cf6bf 23 API calls 96926->96940 96927->96926 96928->96926 96929->96926 96930->96926 96931->96926 96932->96926 96933->96926 96934->96926 96935->96926 96936->96903 96937->96922 96938->96926 96939->96926 96940->96926 96941->96922 96942->96909 96943 67f7bf 96944 67fcb6 96943->96944 96945 67f7d3 96943->96945 96980 67aceb 23 API calls ISource 96944->96980 96947 67fcc2 96945->96947 96949 68fddb 22 API calls 96945->96949 96981 67aceb 23 API calls ISource 96947->96981 96950 67f7e5 96949->96950 96950->96947 96951 67f83e 96950->96951 96952 67fd3d 96950->96952 96954 681310 236 API calls 96951->96954 96976 67ed9d ISource 96951->96976 96982 6e1155 22 API calls 96952->96982 96975 67ec76 ISource 96954->96975 96955 68fddb 22 API calls 96955->96975 96957 67fef7 96963 67a8c7 22 API calls 96957->96963 96957->96976 96959 6c4b0b 96984 6e359c 82 API calls __wsopen_s 96959->96984 96960 6c4600 96965 67a8c7 22 API calls 96960->96965 96960->96976 96963->96976 96964 67a8c7 22 API calls 96964->96975 96965->96976 96967 690242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96967->96975 96968 67fbe3 96971 6c4bdc 96968->96971 96968->96976 96977 67f3ae ISource 96968->96977 96969 67a961 22 API calls 96969->96975 96970 6900a3 29 API calls pre_c_initialization 96970->96975 96985 6e359c 82 API calls __wsopen_s 96971->96985 96973 6c4beb 96986 6e359c 82 API calls __wsopen_s 96973->96986 96974 6901f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 96974->96975 96975->96955 96975->96957 96975->96959 96975->96960 96975->96964 96975->96967 96975->96968 96975->96969 96975->96970 96975->96973 96975->96974 96975->96976 96975->96977 96978 6801e0 236 API calls 2 library calls 96975->96978 96979 6806a0 41 API calls ISource 96975->96979 96977->96976 96983 6e359c 82 API calls __wsopen_s 96977->96983 96978->96975 96979->96975 96980->96947 96981->96952 96982->96976 96983->96976 96984->96976 96985->96973 96986->96976 96987 6c3f75 96988 68ceb1 23 API calls 96987->96988 96989 6c3f8b 96988->96989 96990 6c4006 96989->96990 96998 68e300 23 API calls 96989->96998 96992 67bf40 236 API calls 96990->96992 96995 6c4052 96992->96995 96993 6c3fe6 96993->96995 96999 6e1abf 22 API calls 96993->96999 96996 6c4a88 96995->96996 97000 6e359c 82 API calls __wsopen_s 96995->97000 96998->96993 96999->96990 97000->96996 97001 ca23b0 97015 ca0000 97001->97015 97003 ca2436 97018 ca22a0 97003->97018 97021 ca3460 GetPEB 97015->97021 97017 ca068b 97017->97003 97019 ca22a9 Sleep 97018->97019 97020 ca22b7 97019->97020 97022 ca348a 97021->97022 97022->97017 97023 67dddc 97024 67b710 236 API calls 97023->97024 97025 67ddea 97024->97025 97026 67105b 97031 67344d 97026->97031 97028 67106a 97062 6900a3 29 API calls __onexit 97028->97062 97030 671074 97032 67345d __wsopen_s 97031->97032 97033 67a961 22 API calls 97032->97033 97034 673513 97033->97034 97035 673a5a 24 API calls 97034->97035 97036 67351c 97035->97036 97063 673357 97036->97063 97039 6733c6 22 API calls 97040 673535 97039->97040 97041 67515f 22 API calls 97040->97041 97042 673544 97041->97042 97043 67a961 22 API calls 97042->97043 97044 67354d 97043->97044 97045 67a6c3 22 API calls 97044->97045 97046 673556 RegOpenKeyExW 97045->97046 97047 6b3176 RegQueryValueExW 97046->97047 97051 673578 97046->97051 97048 6b320c RegCloseKey 97047->97048 97049 6b3193 97047->97049 97048->97051 97061 6b321e _wcslen 97048->97061 97050 68fe0b 22 API calls 97049->97050 97052 6b31ac 97050->97052 97051->97028 97053 675722 22 API calls 97052->97053 97054 6b31b7 RegQueryValueExW 97053->97054 97056 6b31d4 97054->97056 97058 6b31ee ISource 97054->97058 97055 674c6d 22 API calls 97055->97061 97057 676b57 22 API calls 97056->97057 97057->97058 97058->97048 97059 679cb3 22 API calls 97059->97061 97060 67515f 22 API calls 97060->97061 97061->97051 97061->97055 97061->97059 97061->97060 97062->97030 97064 6b1f50 __wsopen_s 97063->97064 97065 673364 GetFullPathNameW 97064->97065 97066 673386 97065->97066 97067 676b57 22 API calls 97066->97067 97068 6733a4 97067->97068 97068->97039 97069 671098 97074 6742de 97069->97074 97073 6710a7 97075 67a961 22 API calls 97074->97075 97076 6742f5 GetVersionExW 97075->97076 97077 676b57 22 API calls 97076->97077 97078 674342 97077->97078 97079 6793b2 22 API calls 97078->97079 97089 674378 97078->97089 97080 67436c 97079->97080 97082 6737a0 22 API calls 97080->97082 97081 67441b GetCurrentProcess IsWow64Process 97083 674437 97081->97083 97082->97089 97084 67444f LoadLibraryA 97083->97084 97085 6b3824 GetSystemInfo 97083->97085 97086 674460 GetProcAddress 97084->97086 97087 67449c GetSystemInfo 97084->97087 97086->97087 97091 674470 GetNativeSystemInfo 97086->97091 97088 674476 97087->97088 97092 67109d 97088->97092 97093 67447a FreeLibrary 97088->97093 97089->97081 97090 6b37df 97089->97090 97091->97088 97094 6900a3 29 API calls __onexit 97092->97094 97093->97092 97094->97073

                            Executed Functions

                            Function 006742DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 234 6742de-67434d call 67a961 GetVersionExW call 676b57 239 674353 234->239 240 6b3617-6b362a 234->240 242 674355-674357 239->242 241 6b362b-6b362f 240->241 243 6b3632-6b363e 241->243 244 6b3631 241->244 245 67435d-6743bc call 6793b2 call 6737a0 242->245 246 6b3656 242->246 243->241 247 6b3640-6b3642 243->247 244->243 263 6b37df-6b37e6 245->263 264 6743c2-6743c4 245->264 250 6b365d-6b3660 246->250 247->242 249 6b3648-6b364f 247->249 249->240 252 6b3651 249->252 253 67441b-674435 GetCurrentProcess IsWow64Process 250->253 254 6b3666-6b36a8 250->254 252->246 256 674437 253->256 257 674494-67449a 253->257 254->253 258 6b36ae-6b36b1 254->258 260 67443d-674449 256->260 257->260 261 6b36db-6b36e5 258->261 262 6b36b3-6b36bd 258->262 270 67444f-67445e LoadLibraryA 260->270 271 6b3824-6b3828 GetSystemInfo 260->271 266 6b36f8-6b3702 261->266 267 6b36e7-6b36f3 261->267 272 6b36ca-6b36d6 262->272 273 6b36bf-6b36c5 262->273 268 6b37e8 263->268 269 6b3806-6b3809 263->269 264->250 265 6743ca-6743dd 264->265 274 6743e3-6743e5 265->274 275 6b3726-6b372f 265->275 277 6b3715-6b3721 266->277 278 6b3704-6b3710 266->278 267->253 276 6b37ee 268->276 279 6b380b-6b381a 269->279 280 6b37f4-6b37fc 269->280 281 674460-67446e GetProcAddress 270->281 282 67449c-6744a6 GetSystemInfo 270->282 272->253 273->253 284 6b374d-6b3762 274->284 285 6743eb-6743ee 274->285 286 6b373c-6b3748 275->286 287 6b3731-6b3737 275->287 276->280 277->253 278->253 279->276 288 6b381c-6b3822 279->288 280->269 281->282 289 674470-674474 GetNativeSystemInfo 281->289 283 674476-674478 282->283 294 674481-674493 283->294 295 67447a-67447b FreeLibrary 283->295 292 6b376f-6b377b 284->292 293 6b3764-6b376a 284->293 290 6743f4-67440f 285->290 291 6b3791-6b3794 285->291 286->253 287->253 288->280 289->283 296 674415 290->296 297 6b3780-6b378c 290->297 291->253 298 6b379a-6b37c1 291->298 292->253 293->253 295->294 296->253 297->253 299 6b37ce-6b37da 298->299 300 6b37c3-6b37c9 298->300 299->253 300->253
                            APIs
                            • GetVersionExW.KERNEL32(?), ref: 0067430D
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                            • GetCurrentProcess.KERNEL32(?,0070CB64,00000000,?,?), ref: 00674422
                            • IsWow64Process.KERNEL32(00000000,?,?), ref: 00674429
                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00674454
                            • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00674466
                            • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00674474
                            • FreeLibrary.KERNEL32(00000000,?,?), ref: 0067447B
                            • GetSystemInfo.KERNEL32(?,?,?), ref: 006744A0
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                            • String ID: GetNativeSystemInfo$kernel32.dll$|O
                            • API String ID: 3290436268-3101561225
                            • Opcode ID: 7c17c820c89ce531cc86eefb84a8e054b144d3e397acbd4726a11a2028537fbe
                            • Instruction ID: 52e149f21108ddbf099263fbf9a3d0187ab8dd29004b9816eafda8a823108947
                            • Opcode Fuzzy Hash: 7c17c820c89ce531cc86eefb84a8e054b144d3e397acbd4726a11a2028537fbe
                            • Instruction Fuzzy Hash: CFA1D5BA90A2D0CFC712EF697C441E47FE6AB27340B84C5AAD04593B26E72C45C5DB2D
                            Function 006742A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1378 6742a2-6742ba CreateStreamOnHGlobal 1379 6742bc-6742d3 FindResourceExW 1378->1379 1380 6742da-6742dd 1378->1380 1381 6b35ba-6b35c9 LoadResource 1379->1381 1382 6742d9 1379->1382 1381->1382 1383 6b35cf-6b35dd SizeofResource 1381->1383 1382->1380 1383->1382 1384 6b35e3-6b35ee LockResource 1383->1384 1384->1382 1385 6b35f4-6b35fc 1384->1385 1386 6b3600-6b3612 1385->1386 1386->1382
                            APIs
                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,006750AA,?,?,00000000,00000000), ref: 006742B2
                            • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006750AA,?,?,00000000,00000000), ref: 006742C9
                            • LoadResource.KERNEL32(?,00000000,?,?,006750AA,?,?,00000000,00000000,?,?,?,?,?,?,00674F20), ref: 006B35BE
                            • SizeofResource.KERNEL32(?,00000000,?,?,006750AA,?,?,00000000,00000000,?,?,?,?,?,?,00674F20), ref: 006B35D3
                            • LockResource.KERNEL32(006750AA,?,?,006750AA,?,?,00000000,00000000,?,?,?,?,?,?,00674F20,?), ref: 006B35E6
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                            • String ID: SCRIPT
                            • API String ID: 3051347437-3967369404
                            • Opcode ID: 09c22560da4813123edb778686bc1f1086ec5c3f0307fd89e21123ff066955f1
                            • Instruction ID: 9e4b9424ddac63c7398e9c0908acb99ea4d8024a172b5669c6cffd9734dec91b
                            • Opcode Fuzzy Hash: 09c22560da4813123edb778686bc1f1086ec5c3f0307fd89e21123ff066955f1
                            • Instruction Fuzzy Hash: B4117C71200700FFD7228B65DC49F677BBAEFC5B51F208269F41696690DF71D9108A20
                            Function 006B2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                            Download Yara Rule

                            Control-flow Graph

                            APIs
                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00672B6B
                              • Part of subcall function 00673A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00741418,?,00672E7F,?,?,?,00000000), ref: 00673A78
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • GetForegroundWindow.USER32(runas,?,?,?,?,?,00732224), ref: 006B2C10
                            • ShellExecuteW.SHELL32(00000000,?,?,00732224), ref: 006B2C17
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                            • String ID: runas
                            • API String ID: 448630720-4000483414
                            • Opcode ID: 57d5434c16e98a83c95857520a13c1620d59ad05a455982ad2b2b53d25ad72c2
                            • Instruction ID: caf974f5749ec12c22537966149ce0d18662c3108d1e8569ddd835dcc32fab19
                            • Opcode Fuzzy Hash: 57d5434c16e98a83c95857520a13c1620d59ad05a455982ad2b2b53d25ad72c2
                            • Instruction Fuzzy Hash: CF113631208382AAC754FF20D862DBE7BE6AF91710F44C52DF08A021A3CF34858AD71A
                            Function 006DDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                            Download Yara Rule
                            APIs
                            • lstrlenW.KERNEL32(?,006B5222), ref: 006DDBCE
                            • GetFileAttributesW.KERNELBASE(?), ref: 006DDBDD
                            • FindFirstFileW.KERNELBASE(?,?), ref: 006DDBEE
                            • FindClose.KERNEL32(00000000), ref: 006DDBFA
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FileFind$AttributesCloseFirstlstrlen
                            • String ID:
                            • API String ID: 2695905019-0
                            • Opcode ID: 387a3348ebbe473b8a6ab47164634f4d3b75fc3def0ce2447272d8a145c8206e
                            • Instruction ID: d9ef9d96400a50b1123b25e674410854f8a248ac0ff477940c2f42bbd0139de6
                            • Opcode Fuzzy Hash: 387a3348ebbe473b8a6ab47164634f4d3b75fc3def0ce2447272d8a145c8206e
                            • Instruction Fuzzy Hash: A1F0A0B082091497D2217B78AC0E8BA376DAE01374F208703F836C22E1EFB459558699
                            Function 0067CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: Variable is not of type 'Object'.$p#t
                            • API String ID: 0-112919048
                            • Opcode ID: 1dfd91a2a1a786f674d1ea89d25315328cf507b9e2a48da068ccbe5669998579
                            • Instruction ID: 5c358c0bde1d87c5ad2e844dd3a3b34c08961f7f11cff5613dd334bfb29043bb
                            • Opcode Fuzzy Hash: 1dfd91a2a1a786f674d1ea89d25315328cf507b9e2a48da068ccbe5669998579
                            • Instruction Fuzzy Hash: AD326970900218DBEF14DF94C895BEDB7B6FF09314F24815DE80AAB292D735AE46CB64
                            Function 0067BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: BuffCharUpper
                            • String ID: p#t
                            • API String ID: 3964851224-1114731270
                            • Opcode ID: b9581c691b278e5982c5fd89eb0360c540cba19ac0458da13b9b4cda471c8cfb
                            • Instruction ID: 82b749ec3eb11f2f018bebd0de1354f970a53627a208d7d6bf734a9780d76847
                            • Opcode Fuzzy Hash: b9581c691b278e5982c5fd89eb0360c540cba19ac0458da13b9b4cda471c8cfb
                            • Instruction Fuzzy Hash: 23A25770608301DFD764DF28C480B6ABBE2FF89314F14896DE99A8B352D771E945CB92
                            Function 0067D730 Relevance: 21.6, APIs: 14, Instructions: 621windowsleeptimeCOMMON
                            Download Yara Rule
                            APIs
                            • GetInputState.USER32 ref: 0067D807
                            • timeGetTime.WINMM ref: 0067DA07
                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0067DB28
                            • TranslateMessage.USER32(?), ref: 0067DB7B
                            • DispatchMessageW.USER32(?), ref: 0067DB89
                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0067DB9F
                            • Sleep.KERNEL32(0000000A), ref: 0067DBB1
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                            • String ID:
                            • API String ID: 2189390790-0
                            • Opcode ID: 22e563b8a7e6e2845e55b6085ffe27456b018baee20d54d5f7a253130fbd3760
                            • Instruction ID: 8823c9a292711d681f2be4c5317473d5982b52850e04776ef02f9a26d6165d8b
                            • Opcode Fuzzy Hash: 22e563b8a7e6e2845e55b6085ffe27456b018baee20d54d5f7a253130fbd3760
                            • Instruction Fuzzy Hash: 2842EE70604242DFD729DB24C854FBAB7B2FF86304F148A1EE95A87391C774E885CB96
                            Function 00672CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            APIs
                            • GetSysColorBrush.USER32(0000000F), ref: 00672D07
                            • RegisterClassExW.USER32(00000030), ref: 00672D31
                            • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00672D42
                            • InitCommonControlsEx.COMCTL32(?), ref: 00672D5F
                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00672D6F
                            • LoadIconW.USER32(000000A9), ref: 00672D85
                            • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00672D94
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                            • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                            • API String ID: 2914291525-1005189915
                            • Opcode ID: c6af64556f07bcc3b390e89901f9bce4a967cefee4e0f1052c8a151cf6c21d27
                            • Instruction ID: 0bc84db1221c8c6c3c14aa39828348d366dce0043238d788691fd9088901b950
                            • Opcode Fuzzy Hash: c6af64556f07bcc3b390e89901f9bce4a967cefee4e0f1052c8a151cf6c21d27
                            • Instruction Fuzzy Hash: A321E3B5911248EFDB01EFA4EC49BDDBBB4FB09700F00821AF511A62A0DBB91584CF98
                            Function 006A8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 302 6a8d45-6a8d55 303 6a8d6f-6a8d71 302->303 304 6a8d57-6a8d6a call 69f2c6 call 69f2d9 302->304 305 6a90d9-6a90e6 call 69f2c6 call 69f2d9 303->305 306 6a8d77-6a8d7d 303->306 318 6a90f1 304->318 324 6a90ec call 6a27ec 305->324 306->305 310 6a8d83-6a8dae 306->310 310->305 313 6a8db4-6a8dbd 310->313 316 6a8dbf-6a8dd2 call 69f2c6 call 69f2d9 313->316 317 6a8dd7-6a8dd9 313->317 316->324 321 6a8ddf-6a8de3 317->321 322 6a90d5-6a90d7 317->322 323 6a90f4-6a90f9 318->323 321->322 326 6a8de9-6a8ded 321->326 322->323 324->318 326->316 329 6a8def-6a8e06 326->329 330 6a8e08-6a8e0b 329->330 331 6a8e23-6a8e2c 329->331 333 6a8e0d-6a8e13 330->333 334 6a8e15-6a8e1e 330->334 335 6a8e4a-6a8e54 331->335 336 6a8e2e-6a8e45 call 69f2c6 call 69f2d9 call 6a27ec 331->336 333->334 333->336 337 6a8ebf-6a8ed9 334->337 339 6a8e5b-6a8e79 call 6a3820 call 6a29c8 * 2 335->339 340 6a8e56-6a8e58 335->340 367 6a900c 336->367 342 6a8edf-6a8eef 337->342 343 6a8fad-6a8fb6 call 6af89b 337->343 371 6a8e7b-6a8e91 call 69f2d9 call 69f2c6 339->371 372 6a8e96-6a8ebc call 6a9424 339->372 340->339 342->343 347 6a8ef5-6a8ef7 342->347 356 6a8fb8-6a8fca 343->356 357 6a9029 343->357 347->343 352 6a8efd-6a8f23 347->352 352->343 353 6a8f29-6a8f3c 352->353 353->343 358 6a8f3e-6a8f40 353->358 356->357 362 6a8fcc-6a8fdb GetConsoleMode 356->362 360 6a902d-6a9045 ReadFile 357->360 358->343 363 6a8f42-6a8f6d 358->363 365 6a90a1-6a90ac GetLastError 360->365 366 6a9047-6a904d 360->366 362->357 368 6a8fdd-6a8fe1 362->368 363->343 370 6a8f6f-6a8f82 363->370 373 6a90ae-6a90c0 call 69f2d9 call 69f2c6 365->373 374 6a90c5-6a90c8 365->374 366->365 375 6a904f 366->375 369 6a900f-6a9019 call 6a29c8 367->369 368->360 376 6a8fe3-6a8ffd ReadConsoleW 368->376 369->323 370->343 378 6a8f84-6a8f86 370->378 371->367 372->337 373->367 385 6a90ce-6a90d0 374->385 386 6a9005-6a900b call 69f2a3 374->386 382 6a9052-6a9064 375->382 383 6a901e-6a9027 376->383 384 6a8fff GetLastError 376->384 378->343 388 6a8f88-6a8fa8 378->388 382->369 392 6a9066-6a906a 382->392 383->382 384->386 385->369 386->367 388->343 397 6a906c-6a907c call 6a8a61 392->397 398 6a9083-6a908e 392->398 409 6a907f-6a9081 397->409 399 6a909a-6a909f call 6a88a1 398->399 400 6a9090 call 6a8bb1 398->400 407 6a9095-6a9098 399->407 400->407 407->409 409->369
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: .i
                            • API String ID: 0-2647164722
                            • Opcode ID: 1b14888ffa7fd3247c819b13f1829bcb15691249795c54fbf02785fbe466236f
                            • Instruction ID: 961b7e7fbb97fe650085df5b5cc1538ef016e3655e26618a537898f926b2ee69
                            • Opcode Fuzzy Hash: 1b14888ffa7fd3247c819b13f1829bcb15691249795c54fbf02785fbe466236f
                            • Instruction Fuzzy Hash: ECC1BE74904249AFDF11EFA8C841BEDBBB6AF0A350F244199E914A7392CB349E41CF65
                            Function 006B065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 410 6b065b-6b068b call 6b042f 413 6b068d-6b0698 call 69f2c6 410->413 414 6b06a6-6b06b2 call 6a5221 410->414 419 6b069a-6b06a1 call 69f2d9 413->419 420 6b06cb-6b0714 call 6b039a 414->420 421 6b06b4-6b06c9 call 69f2c6 call 69f2d9 414->421 430 6b097d-6b0983 419->430 428 6b0781-6b078a GetFileType 420->428 429 6b0716-6b071f 420->429 421->419 434 6b078c-6b07bd GetLastError call 69f2a3 CloseHandle 428->434 435 6b07d3-6b07d6 428->435 432 6b0721-6b0725 429->432 433 6b0756-6b077c GetLastError call 69f2a3 429->433 432->433 439 6b0727-6b0754 call 6b039a 432->439 433->419 434->419 449 6b07c3-6b07ce call 69f2d9 434->449 437 6b07d8-6b07dd 435->437 438 6b07df-6b07e5 435->438 442 6b07e9-6b0837 call 6a516a 437->442 438->442 443 6b07e7 438->443 439->428 439->433 453 6b0839-6b0845 call 6b05ab 442->453 454 6b0847-6b086b call 6b014d 442->454 443->442 449->419 453->454 459 6b086f-6b0879 call 6a86ae 453->459 460 6b087e-6b08c1 454->460 461 6b086d 454->461 459->430 463 6b08c3-6b08c7 460->463 464 6b08e2-6b08f0 460->464 461->459 463->464 466 6b08c9-6b08dd 463->466 467 6b097b 464->467 468 6b08f6-6b08fa 464->468 466->464 467->430 468->467 469 6b08fc-6b092f CloseHandle call 6b039a 468->469 472 6b0963-6b0977 469->472 473 6b0931-6b095d GetLastError call 69f2a3 call 6a5333 469->473 472->467 473->472
                            APIs
                              • Part of subcall function 006B039A: CreateFileW.KERNELBASE(00000000,00000000,?,006B0704,?,?,00000000,?,006B0704,00000000,0000000C), ref: 006B03B7
                            • GetLastError.KERNEL32 ref: 006B076F
                            • __dosmaperr.LIBCMT ref: 006B0776
                            • GetFileType.KERNELBASE(00000000), ref: 006B0782
                            • GetLastError.KERNEL32 ref: 006B078C
                            • __dosmaperr.LIBCMT ref: 006B0795
                            • CloseHandle.KERNEL32(00000000), ref: 006B07B5
                            • CloseHandle.KERNEL32(?), ref: 006B08FF
                            • GetLastError.KERNEL32 ref: 006B0931
                            • __dosmaperr.LIBCMT ref: 006B0938
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                            • String ID: H
                            • API String ID: 4237864984-2852464175
                            • Opcode ID: f50148262f7b788279c75854cf5b2d6960841e94f13d83ca7d9fa040195d1562
                            • Instruction ID: 989017e28c660199752c160f2dee3dadd58536f147512033f249d9d436477836
                            • Opcode Fuzzy Hash: f50148262f7b788279c75854cf5b2d6960841e94f13d83ca7d9fa040195d1562
                            • Instruction Fuzzy Hash: 15A13772A101048FEF19EF68D851BEE7FA2AB06320F14416EF811DB392DB359D52CB95
                            Function 0067344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            APIs
                              • Part of subcall function 00673A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00741418,?,00672E7F,?,?,?,00000000), ref: 00673A78
                              • Part of subcall function 00673357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00673379
                            • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0067356A
                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 006B318D
                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 006B31CE
                            • RegCloseKey.ADVAPI32(?), ref: 006B3210
                            • _wcslen.LIBCMT ref: 006B3277
                            • _wcslen.LIBCMT ref: 006B3286
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                            • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                            • API String ID: 98802146-2727554177
                            • Opcode ID: 2bd83e022da476b783403e77fa997d9d7a5b99379e59a424e592e1b36fd24608
                            • Instruction ID: fb31efc19cf1c46f90c08fdf9521502157992ecd0cfcdf9ce527894c4ae45ba8
                            • Opcode Fuzzy Hash: 2bd83e022da476b783403e77fa997d9d7a5b99379e59a424e592e1b36fd24608
                            • Instruction Fuzzy Hash: 3F71D7B15043009EC354DF65DC428ABBBF9FF86740F80852EF545832B1EB389A59CB6A
                            Function 00672B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            APIs
                            • GetSysColorBrush.USER32(0000000F), ref: 00672B8E
                            • LoadCursorW.USER32(00000000,00007F00), ref: 00672B9D
                            • LoadIconW.USER32(00000063), ref: 00672BB3
                            • LoadIconW.USER32(000000A4), ref: 00672BC5
                            • LoadIconW.USER32(000000A2), ref: 00672BD7
                            • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00672BEF
                            • RegisterClassExW.USER32(?), ref: 00672C40
                              • Part of subcall function 00672CD4: GetSysColorBrush.USER32(0000000F), ref: 00672D07
                              • Part of subcall function 00672CD4: RegisterClassExW.USER32(00000030), ref: 00672D31
                              • Part of subcall function 00672CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00672D42
                              • Part of subcall function 00672CD4: InitCommonControlsEx.COMCTL32(?), ref: 00672D5F
                              • Part of subcall function 00672CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00672D6F
                              • Part of subcall function 00672CD4: LoadIconW.USER32(000000A9), ref: 00672D85
                              • Part of subcall function 00672CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00672D94
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                            • String ID: #$0$AutoIt v3
                            • API String ID: 423443420-4155596026
                            • Opcode ID: eeed44c612e88440173b995acd4f1735804f1dcc1048018ef4743ea3e574ca23
                            • Instruction ID: 7df356b97d1aa7d96706c668f4a41f56febc562ea5a471db30068d855e4ba59f
                            • Opcode Fuzzy Hash: eeed44c612e88440173b995acd4f1735804f1dcc1048018ef4743ea3e574ca23
                            • Instruction Fuzzy Hash: 6E214C78E40314ABDB11AFA5EC55A997FB4FB09B50F40C11BF500A66A0D7B90580CF98
                            Function 0067B710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON
                            Download Yara Rule
                            APIs
                            • __Init_thread_footer.LIBCMT ref: 0067BB4E
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Init_thread_footer
                            • String ID: p#t$p#t$p#t$p#t$p%t$p%t$x#t$x#t
                            • API String ID: 1385522511-3434696796
                            • Opcode ID: c8f2c4f73fa0ea062fdc02fcaeed7cdf25b99b1a4cd6aedddeb4600245ec141d
                            • Instruction ID: f338dab1bd5f955339947418ed250103337b29eba5e4daf0dca9c62d22a67341
                            • Opcode Fuzzy Hash: c8f2c4f73fa0ea062fdc02fcaeed7cdf25b99b1a4cd6aedddeb4600245ec141d
                            • Instruction Fuzzy Hash: 72329B34A00209DFEB14DF54C894FBAB7BAEF45304F14C05AE919AB352D778AE42CB95
                            Function 00673170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 758 673170-673185 759 673187-67318a 758->759 760 6731e5-6731e7 758->760 761 67318c-673193 759->761 762 6731eb 759->762 760->759 763 6731e9 760->763 764 673265-67326d PostQuitMessage 761->764 765 673199-67319e 761->765 767 6b2dfb-6b2e23 call 6718e2 call 68e499 762->767 768 6731f1-6731f6 762->768 766 6731d0-6731d8 DefWindowProcW 763->766 773 673219-67321b 764->773 770 6731a4-6731a8 765->770 771 6b2e7c-6b2e90 call 6dbf30 765->771 772 6731de-6731e4 766->772 803 6b2e28-6b2e2f 767->803 774 67321d-673244 SetTimer RegisterWindowMessageW 768->774 775 6731f8-6731fb 768->775 779 6b2e68-6b2e72 call 6dc161 770->779 780 6731ae-6731b3 770->780 771->773 797 6b2e96 771->797 773->772 774->773 781 673246-673251 CreatePopupMenu 774->781 776 673201-673214 KillTimer call 6730f2 call 673c50 775->776 777 6b2d9c-6b2d9f 775->777 776->773 789 6b2da1-6b2da5 777->789 790 6b2dd7-6b2df6 MoveWindow 777->790 793 6b2e77 779->793 786 6b2e4d-6b2e54 780->786 787 6731b9-6731be 780->787 781->773 786->766 791 6b2e5a-6b2e63 call 6d0ad7 786->791 795 6731c4-6731ca 787->795 796 673253-673263 call 67326f 787->796 798 6b2da7-6b2daa 789->798 799 6b2dc6-6b2dd2 SetFocus 789->799 790->773 791->766 793->773 795->766 795->803 796->773 797->766 798->795 804 6b2db0-6b2dc1 call 6718e2 798->804 799->773 803->766 807 6b2e35-6b2e48 call 6730f2 call 673837 803->807 804->773 807->766
                            APIs
                            • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0067316A,?,?), ref: 006731D8
                            • KillTimer.USER32(?,00000001,?,?,?,?,?,0067316A,?,?), ref: 00673204
                            • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00673227
                            • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0067316A,?,?), ref: 00673232
                            • CreatePopupMenu.USER32 ref: 00673246
                            • PostQuitMessage.USER32(00000000), ref: 00673267
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                            • String ID: TaskbarCreated
                            • API String ID: 129472671-2362178303
                            • Opcode ID: 91f85c6d151e2cdcc67b300ba28c78d464466e2f936f2aed3f0ef15eaec250df
                            • Instruction ID: 8ebb1e45721b707ecfeead1796deda140d09d3abc90b2ddb02a357ca9d79e904
                            • Opcode Fuzzy Hash: 91f85c6d151e2cdcc67b300ba28c78d464466e2f936f2aed3f0ef15eaec250df
                            • Instruction Fuzzy Hash: 82416D35250224E7DB152B388C197F9375BE706340F94C22AF519853A2CB799B81A76A
                            Function 0067DFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: D%t$D%t$D%t$D%t$D%tD%t$Variable must be of type 'Object'.
                            • API String ID: 0-3475053870
                            • Opcode ID: a11d8fb51818a650391dae9b7e7d4bc5cb48d3673df17ff04191c660a818b26c
                            • Instruction ID: caa8cf3de5ae5550bffa20c7e22428306027b99801246a551968ac73858e262f
                            • Opcode Fuzzy Hash: a11d8fb51818a650391dae9b7e7d4bc5cb48d3673df17ff04191c660a818b26c
                            • Instruction Fuzzy Hash: 15C28D75A00214CFCB24DF58C881AADB7B2FF09310F24C5A9E919AB391D376ED46CB95
                            Function 00CA25B0 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1324 ca25b0-ca265e call ca0000 1327 ca2665-ca268b call ca34c0 CreateFileW 1324->1327 1330 ca268d 1327->1330 1331 ca2692-ca26a2 1327->1331 1332 ca27dd-ca27e1 1330->1332 1336 ca26a9-ca26c3 VirtualAlloc 1331->1336 1337 ca26a4 1331->1337 1333 ca2823-ca2826 1332->1333 1334 ca27e3-ca27e7 1332->1334 1338 ca2829-ca2830 1333->1338 1339 ca27e9-ca27ec 1334->1339 1340 ca27f3-ca27f7 1334->1340 1341 ca26ca-ca26e1 ReadFile 1336->1341 1342 ca26c5 1336->1342 1337->1332 1343 ca2832-ca283d 1338->1343 1344 ca2885-ca289a 1338->1344 1339->1340 1345 ca27f9-ca2803 1340->1345 1346 ca2807-ca280b 1340->1346 1349 ca26e8-ca2728 VirtualAlloc 1341->1349 1350 ca26e3 1341->1350 1342->1332 1351 ca283f 1343->1351 1352 ca2841-ca284d 1343->1352 1353 ca28aa-ca28b2 1344->1353 1354 ca289c-ca28a7 VirtualFree 1344->1354 1345->1346 1347 ca281b 1346->1347 1348 ca280d-ca2817 1346->1348 1347->1333 1348->1347 1355 ca272a 1349->1355 1356 ca272f-ca274a call ca3710 1349->1356 1350->1332 1351->1344 1357 ca284f-ca285f 1352->1357 1358 ca2861-ca286d 1352->1358 1354->1353 1355->1332 1364 ca2755-ca275f 1356->1364 1360 ca2883 1357->1360 1361 ca287a-ca2880 1358->1361 1362 ca286f-ca2878 1358->1362 1360->1338 1361->1360 1362->1360 1365 ca2792-ca27a6 call ca3520 1364->1365 1366 ca2761-ca2790 call ca3710 1364->1366 1371 ca27aa-ca27ae 1365->1371 1372 ca27a8 1365->1372 1366->1364 1374 ca27ba-ca27be 1371->1374 1375 ca27b0-ca27b4 FindCloseChangeNotification 1371->1375 1372->1332 1376 ca27ce-ca27d7 1374->1376 1377 ca27c0-ca27cb VirtualFree 1374->1377 1375->1374 1376->1327 1376->1332 1377->1376
                            APIs
                            • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00CA2681
                            • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00CA28A7
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815495861.0000000000CA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CA0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_ca0000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateFileFreeVirtual
                            • String ID:
                            • API String ID: 204039940-0
                            • Opcode ID: e7fcc9d0c03c8eebee60ddba528add67e317e316073a556d8272a5bdc8b54fa5
                            • Instruction ID: 7db171e128add8e2078da1deff939f173fa960e568ddd2ba5ebfbcb657211779
                            • Opcode Fuzzy Hash: e7fcc9d0c03c8eebee60ddba528add67e317e316073a556d8272a5bdc8b54fa5
                            • Instruction Fuzzy Hash: B1A12C75E0021AEBDB14CFA8C994BEEB7B5FF49308F208159E511BB280D7799A40DF94
                            Function 00672C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1388 672c63-672cd3 CreateWindowExW * 2 ShowWindow * 2
                            APIs
                            • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00672C91
                            • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00672CB2
                            • ShowWindow.USER32(00000000,?,?,?,?,?,?,00671CAD,?), ref: 00672CC6
                            • ShowWindow.USER32(00000000,?,?,?,?,?,?,00671CAD,?), ref: 00672CCF
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$CreateShow
                            • String ID: AutoIt v3$edit
                            • API String ID: 1584632944-3779509399
                            • Opcode ID: 3138124e542219b13b619dcd6c4875a3a3be8c39cfb9a55edc4fb84ea656af7d
                            • Instruction ID: 74c89562dc90a907d3f6e7499ff68f5e0b45982fb14a1c6e3ddba9608e105052
                            • Opcode Fuzzy Hash: 3138124e542219b13b619dcd6c4875a3a3be8c39cfb9a55edc4fb84ea656af7d
                            • Instruction Fuzzy Hash: 09F0DA79540290BAEB322B17AC48E772EBDD7C7F50B41815AF900A25A0C7691894DAB8
                            Function 00CA23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133fileCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1503 ca23b0-ca24ac call ca0000 call ca22a0 CreateFileW 1510 ca24ae 1503->1510 1511 ca24b3-ca24c3 1503->1511 1512 ca2563-ca2568 1510->1512 1514 ca24ca-ca24e4 VirtualAlloc 1511->1514 1515 ca24c5 1511->1515 1516 ca24e8-ca24ff ReadFile 1514->1516 1517 ca24e6 1514->1517 1515->1512 1518 ca2503-ca253d call ca22e0 call ca12a0 1516->1518 1519 ca2501 1516->1519 1517->1512 1524 ca2559-ca2561 ExitProcess 1518->1524 1525 ca253f-ca2554 call ca2330 1518->1525 1519->1512 1524->1512 1525->1524
                            APIs
                              • Part of subcall function 00CA22A0: Sleep.KERNELBASE(000001F4), ref: 00CA22B1
                            • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00CA24A2
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815495861.0000000000CA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CA0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_ca0000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateFileSleep
                            • String ID: T1V4BF77KVC
                            • API String ID: 2694422964-797782593
                            • Opcode ID: 0de058f9ad9d0b859926e7b133ef1bd87b55a28ab95c77040bd53649b2d38be1
                            • Instruction ID: 684af398597dcec8c338ccd4f0650b7e698ab675eded00978fa1070608ee342b
                            • Opcode Fuzzy Hash: 0de058f9ad9d0b859926e7b133ef1bd87b55a28ab95c77040bd53649b2d38be1
                            • Instruction Fuzzy Hash: CF51A031D0425AEBEF10DBE8C855BEEBB78AF09304F104199E219BB2C0D6791B45CBA5
                            Function 006E2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1527 6e2947-6e29b9 call 6b1f50 call 6e25d6 call 68fe0b call 675722 call 6e274e call 67511f call 695232 1542 6e29bf-6e29c6 call 6e2e66 1527->1542 1543 6e2a6c-6e2a73 call 6e2e66 1527->1543 1548 6e29cc-6e2a6a call 69d583 call 694983 call 699038 call 69d583 call 699038 * 2 1542->1548 1549 6e2a75-6e2a77 1542->1549 1543->1549 1550 6e2a7c 1543->1550 1553 6e2a7f-6e2b3a call 6750f5 * 8 call 6e3017 call 69e5eb 1548->1553 1552 6e2cb6-6e2cb7 1549->1552 1550->1553 1554 6e2cd5-6e2cdb 1552->1554 1592 6e2b3c-6e2b3e 1553->1592 1593 6e2b43-6e2b5e call 6e2792 1553->1593 1557 6e2cdd-6e2ce8 call 68fdcd call 68fe14 1554->1557 1558 6e2cf0-6e2cf6 1554->1558 1570 6e2ced 1557->1570 1570->1558 1592->1552 1596 6e2b64-6e2b6c 1593->1596 1597 6e2bf0-6e2bfc call 69e678 1593->1597 1598 6e2b6e-6e2b72 1596->1598 1599 6e2b74 1596->1599 1604 6e2bfe-6e2c0d DeleteFileW 1597->1604 1605 6e2c12-6e2c16 1597->1605 1601 6e2b79-6e2b97 call 6750f5 1598->1601 1599->1601 1611 6e2b99-6e2b9e 1601->1611 1612 6e2bc1-6e2bd7 call 6e211d call 69dbb3 1601->1612 1604->1552 1607 6e2c18-6e2c7e call 6e25d6 call 69d2eb * 2 call 6e22ce 1605->1607 1608 6e2c91-6e2ca5 CopyFileW 1605->1608 1609 6e2cb9-6e2ccf DeleteFileW call 6e2fd8 1607->1609 1632 6e2c80-6e2c8f DeleteFileW 1607->1632 1608->1609 1610 6e2ca7-6e2cb4 DeleteFileW 1608->1610 1618 6e2cd4 1609->1618 1610->1552 1615 6e2ba1-6e2bb4 call 6e28d2 1611->1615 1627 6e2bdc-6e2be7 1612->1627 1625 6e2bb6-6e2bbf 1615->1625 1618->1554 1625->1612 1627->1596 1628 6e2bed 1627->1628 1628->1597 1632->1552
                            APIs
                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006E2C05
                            • DeleteFileW.KERNEL32(?), ref: 006E2C87
                            • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 006E2C9D
                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006E2CAE
                            • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006E2CC0
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: File$Delete$Copy
                            • String ID:
                            • API String ID: 3226157194-0
                            • Opcode ID: 65ca7e8cdb816982ef388436c8990f3605f824619b652e6c2d2cb761e839257a
                            • Instruction ID: bdb2b64b0d7e15ea012ad1e4e7da3dcd38e8021bffba57c44f6c5ab6310878b7
                            • Opcode Fuzzy Hash: 65ca7e8cdb816982ef388436c8990f3605f824619b652e6c2d2cb761e839257a
                            • Instruction Fuzzy Hash: D1B17F71D01219ABDF51DFA5CC95EDEB7BEEF48340F1040AAF609E7241EA309A448F65
                            Function 006A5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE
                            Download Yara Rule

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1907 6a5aa9-6a5ace 1908 6a5ad0-6a5ad2 1907->1908 1909 6a5ad7-6a5ad9 1907->1909 1910 6a5ca5-6a5cb4 call 690a8c 1908->1910 1911 6a5afa-6a5b1f 1909->1911 1912 6a5adb-6a5af5 call 69f2c6 call 69f2d9 call 6a27ec 1909->1912 1914 6a5b21-6a5b24 1911->1914 1915 6a5b26-6a5b2c 1911->1915 1912->1910 1914->1915 1918 6a5b4e-6a5b53 1914->1918 1919 6a5b4b 1915->1919 1920 6a5b2e-6a5b46 call 69f2c6 call 69f2d9 call 6a27ec 1915->1920 1923 6a5b64-6a5b6d call 6a564e 1918->1923 1924 6a5b55-6a5b61 call 6a9424 1918->1924 1919->1918 1952 6a5c9c-6a5c9f 1920->1952 1935 6a5ba8-6a5bba 1923->1935 1936 6a5b6f-6a5b71 1923->1936 1924->1923 1938 6a5bbc-6a5bc2 1935->1938 1939 6a5c02-6a5c23 WriteFile 1935->1939 1940 6a5b73-6a5b78 1936->1940 1941 6a5b95-6a5b9e call 6a542e 1936->1941 1943 6a5bf2-6a5c00 call 6a56c4 1938->1943 1944 6a5bc4-6a5bc7 1938->1944 1947 6a5c2e 1939->1947 1948 6a5c25-6a5c2b GetLastError 1939->1948 1945 6a5b7e-6a5b8b call 6a55e1 1940->1945 1946 6a5c6c-6a5c7e 1940->1946 1951 6a5ba3-6a5ba6 1941->1951 1943->1951 1954 6a5bc9-6a5bcc 1944->1954 1955 6a5be2-6a5bf0 call 6a5891 1944->1955 1960 6a5b8e-6a5b90 1945->1960 1958 6a5c89-6a5c99 call 69f2d9 call 69f2c6 1946->1958 1959 6a5c80-6a5c83 1946->1959 1953 6a5c31-6a5c3c 1947->1953 1948->1947 1951->1960 1965 6a5ca4 1952->1965 1962 6a5c3e-6a5c43 1953->1962 1963 6a5ca1 1953->1963 1954->1946 1964 6a5bd2-6a5be0 call 6a57a3 1954->1964 1955->1951 1958->1952 1959->1958 1969 6a5c85-6a5c87 1959->1969 1960->1953 1971 6a5c69 1962->1971 1972 6a5c45-6a5c4a 1962->1972 1963->1965 1964->1951 1965->1910 1969->1965 1971->1946 1976 6a5c4c-6a5c5e call 69f2d9 call 69f2c6 1972->1976 1977 6a5c60-6a5c67 call 69f2a3 1972->1977 1976->1952 1977->1952
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: JOg
                            • API String ID: 0-645625397
                            • Opcode ID: 6cf7d88ecd5abce6dcc469492a21b3283c115757cc1b28ace6925851491b4c0e
                            • Instruction ID: e012718a03efe5da80a702aa77cae844a598085fda54cf1ea30c1621f8458c17
                            • Opcode Fuzzy Hash: 6cf7d88ecd5abce6dcc469492a21b3283c115757cc1b28ace6925851491b4c0e
                            • Instruction Fuzzy Hash: 6051AE75900609ABCF11FFA8C845BEEBBBAAF06324F14005EF507A7292D6359E018F65
                            Function 00673B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                            Download Yara Rule
                            APIs
                            • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00673B0F,SwapMouseButtons,00000004,?), ref: 00673B40
                            • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00673B0F,SwapMouseButtons,00000004,?), ref: 00673B61
                            • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00673B0F,SwapMouseButtons,00000004,?), ref: 00673B83
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CloseOpenQueryValue
                            • String ID: Control Panel\Mouse
                            • API String ID: 3677997916-824357125
                            • Opcode ID: 4e6e540956636cb99ac5f71540a9b5987a977727d209660e6d2ba9b37d36ab44
                            • Instruction ID: 63cc692715799ec3a825e3731a91e814e915e9b7117598a3362f87abc2a5678a
                            • Opcode Fuzzy Hash: 4e6e540956636cb99ac5f71540a9b5987a977727d209660e6d2ba9b37d36ab44
                            • Instruction Fuzzy Hash: B0112AB5510218FFDB218FA5DC44AEEB7BDEF24B44B10855AA809D7210E6319E40A7A4
                            Function 00CA12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                            Download Yara Rule
                            APIs
                            • CreateProcessW.KERNELBASE(?,00000000), ref: 00CA1A5B
                            • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00CA1AF1
                            • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00CA1B13
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815495861.0000000000CA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CA0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_ca0000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$ContextCreateMemoryReadThreadWow64
                            • String ID:
                            • API String ID: 2438371351-0
                            • Opcode ID: f7a3111ab7015fd8b62422fe8fc399687c9bf18e9b49b2a513bdf356eeec8a8c
                            • Instruction ID: 62dbe423093e614b2349fe2881513689088ff028e7c3c95ecf1a301df5046dab
                            • Opcode Fuzzy Hash: f7a3111ab7015fd8b62422fe8fc399687c9bf18e9b49b2a513bdf356eeec8a8c
                            • Instruction Fuzzy Hash: CA623B30A14259DBEB24CFA4C840BDEB372EF58304F1491A9E51DEB390E7799E81CB59
                            Function 00673923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                            Download Yara Rule
                            APIs
                            • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 006B33A2
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                            • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00673A04
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: IconLoadNotifyShell_String_wcslen
                            • String ID: Line:
                            • API String ID: 2289894680-1585850449
                            • Opcode ID: c37b288d0d3f25af4309c05db1e4b8cf55e0be4230b78e7d9c6c511e89f7667a
                            • Instruction ID: 83312c4221b95f5740342c8d133f538cc439f169ad144c62c2efdf06ec497d22
                            • Opcode Fuzzy Hash: c37b288d0d3f25af4309c05db1e4b8cf55e0be4230b78e7d9c6c511e89f7667a
                            • Instruction Fuzzy Hash: B631C571508320AEC761EF20DC45BEBB7D9AB41710F00861EF59D83291EF749689C7CA
                            Function 00672DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
                            Download Yara Rule
                            APIs
                            • GetOpenFileNameW.COMDLG32(?), ref: 006B2C8C
                              • Part of subcall function 00673AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00673A97,?,?,00672E7F,?,?,?,00000000), ref: 00673AC2
                              • Part of subcall function 00672DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00672DC4
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Name$Path$FileFullLongOpen
                            • String ID: X$`es
                            • API String ID: 779396738-2017476410
                            • Opcode ID: 7f415214d1fdfe20ddb54de6ef1af4044109497a86244d0dd15b78539aa09db5
                            • Instruction ID: 22641b3b94c096829976899d882e4851b7d74dafa1fb4b59e36962290dc510ba
                            • Opcode Fuzzy Hash: 7f415214d1fdfe20ddb54de6ef1af4044109497a86244d0dd15b78539aa09db5
                            • Instruction Fuzzy Hash: D4219671A00258ABDB41DF94C8557EE7BFDAF49304F00C05DE509A7241DBB85A898B65
                            Function 0068FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                            Download Yara Rule
                            APIs
                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00690668
                              • Part of subcall function 006932A4: RaiseException.KERNEL32(?,?,?,0069068A,?,00741444,?,?,?,?,?,?,0069068A,00671129,00738738,00671129), ref: 00693304
                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00690685
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Exception@8Throw$ExceptionRaise
                            • String ID: Unknown exception
                            • API String ID: 3476068407-410509341
                            • Opcode ID: c7e87462b50f60ba1b597f5ee4061d846326553e5eeefe24df497d93d0dbf1ce
                            • Instruction ID: eb83d81bafdd1d4a15241a2dda63b58229d6142cb350c08d601f427f45cfe890
                            • Opcode Fuzzy Hash: c7e87462b50f60ba1b597f5ee4061d846326553e5eeefe24df497d93d0dbf1ce
                            • Instruction Fuzzy Hash: 42F04F34900209ABDF40B7A4D846C9E776E5E40350B604639B924D6ED2EF71EB66C685
                            Function 006E3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                            Download Yara Rule
                            APIs
                            • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 006E302F
                            • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 006E3044
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Temp$FileNamePath
                            • String ID: aut
                            • API String ID: 3285503233-3010740371
                            • Opcode ID: ed85e5ada1040330a5866b83cfb2c5c70cbe8d722ce5ffecf520b12a05913a87
                            • Instruction ID: ad266126209d14cb36fbb63bb2a3a4f43abc82484e07b625ebd4a3b4fab7dd7a
                            • Opcode Fuzzy Hash: ed85e5ada1040330a5866b83cfb2c5c70cbe8d722ce5ffecf520b12a05913a87
                            • Instruction Fuzzy Hash: 52D05EB2500328B7DA20A7A4AC0EFCB3A6CEB05750F0043A1B655E60D1DEF89984CAD4
                            Function 006F7F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 006F82F5
                            • TerminateProcess.KERNEL32(00000000), ref: 006F82FC
                            • FreeLibrary.KERNEL32(?,?,?,?), ref: 006F84DD
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$CurrentFreeLibraryTerminate
                            • String ID:
                            • API String ID: 146820519-0
                            • Opcode ID: 8cc434054a4412f06121cec257696a7e0d4078185066f37fa27b9b541c9bcce9
                            • Instruction ID: cfb2295888aad7126523afe61c8fdc050eaa0350ad9bcb5fa080d3f64046b6f8
                            • Opcode Fuzzy Hash: 8cc434054a4412f06121cec257696a7e0d4078185066f37fa27b9b541c9bcce9
                            • Instruction Fuzzy Hash: 52127B71A083459FC754DF28C484B6ABBE2BF85318F04899DE9898B352DB31ED45CF92
                            Function 006710F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00671BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00671BF4
                              • Part of subcall function 00671BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00671BFC
                              • Part of subcall function 00671BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00671C07
                              • Part of subcall function 00671BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00671C12
                              • Part of subcall function 00671BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00671C1A
                              • Part of subcall function 00671BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00671C22
                              • Part of subcall function 00671B4A: RegisterWindowMessageW.USER32(00000004,?,006712C4), ref: 00671BA2
                            • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0067136A
                            • OleInitialize.OLE32 ref: 00671388
                            • CloseHandle.KERNEL32(00000000,00000000), ref: 006B24AB
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                            • String ID:
                            • API String ID: 1986988660-0
                            • Opcode ID: 7e192e916b680ca28acf77dd582d8a2a7e4b232bb4df55ce9cf9c700b4ec5f95
                            • Instruction ID: ded2b8aa272b74e8623566e161bea691a6512e7fec3cf752715b414cf8d52652
                            • Opcode Fuzzy Hash: 7e192e916b680ca28acf77dd582d8a2a7e4b232bb4df55ce9cf9c700b4ec5f95
                            • Instruction Fuzzy Hash: 887199B89112408FC384FF79E845695BAE5AB8A394395C22FD51ACB261EB3C44E0CF5D
                            Function 006DC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00673923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00673A04
                            • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006DC259
                            • KillTimer.USER32(?,00000001,?,?), ref: 006DC261
                            • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006DC270
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: IconNotifyShell_Timer$Kill
                            • String ID:
                            • API String ID: 3500052701-0
                            • Opcode ID: 2b82241475eafa98fde9b8f44fefaa82244c9e75cc97d594d041ac6538847971
                            • Instruction ID: a4b5d0e74b576f81b2dbcf0d52354b4e6c6fe54a83268a7c65ce660034a5538a
                            • Opcode Fuzzy Hash: 2b82241475eafa98fde9b8f44fefaa82244c9e75cc97d594d041ac6538847971
                            • Instruction Fuzzy Hash: AE31E370D00348AFEB329F648895BE7BBEDAB02314F00409EE2DA93341C7745A85CB55
                            Function 006A86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,006A85CC,?,00738CC8,0000000C), ref: 006A8704
                            • GetLastError.KERNEL32(?,006A85CC,?,00738CC8,0000000C), ref: 006A870E
                            • __dosmaperr.LIBCMT ref: 006A8739
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ChangeCloseErrorFindLastNotification__dosmaperr
                            • String ID:
                            • API String ID: 490808831-0
                            • Opcode ID: 51d0aa4760f447e1d1072ccbf1286092fe14ba8e9f465c05b37445c277b3bc82
                            • Instruction ID: b8f48747e1b706b225df81947c9e5eccbe475c019a622d0c0f47537b99e501ea
                            • Opcode Fuzzy Hash: 51d0aa4760f447e1d1072ccbf1286092fe14ba8e9f465c05b37445c277b3bc82
                            • Instruction Fuzzy Hash: 6B0148326046202EEAA0B3346845BAE674B4BC3774F39121DE8058B2D2EEA4DC818998
                            Function 0067DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON
                            Download Yara Rule
                            APIs
                            • TranslateMessage.USER32(?), ref: 0067DB7B
                            • DispatchMessageW.USER32(?), ref: 0067DB89
                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0067DB9F
                            • Sleep.KERNEL32(0000000A), ref: 0067DBB1
                            • TranslateAcceleratorW.USER32(?,?,?), ref: 006C1CC9
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Message$Translate$AcceleratorDispatchPeekSleep
                            • String ID:
                            • API String ID: 3288985973-0
                            • Opcode ID: 1959d3d4473a5c9a50bafa81b215815a8c95c8c40f8cb6589389672888aacbec
                            • Instruction ID: ae2f2fddd2258be9dffaa327468a27827b1aa5a6bf7d2f9b737de702dbde35dc
                            • Opcode Fuzzy Hash: 1959d3d4473a5c9a50bafa81b215815a8c95c8c40f8cb6589389672888aacbec
                            • Instruction Fuzzy Hash: 1EF05E30644340DBE730DB608C49FEA73BEEF46710F508B19F61A971C0DB78A4888B19
                            Function 006E2FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON
                            Download Yara Rule
                            APIs
                            • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,006E2CD4,?,?,?,00000004,00000001), ref: 006E2FF2
                            • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,006E2CD4,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 006E3006
                            • CloseHandle.KERNEL32(00000000,?,006E2CD4,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 006E300D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: File$CloseCreateHandleTime
                            • String ID:
                            • API String ID: 3397143404-0
                            • Opcode ID: 62f261bf3c9cbb6949274b10c0acd7f3adee760082cb17cffe844957645fba0c
                            • Instruction ID: bfc0d1775cc20ec8cf44b53cc40edab995bb82a8eb869addc6493e08ce9d2edc
                            • Opcode Fuzzy Hash: 62f261bf3c9cbb6949274b10c0acd7f3adee760082cb17cffe844957645fba0c
                            • Instruction Fuzzy Hash: FAE08632281324B7D2311755BC0DFCB3A1CD786B75F118310F719761D04AA4150142AC
                            Function 00681310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                            Download Yara Rule
                            APIs
                            • __Init_thread_footer.LIBCMT ref: 006817F6
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Init_thread_footer
                            • String ID: CALL
                            • API String ID: 1385522511-4196123274
                            • Opcode ID: d6a98cc91de751731d5f30824ba9c0fcf66df4cabf974290d179adbded8d0380
                            • Instruction ID: 4012f82fe222443142145800400a607e27eb518336bb1fca6f994464abb7b76c
                            • Opcode Fuzzy Hash: d6a98cc91de751731d5f30824ba9c0fcf66df4cabf974290d179adbded8d0380
                            • Instruction Fuzzy Hash: 5B229CB06082419FC714EF14C484B6ABBF6FF86314F248A6DF49A8B361D771E942CB56
                            Function 006E6EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON
                            Download Yara Rule
                            APIs
                            • _wcslen.LIBCMT ref: 006E6F6B
                              • Part of subcall function 00674ECB: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674EFD
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LibraryLoad_wcslen
                            • String ID: >>>AUTOIT SCRIPT<<<
                            • API String ID: 3312870042-2806939583
                            • Opcode ID: ef69779b57b41fc656248c7eefe257525400eab7feeb59d106b76d509363098e
                            • Instruction ID: 80a20b1b81231e0c68899ce0e55aa6ad0195311d92d9f92b4d6171b65e3136f8
                            • Opcode Fuzzy Hash: ef69779b57b41fc656248c7eefe257525400eab7feeb59d106b76d509363098e
                            • Instruction Fuzzy Hash: 06B18F315083418FCB54EF20C8919AEB7E6AF94310F14895DF49A872A2EF30ED49CB96
                            Function 006E2557 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: __fread_nolock
                            • String ID: EA06
                            • API String ID: 2638373210-3962188686
                            • Opcode ID: e8f1515fa11057ab498fa720b75982b6c700bf4bbc94369c72ed94f0e6dd842d
                            • Instruction ID: c0b3441ded9f795c562908f2100d0aa2dd85182522899030f78ab4c9f2cddb20
                            • Opcode Fuzzy Hash: e8f1515fa11057ab498fa720b75982b6c700bf4bbc94369c72ed94f0e6dd842d
                            • Instruction Fuzzy Hash: 1301B5729042587EEF58C7A8C856EEEBBFD9B05301F00855EE152D21C1E5B5E6088B60
                            Function 00673837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                            Download Yara Rule
                            APIs
                            • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00673908
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: IconNotifyShell_
                            • String ID:
                            • API String ID: 1144537725-0
                            • Opcode ID: e4f9fc0775f6f7b14eb8f1b57dfca7d7471edb91c3fc3c40da03d6da52049bbc
                            • Instruction ID: e4349a7a8cc215558269212fbd5e34458d51b06071fbe33078e84f04bfc7b0d1
                            • Opcode Fuzzy Hash: e4f9fc0775f6f7b14eb8f1b57dfca7d7471edb91c3fc3c40da03d6da52049bbc
                            • Instruction Fuzzy Hash: C0318EB0A043119FD761EF24D8847D7BBE9FB49708F00492EF69983340E775AA84DB56
                            Function 00CA129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                            Download Yara Rule
                            APIs
                            • CreateProcessW.KERNELBASE(?,00000000), ref: 00CA1A5B
                            • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00CA1AF1
                            • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00CA1B13
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815495861.0000000000CA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CA0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_ca0000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$ContextCreateMemoryReadThreadWow64
                            • String ID:
                            • API String ID: 2438371351-0
                            • Opcode ID: 47f45bba1b7d6f78db91ee930b61901a72fbf3bd75938062ef2b5451d70cd9db
                            • Instruction ID: bd268d34faba74fc699723ea2a9645534790100ce7469fb7fe48213bbc2f2d9f
                            • Opcode Fuzzy Hash: 47f45bba1b7d6f78db91ee930b61901a72fbf3bd75938062ef2b5451d70cd9db
                            • Instruction Fuzzy Hash: 7A12BD24E24658C6EB24DF64D8507DEB232EF69300F1090E9910DEB7A5E77A4F81CF5A
                            Function 00674ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00674E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E9C
                              • Part of subcall function 00674E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00674EAE
                              • Part of subcall function 00674E90: FreeLibrary.KERNEL32(00000000,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674EC0
                            • LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674EFD
                              • Part of subcall function 00674E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E62
                              • Part of subcall function 00674E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00674E74
                              • Part of subcall function 00674E59: FreeLibrary.KERNEL32(00000000,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E87
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Library$Load$AddressFreeProc
                            • String ID:
                            • API String ID: 2632591731-0
                            • Opcode ID: 811774656b24cc284d7817adb0f55e3f673fb51aef84cd11a579c5d5e166a862
                            • Instruction ID: bc8e55a20edfd5cc7418905b90edbb39726f0984e7c78f31f30348d6131bf43d
                            • Opcode Fuzzy Hash: 811774656b24cc284d7817adb0f55e3f673fb51aef84cd11a579c5d5e166a862
                            • Instruction Fuzzy Hash: 25110132600205AACB10EB70DC0ABAD77A6AF80710F20C42DF04AA62C1EFB59A459B58
                            Function 006F9ABB Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LibraryLoad
                            • String ID:
                            • API String ID: 1029625771-0
                            • Opcode ID: 49cbff61476feced05cc3e78778a280d6fa74b5d1e0d3ca58455b31f72b1aff4
                            • Instruction ID: fa2fd86b7dfc27e38a685b65a0b20bf52f65ee69973dab3d9519eabe189b03ef
                            • Opcode Fuzzy Hash: 49cbff61476feced05cc3e78778a280d6fa74b5d1e0d3ca58455b31f72b1aff4
                            • Instruction Fuzzy Hash: AA11A336700115CFDB11DF18D480AEAB7E6FF49310B05816AED4A8B350DB30AD41CBA1
                            Function 006A8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: __wsopen_s
                            • String ID:
                            • API String ID: 3347428461-0
                            • Opcode ID: 18c7c5e38070e748bf528c94747af5ed9f7ac61b695de48ffad83a00653557d1
                            • Instruction ID: 667f006820152c08445e78741083e292dd8cec298d9859e3f09620ec66ff1222
                            • Opcode Fuzzy Hash: 18c7c5e38070e748bf528c94747af5ed9f7ac61b695de48ffad83a00653557d1
                            • Instruction Fuzzy Hash: AD11187590420AAFCB05EF58E9459DA7BF9EF49314F104099F808AB312DB31DE11CBA9
                            Function 006A5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006A4C7D: RtlAllocateHeap.NTDLL(00000008,00671129,00000000,?,006A2E29,00000001,00000364,?,?,?,0069F2DE,006A3863,00741444,?,0068FDF5,?), ref: 006A4CBE
                            • _free.LIBCMT ref: 006A506C
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AllocateHeap_free
                            • String ID:
                            • API String ID: 614378929-0
                            • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                            • Instruction ID: d82d6bc25fdf770cbd58f2d3efcc4b0b2109dabe1f07b165c68829e7b9f0d8ad
                            • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                            • Instruction Fuzzy Hash: 43012B722047055BE321DE559C41A9AFBEAFB8A370F25051DE18583280EA706C05CA74
                            Function 0069E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                            • Instruction ID: e576880390945a8185c69933fc946315a5c6ad1811dc10ebe565eac1cba42370
                            • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                            • Instruction Fuzzy Hash: 1FF0F932510E109ADE717A698C05B96339F9FA3331F10072DF420D7AD2DF75E8028AAD
                            Function 00679CB3 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen
                            • String ID:
                            • API String ID: 176396367-0
                            • Opcode ID: 44d5df428b1063420b1133a1677c9ea66ad3a2b7c5b2be1c3290bca24a9e2b1b
                            • Instruction ID: 5c11f0ef4b1139a6d7e7f4d2e2a6d71823eb3f6e8a99a49b63a702cd9564f242
                            • Opcode Fuzzy Hash: 44d5df428b1063420b1133a1677c9ea66ad3a2b7c5b2be1c3290bca24a9e2b1b
                            • Instruction Fuzzy Hash: EDF02D731006007ED7105F28C806E57BB99EF44760F10852EF619CB1D1DB31E4108BE4
                            Function 006A4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • RtlAllocateHeap.NTDLL(00000008,00671129,00000000,?,006A2E29,00000001,00000364,?,?,?,0069F2DE,006A3863,00741444,?,0068FDF5,?), ref: 006A4CBE
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AllocateHeap
                            • String ID:
                            • API String ID: 1279760036-0
                            • Opcode ID: e26f8ca24a124d6a16bd6d9459f61ce3a523045fad9693f7e81ac6e3b62023b9
                            • Instruction ID: 37d2a86d78112470aba23c9ed12d2787493bbe291d8656aba9a2cc6c8458b5ed
                            • Opcode Fuzzy Hash: e26f8ca24a124d6a16bd6d9459f61ce3a523045fad9693f7e81ac6e3b62023b9
                            • Instruction Fuzzy Hash: 65F0BB3150612466DB217F619C05F96379BAFC3770B154215B81F96681CEF0DC024A94
                            Function 006A3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AllocateHeap
                            • String ID:
                            • API String ID: 1279760036-0
                            • Opcode ID: dce766c804e5a610ce89067f6f54c050f57fa4878af91cfa172534c4da84492b
                            • Instruction ID: 34cf1e90ee7d562e0188b1f15bf0fb35628ca503a774a351fb680207470bdc78
                            • Opcode Fuzzy Hash: dce766c804e5a610ce89067f6f54c050f57fa4878af91cfa172534c4da84492b
                            • Instruction Fuzzy Hash: CAE0E53110123496DA213B669C05FDA375FAF437B0F054125BC0592B80DF18DE028BE4
                            Function 00674F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                            Download Yara Rule
                            APIs
                            • FreeLibrary.KERNEL32(?,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674F6D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FreeLibrary
                            • String ID:
                            • API String ID: 3664257935-0
                            • Opcode ID: e746bf796aa189e025ec86c08fdaa086769cfd5ab323da4dc73a8a5ac1e72d90
                            • Instruction ID: 018d4f5e04e57ee8bf7f05736d1874f467be10008c7b4c15726ef8930b6ff7e4
                            • Opcode Fuzzy Hash: e746bf796aa189e025ec86c08fdaa086769cfd5ab323da4dc73a8a5ac1e72d90
                            • Instruction Fuzzy Hash: 30F03971105752CFDB349F64D498862FBE6EF55329320CA7EE1EE82621CB3A9884DF10
                            Function 00672DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                            Download Yara Rule
                            APIs
                            • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00672DC4
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LongNamePath_wcslen
                            • String ID:
                            • API String ID: 541455249-0
                            • Opcode ID: 13ae075d180392f66e479eb7ab4dd4d70e0fbc3501e6ef098c2f01a201e32e7e
                            • Instruction ID: fac7d9ea4ca000afba2744d52f99874480a8ab06c08290aec0d66df7c93c68c3
                            • Opcode Fuzzy Hash: 13ae075d180392f66e479eb7ab4dd4d70e0fbc3501e6ef098c2f01a201e32e7e
                            • Instruction Fuzzy Hash: CAE0CD726001245BC7119358DC05FEA77DDDFC9790F044175FD09D7249D964ADC0C654
                            Function 006E2693 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: __fread_nolock
                            • String ID:
                            • API String ID: 2638373210-0
                            • Opcode ID: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
                            • Instruction ID: c9cfa2df5b82668660b57f4fc0397187d50c14f26e577fe852e7f0d6ddd7fdfc
                            • Opcode Fuzzy Hash: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
                            • Instruction Fuzzy Hash: D8E04FB060AB005FDF399A28A9617F677EA9F49300F00096EF69B82752E57268458A4D
                            Function 00672B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00673837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00673908
                              • Part of subcall function 0067D730: GetInputState.USER32 ref: 0067D807
                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00672B6B
                              • Part of subcall function 006730F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0067314E
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: IconNotifyShell_$CurrentDirectoryInputState
                            • String ID:
                            • API String ID: 3667716007-0
                            • Opcode ID: 1c7e8d7c90c31cb79177febc966a906df2ae6c454d4c2f3734e20218c1ba14bc
                            • Instruction ID: 942da974f0d43b4ce66ac9924867db4052046bd4cbca2f0101a584292e8aea8b
                            • Opcode Fuzzy Hash: 1c7e8d7c90c31cb79177febc966a906df2ae6c454d4c2f3734e20218c1ba14bc
                            • Instruction Fuzzy Hash: 57E0262130025803CA48BB3498124ADA75B8FD2351F40C93EF04A432A3CF284585421A
                            Function 006B039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • CreateFileW.KERNELBASE(00000000,00000000,?,006B0704,?,?,00000000,?,006B0704,00000000,0000000C), ref: 006B03B7
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateFile
                            • String ID:
                            • API String ID: 823142352-0
                            • Opcode ID: 4cb400460d2b9a1050a37e9ace85d8646f4242149c013e930964876543c7a25b
                            • Instruction ID: 52fddc863a6ef67570f5ece4d21d421bfe67416b24c62a431f372df3433b19ac
                            • Opcode Fuzzy Hash: 4cb400460d2b9a1050a37e9ace85d8646f4242149c013e930964876543c7a25b
                            • Instruction Fuzzy Hash: F3D06C3204010DFBDF028F84DD06EDA3BAAFB48714F018100BE1856020C736E821AB94
                            Function 00671CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                            Download Yara Rule
                            APIs
                            • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00671CBC
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: InfoParametersSystem
                            • String ID:
                            • API String ID: 3098949447-0
                            • Opcode ID: 2df282f278294eae14db9e2f2a01f1a5a23e7ebe9abbe4da7f7e68e885471b5c
                            • Instruction ID: 9bdd244d0dfb8e2508d5d561569e8caf98d718ec7861b09e325e5d9104724437
                            • Opcode Fuzzy Hash: 2df282f278294eae14db9e2f2a01f1a5a23e7ebe9abbe4da7f7e68e885471b5c
                            • Instruction Fuzzy Hash: ACC09B3D280304DFF2155B80BC5AF107754A349F00F54C102F609555E3C7A51471D658
                            Function 006CD8DD Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                            Download Yara Rule
                            APIs
                            • GetTempPathW.KERNELBASE(00000104,?), ref: 006CD8E9
                              • Part of subcall function 006733A7: _wcslen.LIBCMT ref: 006733AB
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: PathTemp_wcslen
                            • String ID:
                            • API String ID: 1974555822-0
                            • Opcode ID: 1f6022c7af24e2d77921340b9dc7757ce1033aaeff9c46fa29fc026563637631
                            • Instruction ID: 5b855ebc48eef3013a81f08d457850bd30b5013d9123b75ca653484ac8491149
                            • Opcode Fuzzy Hash: 1f6022c7af24e2d77921340b9dc7757ce1033aaeff9c46fa29fc026563637631
                            • Instruction Fuzzy Hash: D9C04C7450105A9BDB90A790CCC9BB97325FF00311F108199F20955050DE745A459B15
                            Function 0068FC70 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AllocVirtual
                            • String ID:
                            • API String ID: 4275171209-0
                            • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                            • Instruction ID: 9840189e012dc99d58bda68995acba191386e0082b9c731921e2b499504663ae
                            • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                            • Instruction Fuzzy Hash: 8831D275A001099BC718EF59D4809AAFBA6FF59300B2487A5E909CF756D731EEC1CBC0
                            Function 00CA22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                            Download Yara Rule
                            APIs
                            • Sleep.KERNELBASE(000001F4), ref: 00CA22B1
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815495861.0000000000CA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00CA0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_ca0000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Sleep
                            • String ID:
                            • API String ID: 3472027048-0
                            • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                            • Instruction ID: 666a43e0ad64c0a52b0b2ede9bff182b41b27e458a93b88373a81b54defb8794
                            • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                            • Instruction Fuzzy Hash: 31E0E67494010EDFDB00EFB8D54969E7FB4EF04311F100261FD01D2280D6309D508A72

                            Non-executed Functions

                            Function 00709576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00689BB2
                            • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0070961A
                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0070965B
                            • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0070969F
                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007096C9
                            • SendMessageW.USER32 ref: 007096F2
                            • GetKeyState.USER32(00000011), ref: 0070978B
                            • GetKeyState.USER32(00000009), ref: 00709798
                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007097AE
                            • GetKeyState.USER32(00000010), ref: 007097B8
                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007097E9
                            • SendMessageW.USER32 ref: 00709810
                            • SendMessageW.USER32(?,00001030,?,00707E95), ref: 00709918
                            • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0070992E
                            • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00709941
                            • SetCapture.USER32(?), ref: 0070994A
                            • ClientToScreen.USER32(?,?), ref: 007099AF
                            • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007099BC
                            • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007099D6
                            • ReleaseCapture.USER32 ref: 007099E1
                            • GetCursorPos.USER32(?), ref: 00709A19
                            • ScreenToClient.USER32(?,?), ref: 00709A26
                            • SendMessageW.USER32(?,00001012,00000000,?), ref: 00709A80
                            • SendMessageW.USER32 ref: 00709AAE
                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00709AEB
                            • SendMessageW.USER32 ref: 00709B1A
                            • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00709B3B
                            • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00709B4A
                            • GetCursorPos.USER32(?), ref: 00709B68
                            • ScreenToClient.USER32(?,?), ref: 00709B75
                            • GetParent.USER32(?), ref: 00709B93
                            • SendMessageW.USER32(?,00001012,00000000,?), ref: 00709BFA
                            • SendMessageW.USER32 ref: 00709C2B
                            • ClientToScreen.USER32(?,?), ref: 00709C84
                            • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00709CB4
                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00709CDE
                            • SendMessageW.USER32 ref: 00709D01
                            • ClientToScreen.USER32(?,?), ref: 00709D4E
                            • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00709D82
                              • Part of subcall function 00689944: GetWindowLongW.USER32(?,000000EB), ref: 00689952
                            • GetWindowLongW.USER32(?,000000F0), ref: 00709E05
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                            • String ID: @GUI_DRAGID$F$p#t
                            • API String ID: 3429851547-3160486056
                            • Opcode ID: ec03324d2913195a9be5ee155c9fe968d73cebbaad2d9303f37a19e2d14c8dc3
                            • Instruction ID: f73439ee78c5c09bfa6f29cfaa4a4bea9eed7d8e61574fa83dfb0c8a019218b9
                            • Opcode Fuzzy Hash: ec03324d2913195a9be5ee155c9fe968d73cebbaad2d9303f37a19e2d14c8dc3
                            • Instruction Fuzzy Hash: 41428B35208240EFDB25DF24CC44AAABBE5FF49310F144B59F799872E2DB3AA850CB55
                            Function 00704873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 007048F3
                            • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00704908
                            • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00704927
                            • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0070494B
                            • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0070495C
                            • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0070497B
                            • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 007049AE
                            • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 007049D4
                            • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00704A0F
                            • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00704A56
                            • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00704A7E
                            • IsMenu.USER32(?), ref: 00704A97
                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00704AF2
                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00704B20
                            • GetWindowLongW.USER32(?,000000F0), ref: 00704B94
                            • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00704BE3
                            • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00704C82
                            • wsprintfW.USER32 ref: 00704CAE
                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00704CC9
                            • GetWindowTextW.USER32(?,00000000,00000001), ref: 00704CF1
                            • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00704D13
                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00704D33
                            • GetWindowTextW.USER32(?,00000000,00000001), ref: 00704D5A
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                            • String ID: %d/%02d/%02d
                            • API String ID: 4054740463-328681919
                            • Opcode ID: bf86ab066637cbdc7f639cb864437a27da72b3bc14872ac05c81cd75d274e853
                            • Instruction ID: acc8a79115f567b7d5dada888a52d118fec3c9e5280d4376cd32e1a22de2aa72
                            • Opcode Fuzzy Hash: bf86ab066637cbdc7f639cb864437a27da72b3bc14872ac05c81cd75d274e853
                            • Instruction Fuzzy Hash: 8812EEB1600205EBEB259F24CC49FAE7BF8FB85310F148369F615DA2E1DB78A941CB54
                            Function 0068F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                            Download Yara Rule
                            APIs
                            • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0068F998
                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006CF474
                            • IsIconic.USER32(00000000), ref: 006CF47D
                            • ShowWindow.USER32(00000000,00000009), ref: 006CF48A
                            • SetForegroundWindow.USER32(00000000), ref: 006CF494
                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006CF4AA
                            • GetCurrentThreadId.KERNEL32 ref: 006CF4B1
                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006CF4BD
                            • AttachThreadInput.USER32(?,00000000,00000001), ref: 006CF4CE
                            • AttachThreadInput.USER32(?,00000000,00000001), ref: 006CF4D6
                            • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 006CF4DE
                            • SetForegroundWindow.USER32(00000000), ref: 006CF4E1
                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 006CF4F6
                            • keybd_event.USER32(00000012,00000000), ref: 006CF501
                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 006CF50B
                            • keybd_event.USER32(00000012,00000000), ref: 006CF510
                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 006CF519
                            • keybd_event.USER32(00000012,00000000), ref: 006CF51E
                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 006CF528
                            • keybd_event.USER32(00000012,00000000), ref: 006CF52D
                            • SetForegroundWindow.USER32(00000000), ref: 006CF530
                            • AttachThreadInput.USER32(?,000000FF,00000000), ref: 006CF557
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                            • String ID: Shell_TrayWnd
                            • API String ID: 4125248594-2988720461
                            • Opcode ID: cef900857a7f2b279a305b14f7dfc7c6ee1a8550b4d087e283c04e37c0d5ae51
                            • Instruction ID: 2dc0414f0b66de784ba09ca6eb3d06c1d99f535678babd13276d6ba2b1a152ca
                            • Opcode Fuzzy Hash: cef900857a7f2b279a305b14f7dfc7c6ee1a8550b4d087e283c04e37c0d5ae51
                            • Instruction Fuzzy Hash: 7731A671A40218BFEB216BB54C4AFBF7E6EEB44B50F104269F700E61D1CBB55D10AA64
                            Function 006D1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006D170D
                              • Part of subcall function 006D16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006D173A
                              • Part of subcall function 006D16C3: GetLastError.KERNEL32 ref: 006D174A
                            • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 006D1286
                            • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 006D12A8
                            • CloseHandle.KERNEL32(?), ref: 006D12B9
                            • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 006D12D1
                            • GetProcessWindowStation.USER32 ref: 006D12EA
                            • SetProcessWindowStation.USER32(00000000), ref: 006D12F4
                            • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 006D1310
                              • Part of subcall function 006D10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006D11FC), ref: 006D10D4
                              • Part of subcall function 006D10BF: CloseHandle.KERNEL32(?,?,006D11FC), ref: 006D10E9
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                            • String ID: $default$winsta0$Zs
                            • API String ID: 22674027-986068762
                            • Opcode ID: 3eb593653d3990fcd3a431e1e63e11cef61858759b722e9b41d3f2add2c4863c
                            • Instruction ID: f219f42f4d34c3a8b39c8133f37a612f2dfa35a7bffe274c16666085f9821345
                            • Opcode Fuzzy Hash: 3eb593653d3990fcd3a431e1e63e11cef61858759b722e9b41d3f2add2c4863c
                            • Instruction Fuzzy Hash: 2E817171D00209BBDF219FA4DC49FEE7BBAEF09704F14821AF910AA390DBB58945CB55
                            Function 006D0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006D1114
                              • Part of subcall function 006D10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1120
                              • Part of subcall function 006D10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D112F
                              • Part of subcall function 006D10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1136
                              • Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006D114D
                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006D0BCC
                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006D0C00
                            • GetLengthSid.ADVAPI32(?), ref: 006D0C17
                            • GetAce.ADVAPI32(?,00000000,?), ref: 006D0C51
                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006D0C6D
                            • GetLengthSid.ADVAPI32(?), ref: 006D0C84
                            • GetProcessHeap.KERNEL32(00000008,00000008), ref: 006D0C8C
                            • HeapAlloc.KERNEL32(00000000), ref: 006D0C93
                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 006D0CB4
                            • CopySid.ADVAPI32(00000000), ref: 006D0CBB
                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006D0CEA
                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006D0D0C
                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 006D0D1E
                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0D45
                            • HeapFree.KERNEL32(00000000), ref: 006D0D4C
                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0D55
                            • HeapFree.KERNEL32(00000000), ref: 006D0D5C
                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0D65
                            • HeapFree.KERNEL32(00000000), ref: 006D0D6C
                            • GetProcessHeap.KERNEL32(00000000,?), ref: 006D0D78
                            • HeapFree.KERNEL32(00000000), ref: 006D0D7F
                              • Part of subcall function 006D1193: GetProcessHeap.KERNEL32(00000008,006D0BB1,?,00000000,?,006D0BB1,?), ref: 006D11A1
                              • Part of subcall function 006D1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,006D0BB1,?), ref: 006D11A8
                              • Part of subcall function 006D1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,006D0BB1,?), ref: 006D11B7
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                            • String ID:
                            • API String ID: 4175595110-0
                            • Opcode ID: 0ab7fe832cd93dc548d1867e6f9bcd8c81369f66bab68225ad1f93d996106a21
                            • Instruction ID: b2ecc0855f7fea8e89ec2fb1f42fa57b029de25a30640d8e6bb27295bff30d4f
                            • Opcode Fuzzy Hash: 0ab7fe832cd93dc548d1867e6f9bcd8c81369f66bab68225ad1f93d996106a21
                            • Instruction Fuzzy Hash: E9715C71D0020AEFEF11DFA4DC45BEEBBBABF09300F148616E914A7291DB75A905CB60
                            Function 006EEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                            Download Yara Rule
                            APIs
                            • OpenClipboard.USER32(0070CC08), ref: 006EEB29
                            • IsClipboardFormatAvailable.USER32(0000000D), ref: 006EEB37
                            • GetClipboardData.USER32(0000000D), ref: 006EEB43
                            • CloseClipboard.USER32 ref: 006EEB4F
                            • GlobalLock.KERNEL32(00000000), ref: 006EEB87
                            • CloseClipboard.USER32 ref: 006EEB91
                            • GlobalUnlock.KERNEL32(00000000,00000000), ref: 006EEBBC
                            • IsClipboardFormatAvailable.USER32(00000001), ref: 006EEBC9
                            • GetClipboardData.USER32(00000001), ref: 006EEBD1
                            • GlobalLock.KERNEL32(00000000), ref: 006EEBE2
                            • GlobalUnlock.KERNEL32(00000000,?), ref: 006EEC22
                            • IsClipboardFormatAvailable.USER32(0000000F), ref: 006EEC38
                            • GetClipboardData.USER32(0000000F), ref: 006EEC44
                            • GlobalLock.KERNEL32(00000000), ref: 006EEC55
                            • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 006EEC77
                            • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 006EEC94
                            • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 006EECD2
                            • GlobalUnlock.KERNEL32(00000000,?,?), ref: 006EECF3
                            • CountClipboardFormats.USER32 ref: 006EED14
                            • CloseClipboard.USER32 ref: 006EED59
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                            • String ID:
                            • API String ID: 420908878-0
                            • Opcode ID: 4e828392334873367c1d4b9e7861196ed1fdf1b1f286311f64158f8605f97f30
                            • Instruction ID: 6cc427d6ed7f16289f307b35c373bef45b39d6bb25d64db547404e24c9b901ee
                            • Opcode Fuzzy Hash: 4e828392334873367c1d4b9e7861196ed1fdf1b1f286311f64158f8605f97f30
                            • Instruction Fuzzy Hash: 7B61DD34204341DFD311EF21D889F6A77A6AF84714F14861DF45A872A2DF36DD0ACBA6
                            Function 006E698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                            Download Yara Rule
                            APIs
                            • FindFirstFileW.KERNEL32(?,?), ref: 006E69BE
                            • FindClose.KERNEL32(00000000), ref: 006E6A12
                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006E6A4E
                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006E6A75
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 006E6AB2
                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 006E6ADF
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                            • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                            • API String ID: 3830820486-3289030164
                            • Opcode ID: c3e6893cee5abff96ba8b7ad19467c8bf51b3620ab86106e7d82c05e9c93b6e4
                            • Instruction ID: f3a18b76fe98396fd46addc9ce5f8f3f5dd8fcc953bcd0aef9af82756e295b80
                            • Opcode Fuzzy Hash: c3e6893cee5abff96ba8b7ad19467c8bf51b3620ab86106e7d82c05e9c93b6e4
                            • Instruction Fuzzy Hash: 50D150B1508340AFC754EBA5C882EABB7EDAF98704F04891DF589C7191EB74DA44CB62
                            Function 006E9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                            Download Yara Rule
                            APIs
                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 006E9663
                            • GetFileAttributesW.KERNEL32(?), ref: 006E96A1
                            • SetFileAttributesW.KERNEL32(?,?), ref: 006E96BB
                            • FindNextFileW.KERNEL32(00000000,?), ref: 006E96D3
                            • FindClose.KERNEL32(00000000), ref: 006E96DE
                            • FindFirstFileW.KERNEL32(*.*,?), ref: 006E96FA
                            • SetCurrentDirectoryW.KERNEL32(?), ref: 006E974A
                            • SetCurrentDirectoryW.KERNEL32(00736B7C), ref: 006E9768
                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 006E9772
                            • FindClose.KERNEL32(00000000), ref: 006E977F
                            • FindClose.KERNEL32(00000000), ref: 006E978F
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                            • String ID: *.*
                            • API String ID: 1409584000-438819550
                            • Opcode ID: 17bf6a21cc5282a22df4258f80839232f908f148523922722541f8ecbaeee65e
                            • Instruction ID: 20c67d96976b2a51269e4b700879c4ae0df5f8c58450c7c828a8de8689165e44
                            • Opcode Fuzzy Hash: 17bf6a21cc5282a22df4258f80839232f908f148523922722541f8ecbaeee65e
                            • Instruction Fuzzy Hash: 9331F672501359BAEF15AFB5DC08ADE77ADAF09320F108256F805E2191DB34DE44CE24
                            Function 006E979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                            Download Yara Rule
                            APIs
                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 006E97BE
                            • FindNextFileW.KERNEL32(00000000,?), ref: 006E9819
                            • FindClose.KERNEL32(00000000), ref: 006E9824
                            • FindFirstFileW.KERNEL32(*.*,?), ref: 006E9840
                            • SetCurrentDirectoryW.KERNEL32(?), ref: 006E9890
                            • SetCurrentDirectoryW.KERNEL32(00736B7C), ref: 006E98AE
                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 006E98B8
                            • FindClose.KERNEL32(00000000), ref: 006E98C5
                            • FindClose.KERNEL32(00000000), ref: 006E98D5
                              • Part of subcall function 006DDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 006DDB00
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                            • String ID: *.*
                            • API String ID: 2640511053-438819550
                            • Opcode ID: 770e4fd63fe0b4178ddcfc7af3dd4b08ca75fef4f521bcaa5b7640e8e1f27638
                            • Instruction ID: 22bd66f457236c5d471d2bb3ea4c4f5a1e2ca489a5f37fdda9f8d23264bc1782
                            • Opcode Fuzzy Hash: 770e4fd63fe0b4178ddcfc7af3dd4b08ca75fef4f521bcaa5b7640e8e1f27638
                            • Instruction Fuzzy Hash: 5531C371501359AAEF21AFB5DC48ADF77AEAF06320F248655E810E22E1DB34DE458F34
                            Function 006E8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                            Download Yara Rule
                            APIs
                            • GetLocalTime.KERNEL32(?), ref: 006E8257
                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 006E8267
                            • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 006E8273
                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 006E8310
                            • SetCurrentDirectoryW.KERNEL32(?), ref: 006E8324
                            • SetCurrentDirectoryW.KERNEL32(?), ref: 006E8356
                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 006E838C
                            • SetCurrentDirectoryW.KERNEL32(?), ref: 006E8395
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CurrentDirectoryTime$File$Local$System
                            • String ID: *.*
                            • API String ID: 1464919966-438819550
                            • Opcode ID: 8b8de0d4136bbafba370b92f13ddcedf7fdb087948877f7ac7b0fa76c5a5177c
                            • Instruction ID: b853d72387f06cd189d779f5f7453ed9a5d1df8741c063e7a422ef5aad83057c
                            • Opcode Fuzzy Hash: 8b8de0d4136bbafba370b92f13ddcedf7fdb087948877f7ac7b0fa76c5a5177c
                            • Instruction Fuzzy Hash: DD6199B25043459FDB10EF60C8409AEB3EAFF89310F04892EF989D7251EB35E905CB96
                            Function 006DD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00673AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00673A97,?,?,00672E7F,?,?,?,00000000), ref: 00673AC2
                              • Part of subcall function 006DE199: GetFileAttributesW.KERNEL32(?,006DCF95), ref: 006DE19A
                            • FindFirstFileW.KERNEL32(?,?), ref: 006DD122
                            • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 006DD1DD
                            • MoveFileW.KERNEL32(?,?), ref: 006DD1F0
                            • DeleteFileW.KERNEL32(?,?,?,?), ref: 006DD20D
                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 006DD237
                              • Part of subcall function 006DD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,006DD21C,?,?), ref: 006DD2B2
                            • FindClose.KERNEL32(00000000,?,?,?), ref: 006DD253
                            • FindClose.KERNEL32(00000000), ref: 006DD264
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                            • String ID: \*.*
                            • API String ID: 1946585618-1173974218
                            • Opcode ID: 9ac93b43181e29678f660f07cf6d137a5daa746533b5fefab539dde9b255c8b0
                            • Instruction ID: e9f529fbbcb7fb5352d1757a68ebdcf21c579e83b4af8d7e12c1cfe4c1b65562
                            • Opcode Fuzzy Hash: 9ac93b43181e29678f660f07cf6d137a5daa746533b5fefab539dde9b255c8b0
                            • Instruction Fuzzy Hash: 12616B31C0110DAACF45FBE0CD929EDB7B6AF55300F20816AE50677292EB316F09DB65
                            Function 006EED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                            • String ID:
                            • API String ID: 1737998785-0
                            • Opcode ID: 136a5ebdae6fa69646af7d0fa64bc2c21e102aae9d458688fda8cd0cd11fdfba
                            • Instruction ID: cddb172760195b49120c1a2467fe503b62a1a082c5ed0a8eb6b3cb8507732c5e
                            • Opcode Fuzzy Hash: 136a5ebdae6fa69646af7d0fa64bc2c21e102aae9d458688fda8cd0cd11fdfba
                            • Instruction Fuzzy Hash: 1C41AE35605651DFD321DF16D888B59BBE2AF44328F14C19DE4198B762CB3AEC42CB94
                            Function 006DE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006D170D
                              • Part of subcall function 006D16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006D173A
                              • Part of subcall function 006D16C3: GetLastError.KERNEL32 ref: 006D174A
                            • ExitWindowsEx.USER32(?,00000000), ref: 006DE932
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                            • String ID: $ $@$SeShutdownPrivilege
                            • API String ID: 2234035333-3163812486
                            • Opcode ID: 1aca90c1b1e47b4b57c182915b0e0c4f023caee6c1eebb8a295e37c8b27c2b79
                            • Instruction ID: 5562bd69912778cf7366de2ab0df999eddd90f450109cb4fb003810c2ef300f6
                            • Opcode Fuzzy Hash: 1aca90c1b1e47b4b57c182915b0e0c4f023caee6c1eebb8a295e37c8b27c2b79
                            • Instruction Fuzzy Hash: C4012672E11211BBEB6433B49C96BFF725EA714751F144A27F802EE3D2D9A65C4081D8
                            Function 006F1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                            Download Yara Rule
                            APIs
                            • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 006F1276
                            • WSAGetLastError.WSOCK32 ref: 006F1283
                            • bind.WSOCK32(00000000,?,00000010), ref: 006F12BA
                            • WSAGetLastError.WSOCK32 ref: 006F12C5
                            • closesocket.WSOCK32(00000000), ref: 006F12F4
                            • listen.WSOCK32(00000000,00000005), ref: 006F1303
                            • WSAGetLastError.WSOCK32 ref: 006F130D
                            • closesocket.WSOCK32(00000000), ref: 006F133C
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLast$closesocket$bindlistensocket
                            • String ID:
                            • API String ID: 540024437-0
                            • Opcode ID: a6658d01a6af8b077fc057d2a55ab530ca441f8ac4169ff3692543f33035e2a7
                            • Instruction ID: 3d55cfb0f8244361cff729ddf5695f704b3d066c55ce5bd5e05f3a0915c084f8
                            • Opcode Fuzzy Hash: a6658d01a6af8b077fc057d2a55ab530ca441f8ac4169ff3692543f33035e2a7
                            • Instruction Fuzzy Hash: DE418E31600104DFD710DF68C488B69BBE6AF86358F18C288E9568F3D6C775ED82CBA1
                            Function 006DD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00673AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00673A97,?,?,00672E7F,?,?,?,00000000), ref: 00673AC2
                              • Part of subcall function 006DE199: GetFileAttributesW.KERNEL32(?,006DCF95), ref: 006DE19A
                            • FindFirstFileW.KERNEL32(?,?), ref: 006DD420
                            • DeleteFileW.KERNEL32(?,?,?,?), ref: 006DD470
                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 006DD481
                            • FindClose.KERNEL32(00000000), ref: 006DD498
                            • FindClose.KERNEL32(00000000), ref: 006DD4A1
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                            • String ID: \*.*
                            • API String ID: 2649000838-1173974218
                            • Opcode ID: cb39b012187ff99155685d01939049f6067920b9c86065e0aa3f5c0e3d894c18
                            • Instruction ID: 24791777c7ffc95319ea8e0d775872d117a8ed6c902c85c5392d792c7a2ce394
                            • Opcode Fuzzy Hash: cb39b012187ff99155685d01939049f6067920b9c86065e0aa3f5c0e3d894c18
                            • Instruction Fuzzy Hash: AB31A2314183459BC305FF60C8528AFB7E9BE91314F408E1EF4D593291EB30AA09C767
                            Function 006AE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: __floor_pentium4
                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                            • API String ID: 4168288129-2761157908
                            • Opcode ID: f7c9018dbdbc54740ff5642e56ba9fcb6258ccce58bf01fd4c1282e482846d3e
                            • Instruction ID: 10b98cb7c29874ad2b9a587640f1c2cd3644f299ab2ed589c17f7062b66805ce
                            • Opcode Fuzzy Hash: f7c9018dbdbc54740ff5642e56ba9fcb6258ccce58bf01fd4c1282e482846d3e
                            • Instruction Fuzzy Hash: F7C26C71E046288FDB25EF68DD407EAB7B6EB4A304F1441EAD40DE7241E779AE818F41
                            Function 006E648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                            Download Yara Rule
                            APIs
                            • _wcslen.LIBCMT ref: 006E64DC
                            • CoInitialize.OLE32(00000000), ref: 006E6639
                            • CoCreateInstance.OLE32(0070FCF8,00000000,00000001,0070FB68,?), ref: 006E6650
                            • CoUninitialize.OLE32 ref: 006E68D4
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateInitializeInstanceUninitialize_wcslen
                            • String ID: .lnk
                            • API String ID: 886957087-24824748
                            • Opcode ID: 0d78561c0554aa8a13dcc62a6d90bf5bb4e351502f9d612757999b94dfa591dc
                            • Instruction ID: fed576bfd9cbd975b43de1f6c6e79af97ef63fea6e5ff102e723cee70b5b728a
                            • Opcode Fuzzy Hash: 0d78561c0554aa8a13dcc62a6d90bf5bb4e351502f9d612757999b94dfa591dc
                            • Instruction Fuzzy Hash: B4D14A71608341AFC354DF24C881D6BB7EAFF94344F00896DF5998B2A1EB70E905CBA6
                            Function 006F22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                            Download Yara Rule
                            APIs
                            • GetForegroundWindow.USER32(?,?,00000000), ref: 006F22E8
                              • Part of subcall function 006EE4EC: GetWindowRect.USER32(?,?), ref: 006EE504
                            • GetDesktopWindow.USER32 ref: 006F2312
                            • GetWindowRect.USER32(00000000), ref: 006F2319
                            • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 006F2355
                            • GetCursorPos.USER32(?), ref: 006F2381
                            • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006F23DF
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Rectmouse_event$CursorDesktopForeground
                            • String ID:
                            • API String ID: 2387181109-0
                            • Opcode ID: 0cc57a22fd8f21895618049e74d37942d6e4808d21f4edc464790fe62ab78141
                            • Instruction ID: 8deb49fdbc37799ae53a44d2f186a2d12077973a595391fe23ecf8aa4e25621f
                            • Opcode Fuzzy Hash: 0cc57a22fd8f21895618049e74d37942d6e4808d21f4edc464790fe62ab78141
                            • Instruction Fuzzy Hash: F431D2B250531A9FC721DF14C845FABBBAAFF84314F000A1DF5859B291DB75E908CB95
                            Function 006E9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 006E9B78
                            • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 006E9C8B
                              • Part of subcall function 006E3874: GetInputState.USER32 ref: 006E38CB
                              • Part of subcall function 006E3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006E3966
                            • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 006E9BA8
                            • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 006E9C75
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                            • String ID: *.*
                            • API String ID: 1972594611-438819550
                            • Opcode ID: 39b1699db6ae18837ae7c40ce1dea7ff02bb914a83ffe615d2792dfebc3a08e8
                            • Instruction ID: eeeb063f53ac07b99c96f0261408bce4bd4238404140a650bc9d1c167257b33c
                            • Opcode Fuzzy Hash: 39b1699db6ae18837ae7c40ce1dea7ff02bb914a83ffe615d2792dfebc3a08e8
                            • Instruction Fuzzy Hash: DB419371901249AFDF55EF65C845AEEBBFAEF05710F208159E405A3291EB309E84CF64
                            Function 0068997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00689BB2
                            • DefDlgProcW.USER32(?,?,?,?,?), ref: 00689A4E
                            • GetSysColor.USER32(0000000F), ref: 00689B23
                            • SetBkColor.GDI32(?,00000000), ref: 00689B36
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Color$LongProcWindow
                            • String ID:
                            • API String ID: 3131106179-0
                            • Opcode ID: 7c4b9c2b492edfe163904c8f6e15f0956cba7603c6b5d2f6c1b5292e8416aabf
                            • Instruction ID: 849fa6ebcf95dd1eddf0c0323367ef2450a02327bb6b7b48874c10d218a443cd
                            • Opcode Fuzzy Hash: 7c4b9c2b492edfe163904c8f6e15f0956cba7603c6b5d2f6c1b5292e8416aabf
                            • Instruction Fuzzy Hash: 14A10870208444FEE72DBA2D8C59EBB269FEB42350B18430DF502D6BD2CA299D42DB75
                            Function 006F1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006F304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 006F307A
                              • Part of subcall function 006F304E: _wcslen.LIBCMT ref: 006F309B
                            • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 006F185D
                            • WSAGetLastError.WSOCK32 ref: 006F1884
                            • bind.WSOCK32(00000000,?,00000010), ref: 006F18DB
                            • WSAGetLastError.WSOCK32 ref: 006F18E6
                            • closesocket.WSOCK32(00000000), ref: 006F1915
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                            • String ID:
                            • API String ID: 1601658205-0
                            • Opcode ID: 3a73c0d1f3f9ca6659d79063574a66a9869fc4bc82e35f128bc2cab418012b75
                            • Instruction ID: 1576cd9913819ef752b4d1f4778e1a4e250d51e194e23c64c4b95dd89af1c5b8
                            • Opcode Fuzzy Hash: 3a73c0d1f3f9ca6659d79063574a66a9869fc4bc82e35f128bc2cab418012b75
                            • Instruction Fuzzy Hash: 0E51E271A00200AFEB50AF24C886F7A77E6AB45758F04C55CFA1A5F3C3CB75AD418BA5
                            Function 00701C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$EnabledForegroundIconicVisibleZoomed
                            • String ID:
                            • API String ID: 292994002-0
                            • Opcode ID: b9d8ba05ff30f62eb1a539c9b3568cb0134913e539c673a72b9064ce4deb85f2
                            • Instruction ID: da8419712f0c3f54af8432e90d41146b280fde2b7da59fefe4e45d5e1d503c99
                            • Opcode Fuzzy Hash: b9d8ba05ff30f62eb1a539c9b3568cb0134913e539c673a72b9064ce4deb85f2
                            • Instruction Fuzzy Hash: 09219431740211DFE7218F2AC884B5B7BE5AF85324F59825CE8468B391DB79DC42CBA4
                            Function 00678060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                            • API String ID: 0-1546025612
                            • Opcode ID: f2196a70a0cdd221ab29ea0aeb651d65c63b4fed6ee129ab56fd7a3a01620663
                            • Instruction ID: 38ebf0cc22cf6e9fdb2dce523df1a7c834876fe5191706fab05b717d9fb44a9d
                            • Opcode Fuzzy Hash: f2196a70a0cdd221ab29ea0aeb651d65c63b4fed6ee129ab56fd7a3a01620663
                            • Instruction Fuzzy Hash: 83A24BB1A4061ACFDF24CF58C9447EDB7B3BB54314F2481A9E81AA7385DB749EC18B90
                            Function 006D8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON
                            Download Yara Rule
                            APIs
                            • lstrlenW.KERNEL32(?,?,?,00000000), ref: 006D82AA
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: lstrlen
                            • String ID: ($tbs$|
                            • API String ID: 1659193697-2660408474
                            • Opcode ID: bdf44701402c1fcca45a4d74633b12be15caa4effc2337084d7462104d256228
                            • Instruction ID: e9873711f6f4e30f295321e42ded264d2b1c84f4b251ba7e683acc0911f62ad1
                            • Opcode Fuzzy Hash: bdf44701402c1fcca45a4d74633b12be15caa4effc2337084d7462104d256228
                            • Instruction Fuzzy Hash: 7E322474A007059FCB28CF59C485AAAB7F1FF48720B15C56EE49ADB3A1EB70E941CB44
                            Function 006FA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                            Download Yara Rule
                            APIs
                            • CreateToolhelp32Snapshot.KERNEL32 ref: 006FA6AC
                            • Process32FirstW.KERNEL32(00000000,?), ref: 006FA6BA
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • Process32NextW.KERNEL32(00000000,?), ref: 006FA79C
                            • CloseHandle.KERNEL32(00000000), ref: 006FA7AB
                              • Part of subcall function 0068CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,006B3303,?), ref: 0068CE8A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                            • String ID:
                            • API String ID: 1991900642-0
                            • Opcode ID: fc476ad1b03cf88f1b9e19e0d6e3655df12c2ab686e4c430ec76c81b592feeab
                            • Instruction ID: 03de421cbff654618aac00a4950154a92d6ee3f14b90936e2ed32edf7a99da64
                            • Opcode Fuzzy Hash: fc476ad1b03cf88f1b9e19e0d6e3655df12c2ab686e4c430ec76c81b592feeab
                            • Instruction Fuzzy Hash: 48516EB15083009FD750EF24C886E6BBBE9FF89754F008A1DF59997252EB70D904CB96
                            Function 006DAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                            Download Yara Rule
                            APIs
                            • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 006DAAAC
                            • SetKeyboardState.USER32(00000080), ref: 006DAAC8
                            • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 006DAB36
                            • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 006DAB88
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: KeyboardState$InputMessagePostSend
                            • String ID:
                            • API String ID: 432972143-0
                            • Opcode ID: 1995eeea4ad40a99f5ae8413a17eb99e02871c66991037560c604fade7f72cf0
                            • Instruction ID: 58486ae467673966998d6f03328183cc9acf913d69c57ab4bef0b7e504b2ece3
                            • Opcode Fuzzy Hash: 1995eeea4ad40a99f5ae8413a17eb99e02871c66991037560c604fade7f72cf0
                            • Instruction Fuzzy Hash: 0731E730E48248AFFB358BA5CC05BFA7BA7AB45310F14431BF581963D1D7758982C766
                            Function 006ABB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                            Download Yara Rule
                            APIs
                            • _free.LIBCMT ref: 006ABB7F
                              • Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
                              • Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0
                            • GetTimeZoneInformation.KERNEL32 ref: 006ABB91
                            • WideCharToMultiByte.KERNEL32(00000000,?,0074121C,000000FF,?,0000003F,?,?), ref: 006ABC09
                            • WideCharToMultiByte.KERNEL32(00000000,?,00741270,000000FF,?,0000003F,?,?,?,0074121C,000000FF,?,0000003F,?,?), ref: 006ABC36
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                            • String ID:
                            • API String ID: 806657224-0
                            • Opcode ID: f3815ff91f7ef741057eb0e4555b7079335ded36f2bde2ad071e6b518124fc91
                            • Instruction ID: 8471b122e039c71fc29d8952c8cd48ef44994fe5c2e1ea3bc3647b0a0db14495
                            • Opcode Fuzzy Hash: f3815ff91f7ef741057eb0e4555b7079335ded36f2bde2ad071e6b518124fc91
                            • Instruction Fuzzy Hash: 3931C070A44205DFCB11FF69DC8086DBBB9BF47720B1492AAE011D72A2DB749D41CF64
                            Function 006ECE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                            Download Yara Rule
                            APIs
                            • InternetReadFile.WININET(?,?,00000400,?), ref: 006ECE89
                            • GetLastError.KERNEL32(?,00000000), ref: 006ECEEA
                            • SetEvent.KERNEL32(?,?,00000000), ref: 006ECEFE
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorEventFileInternetLastRead
                            • String ID:
                            • API String ID: 234945975-0
                            • Opcode ID: d4a200c16d2f921880ff3b9b3678fa6e5e6e81fe00143ca45ec36d72e8c4e953
                            • Instruction ID: beccdf7b0771cf83dae1778141de482a57092e864e234e7d8cfbb0764150f822
                            • Opcode Fuzzy Hash: d4a200c16d2f921880ff3b9b3678fa6e5e6e81fe00143ca45ec36d72e8c4e953
                            • Instruction Fuzzy Hash: 7221B0B1501305EFDB20DF66C945BAA77FEEF00324F10851EE54692251EB74ED069B54
                            Function 006E5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                            Download Yara Rule
                            APIs
                            • FindFirstFileW.KERNEL32(?,?), ref: 006E5CC1
                            • FindNextFileW.KERNEL32(00000000,?), ref: 006E5D17
                            • FindClose.KERNEL32(?), ref: 006E5D5F
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Find$File$CloseFirstNext
                            • String ID:
                            • API String ID: 3541575487-0
                            • Opcode ID: 29d9f551be091aacc47e763d08805da0ce375c6a07ecf59bd804f934c8501876
                            • Instruction ID: 01f369dbd617776453441e3792ef8d231b2a13272959ccd2234f6cebe810475c
                            • Opcode Fuzzy Hash: 29d9f551be091aacc47e763d08805da0ce375c6a07ecf59bd804f934c8501876
                            • Instruction Fuzzy Hash: A451BA34604B419FC704CF28C894A9AB7E5FF49328F14865DE95A8B3A2CB30ED05CF95
                            Function 006A2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • IsDebuggerPresent.KERNEL32 ref: 006A271A
                            • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006A2724
                            • UnhandledExceptionFilter.KERNEL32(?), ref: 006A2731
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                            • String ID:
                            • API String ID: 3906539128-0
                            • Opcode ID: d3348355d6e18502bbb5dd6322ce06f5e816aa6eafaa56b3b965b821f23820f8
                            • Instruction ID: d2b009685461924580e4b70c4c33b10c02de2a464d0e23a43245530dbcb9a5a6
                            • Opcode Fuzzy Hash: d3348355d6e18502bbb5dd6322ce06f5e816aa6eafaa56b3b965b821f23820f8
                            • Instruction Fuzzy Hash: 7F31D774951219ABCB61DF68DC887DCBBB9AF08310F5042DAE80CA7261E7349F818F49
                            Function 006E51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                            Download Yara Rule
                            APIs
                            • SetErrorMode.KERNEL32(00000001), ref: 006E51DA
                            • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 006E5238
                            • SetErrorMode.KERNEL32(00000000), ref: 006E52A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorMode$DiskFreeSpace
                            • String ID:
                            • API String ID: 1682464887-0
                            • Opcode ID: 9ea81d06aeeefc7403cfbb504ee987f737237546cd24e7f373bfb11163164737
                            • Instruction ID: 0f364f34a23409a382a79674e78f54d2ff343e8c67cc0e3b7b7e3e621861286c
                            • Opcode Fuzzy Hash: 9ea81d06aeeefc7403cfbb504ee987f737237546cd24e7f373bfb11163164737
                            • Instruction Fuzzy Hash: 16318175A00608DFDB00DF54D884EADBBF5FF49318F088099E9099B392CB35E945CB94
                            Function 006D16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 0068FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00690668
                              • Part of subcall function 0068FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00690685
                            • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006D170D
                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006D173A
                            • GetLastError.KERNEL32 ref: 006D174A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                            • String ID:
                            • API String ID: 577356006-0
                            • Opcode ID: 945e2aba69afe10af9e2c9f76423c1ac40e9c03c189959ccbf4969b5eeaec78e
                            • Instruction ID: 901ff2b4a00147bf0e894986316c313451e61d11619324c0806f005a7761f49d
                            • Opcode Fuzzy Hash: 945e2aba69afe10af9e2c9f76423c1ac40e9c03c189959ccbf4969b5eeaec78e
                            • Instruction Fuzzy Hash: 281191B2814304FFD728AF54DC86D6AB7BEEF45714B20862EE45657251EB70FC418B24
                            Function 006DD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                            Download Yara Rule
                            APIs
                            • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 006DD608
                            • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 006DD645
                            • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 006DD650
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CloseControlCreateDeviceFileHandle
                            • String ID:
                            • API String ID: 33631002-0
                            • Opcode ID: 174a0019e6b69f8a491b7e6e6f0c9d5d4dd787377cf3c4a67f09a06c26004bd5
                            • Instruction ID: cd0c6f456e9e0cb191867f646fa1e1fb1ece7a8943de78b0fb7741584d07a6c6
                            • Opcode Fuzzy Hash: 174a0019e6b69f8a491b7e6e6f0c9d5d4dd787377cf3c4a67f09a06c26004bd5
                            • Instruction Fuzzy Hash: B3117C71E01228BBDB108F949C44FAFBBBCEB45B50F108252F904E7290D6704A018BE1
                            Function 006D1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                            Download Yara Rule
                            APIs
                            • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 006D168C
                            • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006D16A1
                            • FreeSid.ADVAPI32(?), ref: 006D16B1
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AllocateCheckFreeInitializeMembershipToken
                            • String ID:
                            • API String ID: 3429775523-0
                            • Opcode ID: daad593da668e68418c9e35de6ab4f7bdd38a1a66766d9f5df7f30488e8198af
                            • Instruction ID: 17bfc7f825cb7c6243d9534415fe044ec6d0eb72a0690e8c13bd19921f51aa8b
                            • Opcode Fuzzy Hash: daad593da668e68418c9e35de6ab4f7bdd38a1a66766d9f5df7f30488e8198af
                            • Instruction Fuzzy Hash: C1F0F471950309FBEB00DFE49D89AAEBBBDEB08604F508665E601E2181E774AA448A54
                            Function 00694CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetCurrentProcess.KERNEL32(006A28E9,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002,00000000,?,006A28E9), ref: 00694D09
                            • TerminateProcess.KERNEL32(00000000,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002,00000000,?,006A28E9), ref: 00694D10
                            • ExitProcess.KERNEL32 ref: 00694D22
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$CurrentExitTerminate
                            • String ID:
                            • API String ID: 1703294689-0
                            • Opcode ID: 81d29a6bec7a64e00d76646563cf800c31f5a1e426e4fe4410559c3f8be1d9f1
                            • Instruction ID: 93abf86b25240ad99dc6149780b89db51434a33b153d541173bdc78987ee916f
                            • Opcode Fuzzy Hash: 81d29a6bec7a64e00d76646563cf800c31f5a1e426e4fe4410559c3f8be1d9f1
                            • Instruction Fuzzy Hash: ACE0B635010148EBCF16AF54DD09E987B6EFF46785B108218FC058A622CF39DD46CA88
                            Function 006CD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                            Download Yara Rule
                            APIs
                            • GetUserNameW.ADVAPI32(?,?), ref: 006CD28C
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: NameUser
                            • String ID: X64
                            • API String ID: 2645101109-893830106
                            • Opcode ID: 8333d096d98187048731626b2ffcf5f083eaf4eba3e5bdeda648990237d3d822
                            • Instruction ID: 6c5b9659df5c06ee589bf171a83f080a7d45e13bd226e594cca04ace2cb1a11a
                            • Opcode Fuzzy Hash: 8333d096d98187048731626b2ffcf5f083eaf4eba3e5bdeda648990237d3d822
                            • Instruction Fuzzy Hash: 32D0C9B480111DEACB94DB90DC88DE9B37CFB04305F104355F106A2040DB34964A8F20
                            Function 0069CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                            • Instruction ID: ef17894b82aab676bba5a325d0665c010ce4505b213c050d981308eac1509cdd
                            • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                            • Instruction Fuzzy Hash: FF022C71E002199FDF14CFA9C8806EDBBF6EF48324F254169D819EB784D730AA41CB94
                            Function 006E68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                            Download Yara Rule
                            APIs
                            • FindFirstFileW.KERNEL32(?,?), ref: 006E6918
                            • FindClose.KERNEL32(00000000), ref: 006E6961
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Find$CloseFileFirst
                            • String ID:
                            • API String ID: 2295610775-0
                            • Opcode ID: 947c7f8642ad9866c01d330701340da41102521c1e6da6f487cfe699ed890afc
                            • Instruction ID: 1b9463302de2485d3907a102fffbfdd6c914e729aa7d7b7fde63a429195b95c5
                            • Opcode Fuzzy Hash: 947c7f8642ad9866c01d330701340da41102521c1e6da6f487cfe699ed890afc
                            • Instruction Fuzzy Hash: C2116A316042419FD710DF2AD484A1ABBE6AF85328F14C69DF4698B6A2CB34EC05CB91
                            Function 006E37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,006F4891,?,?,00000035,?), ref: 006E37E4
                            • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,006F4891,?,?,00000035,?), ref: 006E37F4
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorFormatLastMessage
                            • String ID:
                            • API String ID: 3479602957-0
                            • Opcode ID: a273be40b78ade414a479d7af3a9cb582a64237efa5b98839a041bbcd741c080
                            • Instruction ID: 841a68f8be6b43a45c35a8c1dd8d04264626ad3b85127f94749b657472215f5f
                            • Opcode Fuzzy Hash: a273be40b78ade414a479d7af3a9cb582a64237efa5b98839a041bbcd741c080
                            • Instruction Fuzzy Hash: D2F0E5B06053286AEB6117678C4DFEB7AAFEFC5761F004269F509D3281D9609944C7B4
                            Function 006DB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                            Download Yara Rule
                            APIs
                            • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 006DB25D
                            • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 006DB270
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: InputSendkeybd_event
                            • String ID:
                            • API String ID: 3536248340-0
                            • Opcode ID: f16b53f4834e38bb762124d329ed94b5624a7d2192897313c29e0cd199999b38
                            • Instruction ID: 3cc6a68b199da0e745ca464219dc43af8d6e9d5d1054a5db623073dbf490d5c8
                            • Opcode Fuzzy Hash: f16b53f4834e38bb762124d329ed94b5624a7d2192897313c29e0cd199999b38
                            • Instruction Fuzzy Hash: EAF01D7580424DEBDB059FA0C805BFE7BB4FF04305F10910AF955A5291C77986119F94
                            Function 006D10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                            Download Yara Rule
                            APIs
                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006D11FC), ref: 006D10D4
                            • CloseHandle.KERNEL32(?,?,006D11FC), ref: 006D10E9
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AdjustCloseHandlePrivilegesToken
                            • String ID:
                            • API String ID: 81990902-0
                            • Opcode ID: 3c2bafec0955855d3934ed9fde8c11a7bf6c762172acc7892bd1fa39a888c436
                            • Instruction ID: 46c20c320bde43a41f00bd585bb5258cbb47b8c40dd3fcf1a1b9cf8e938daa8d
                            • Opcode Fuzzy Hash: 3c2bafec0955855d3934ed9fde8c11a7bf6c762172acc7892bd1fa39a888c436
                            • Instruction Fuzzy Hash: 96E04F32014600FEE7262B11FC09E7377AAEF04310B10CA2EF5A5805B1DF626CA0DB14
                            Function 006A676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,006A6766,?,?,00000008,?,?,006AFEFE,00000000), ref: 006A6998
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ExceptionRaise
                            • String ID:
                            • API String ID: 3997070919-0
                            • Opcode ID: 6156ebac41bace9312e5be4c7ba5ec063e0e231092e7ab685d31402e8cdbe0a9
                            • Instruction ID: a3ca89041be8c11858654c7a76362106a3e7d4cef5c5d9f9e0c7f2ac6c431539
                            • Opcode Fuzzy Hash: 6156ebac41bace9312e5be4c7ba5ec063e0e231092e7ab685d31402e8cdbe0a9
                            • Instruction Fuzzy Hash: 2BB15C316106098FD715DF28C486BA57BA1FF06364F298658F99ACF2A2C335ED92CF40
                            Function 0068B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID: 0-3916222277
                            • Opcode ID: 0861548fc4884e8a698b3d0a22a660f25ba03ebfa5b899b735fc9bcde5ae1598
                            • Instruction ID: e69f43b6e120bdf9817a736dfeee9b3e4354293545ea1bd70e4222b4c2b54f61
                            • Opcode Fuzzy Hash: 0861548fc4884e8a698b3d0a22a660f25ba03ebfa5b899b735fc9bcde5ae1598
                            • Instruction Fuzzy Hash: D8123F719002299FCB64DF58C881BFEB7F6EF48710F14819AE849EB255DB749E81CB90
                            Function 006EEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                            Download Yara Rule
                            APIs
                            • BlockInput.USER32(00000001), ref: 006EEABD
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: BlockInput
                            • String ID:
                            • API String ID: 3456056419-0
                            • Opcode ID: fad790f1eedf0c97eec1df6c1d2801c7f9b7f122c009dbc64d81dec9eaf2fc94
                            • Instruction ID: 45ac511ce3d4a0d1413732f225b13d166eacafc852b1020274d23a73c4bd95a6
                            • Opcode Fuzzy Hash: fad790f1eedf0c97eec1df6c1d2801c7f9b7f122c009dbc64d81dec9eaf2fc94
                            • Instruction Fuzzy Hash: 36E01A312002049FD710EF6AD804E9AB7EAAF98764F00C42AFC49C7391DB75A8418B94
                            Function 006909D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                            Download Yara Rule
                            APIs
                            • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006903EE), ref: 006909DA
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ExceptionFilterUnhandled
                            • String ID:
                            • API String ID: 3192549508-0
                            • Opcode ID: fee48fc4bb3d385b3742698177ea594db40dbc20c562a15dca8d526a750de7de
                            • Instruction ID: d2c6353d11635bc6c6f2afbf2921a28eac48b3cf7e29d5e049570d608fc08f07
                            • Opcode Fuzzy Hash: fee48fc4bb3d385b3742698177ea594db40dbc20c562a15dca8d526a750de7de
                            • Instruction Fuzzy Hash:
                            Function 0069781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: 0
                            • API String ID: 0-4108050209
                            • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                            • Instruction ID: 600c706b53c8cec7f464b991d299d74476c2c35dfbbeff719d537747ed4a440a
                            • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                            • Instruction Fuzzy Hash: 3151577163C7055BDF3885688A5E7FE638FDB12344F18052AE886DBF82CA15DE02D35A
                            Function 006E2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: 0&t
                            • API String ID: 0-1335626371
                            • Opcode ID: 4657106a671a6def841a96fbbe330a846b32f089605168d712d58f073b94582e
                            • Instruction ID: 4ec33d8b717dd6125ef4a60a41261e9c190e7d244f0790750704d9f64913e49f
                            • Opcode Fuzzy Hash: 4657106a671a6def841a96fbbe330a846b32f089605168d712d58f073b94582e
                            • Instruction Fuzzy Hash: 7821BB326216158BD728CF79C82367E73EAA754310F55862EE4A7C37D1DE39A904C784
                            Function 006A6DD9 Relevance: .6, Instructions: 637COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3fbda54e2d29ed2c1884433e812c8764dc29c0a0602ae28f83afedd32b6f4fce
                            • Instruction ID: 5b6a5d6654ec4945f997715164e40fccf062fc6d88736be5ee3fca1c2b66cce0
                            • Opcode Fuzzy Hash: 3fbda54e2d29ed2c1884433e812c8764dc29c0a0602ae28f83afedd32b6f4fce
                            • Instruction Fuzzy Hash: CE325921D29F014DD723A638DC26375A68AAFB73C5F15D737F816B5AA6EF28C8834500
                            Function 0068CC39 Relevance: .6, Instructions: 635COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 4fc2448083a78cc00330a842726dacf61094dd738fd114faff188bb2f699d05f
                            • Instruction ID: 60a55a3ee363cf6663528ece8625731bc0976a63cfbf76cf9513c98cac361142
                            • Opcode Fuzzy Hash: 4fc2448083a78cc00330a842726dacf61094dd738fd114faff188bb2f699d05f
                            • Instruction Fuzzy Hash: 4532E232A001558BDF28DB69C494FBD7BA3EB45330F28866ED44E9B391D234DD82DB61
                            Function 00677920 Relevance: .6, Instructions: 563COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 45628cb8e898bf6e8c365f01f2e64003a8a21ad05863b811eb0a3617ebc67241
                            • Instruction ID: d3f57010b662a4be628a147a0843fd6e7c937cc9414a0d9e0e713b0e991656e5
                            • Opcode Fuzzy Hash: 45628cb8e898bf6e8c365f01f2e64003a8a21ad05863b811eb0a3617ebc67241
                            • Instruction Fuzzy Hash: 08228EB0A0460ADFDF14DF64C881AEEB7F6FF48300F148629E816A7391EB359955CB54
                            Function 006791C0 Relevance: .5, Instructions: 475COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3c1ba36e110e865571af31114ee82082a9841a35321a7dca9f7f3097c7585a0c
                            • Instruction ID: a3c890dde3c21c41461adf0e3ccecc95703a6402574fe2987d90f492986be7b9
                            • Opcode Fuzzy Hash: 3c1ba36e110e865571af31114ee82082a9841a35321a7dca9f7f3097c7585a0c
                            • Instruction Fuzzy Hash: E902A5B1E00109EBDF14DF64D881AEDB7B6FF44300F118169E81A9B391EB35AE51CB95
                            Function 00691C77 Relevance: .3, Instructions: 254COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                            • Instruction ID: a52cfb231aa27ea4c209388ee7e5182872beaf421288c2eba11ff32aae04676e
                            • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                            • Instruction Fuzzy Hash: 109188726080A34ADF2D463A853407DFFE65E533B132A079ED4F2CEAC5EE24C559D620
                            Function 006919B0 Relevance: .2, Instructions: 240COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                            • Instruction ID: 30acc038b4d9680d7fc67dbd61ba7563b6961a83360091eb32513305232dfdf5
                            • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                            • Instruction Fuzzy Hash: FF9164722090A34ADF29427A857407DFFEB5A933B232A079ED4F2CEAC5FD1489559620
                            Function 00697A4A Relevance: .2, Instructions: 237COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: dcf119e018fb6a221f6d94768c3021512bc0ee05773571fca7f8348e6f58aff4
                            • Instruction ID: b3ae5705654a454ec745c634d1ed06598ddf214b30b1f92e97f8ae441431c2ee
                            • Opcode Fuzzy Hash: dcf119e018fb6a221f6d94768c3021512bc0ee05773571fca7f8348e6f58aff4
                            • Instruction Fuzzy Hash: 186199312383099ADE389E2C8C91BFE238FDF51710F14091EE842DBF85D611AE42C359
                            Function 00697CA7 Relevance: .2, Instructions: 237COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 5066f3db103f61d8a55cc2df8cca03e798b91673c0e30b78e484cc5aacf937be
                            • Instruction ID: 6118ea6ef6b52f0e5ccc0ed6463b15aaf693085dcec4b92c70b48a5e77c52f9e
                            • Opcode Fuzzy Hash: 5066f3db103f61d8a55cc2df8cca03e798b91673c0e30b78e484cc5aacf937be
                            • Instruction Fuzzy Hash: D161897123870997DE384A288852BFF338FEF42704F14095EE842DBF81DA129D4A9359
                            Function 00691706 Relevance: .2, Instructions: 232COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                            • Instruction ID: 0bfcca08c61f153fac9b42c5937d3911dc71e439eb7a09d9997846dc7bdf0204
                            • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                            • Instruction Fuzzy Hash: 948176726090A30ADF6D427985340BEFFE75A933A132A079DD4F2CFAC1EE24C554E620
                            Function 0068D065 Relevance: .1, Instructions: 135COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 37ab0b392c51be2ddb428d483e63d8406c4fd19ad9a41c18c9f068d968f796c2
                            • Instruction ID: 2c4fdb82f27f25bc8f9f9796138d48d0707a8a3709e0bb7b8329e984bf41a198
                            • Opcode Fuzzy Hash: 37ab0b392c51be2ddb428d483e63d8406c4fd19ad9a41c18c9f068d968f796c2
                            • Instruction Fuzzy Hash: C051437154E7C0CFE73AAB258446D347F70EE62A1434A86CEC4814B8BBEB71951ECB85
                            Function 006F2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                            Download Yara Rule
                            APIs
                            • DeleteObject.GDI32(00000000), ref: 006F2B30
                            • DeleteObject.GDI32(00000000), ref: 006F2B43
                            • DestroyWindow.USER32 ref: 006F2B52
                            • GetDesktopWindow.USER32 ref: 006F2B6D
                            • GetWindowRect.USER32(00000000), ref: 006F2B74
                            • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 006F2CA3
                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 006F2CB1
                            • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2CF8
                            • GetClientRect.USER32(00000000,?), ref: 006F2D04
                            • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006F2D40
                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D62
                            • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D75
                            • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D80
                            • GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D89
                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2D98
                            • GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2DA1
                            • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2DA8
                            • GlobalFree.KERNEL32(00000000), ref: 006F2DB3
                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2DC5
                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,0070FC38,00000000), ref: 006F2DDB
                            • GlobalFree.KERNEL32(00000000), ref: 006F2DEB
                            • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 006F2E11
                            • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 006F2E30
                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F2E52
                            • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006F303F
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                            • String ID: $AutoIt v3$DISPLAY$static
                            • API String ID: 2211948467-2373415609
                            • Opcode ID: 1ade0377f288c2048322b36008c67b5e41035751701883a41b1b10854ffb0b84
                            • Instruction ID: 0f00116804fe1d30e79d9c51df982502eeb2e4742594fa67a58e7ff4abc2e69b
                            • Opcode Fuzzy Hash: 1ade0377f288c2048322b36008c67b5e41035751701883a41b1b10854ffb0b84
                            • Instruction Fuzzy Hash: 41028C71500209EFDB15DFA4CC89EAE7BBAFB49714F008258F915AB2A1DB74AD01CF64
                            Function 007070D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                            Download Yara Rule
                            APIs
                            • SetTextColor.GDI32(?,00000000), ref: 0070712F
                            • GetSysColorBrush.USER32(0000000F), ref: 00707160
                            • GetSysColor.USER32(0000000F), ref: 0070716C
                            • SetBkColor.GDI32(?,000000FF), ref: 00707186
                            • SelectObject.GDI32(?,?), ref: 00707195
                            • InflateRect.USER32(?,000000FF,000000FF), ref: 007071C0
                            • GetSysColor.USER32(00000010), ref: 007071C8
                            • CreateSolidBrush.GDI32(00000000), ref: 007071CF
                            • FrameRect.USER32(?,?,00000000), ref: 007071DE
                            • DeleteObject.GDI32(00000000), ref: 007071E5
                            • InflateRect.USER32(?,000000FE,000000FE), ref: 00707230
                            • FillRect.USER32(?,?,?), ref: 00707262
                            • GetWindowLongW.USER32(?,000000F0), ref: 00707284
                              • Part of subcall function 007073E8: GetSysColor.USER32(00000012), ref: 00707421
                              • Part of subcall function 007073E8: SetTextColor.GDI32(?,?), ref: 00707425
                              • Part of subcall function 007073E8: GetSysColorBrush.USER32(0000000F), ref: 0070743B
                              • Part of subcall function 007073E8: GetSysColor.USER32(0000000F), ref: 00707446
                              • Part of subcall function 007073E8: GetSysColor.USER32(00000011), ref: 00707463
                              • Part of subcall function 007073E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00707471
                              • Part of subcall function 007073E8: SelectObject.GDI32(?,00000000), ref: 00707482
                              • Part of subcall function 007073E8: SetBkColor.GDI32(?,00000000), ref: 0070748B
                              • Part of subcall function 007073E8: SelectObject.GDI32(?,?), ref: 00707498
                              • Part of subcall function 007073E8: InflateRect.USER32(?,000000FF,000000FF), ref: 007074B7
                              • Part of subcall function 007073E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007074CE
                              • Part of subcall function 007073E8: GetWindowLongW.USER32(00000000,000000F0), ref: 007074DB
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                            • String ID:
                            • API String ID: 4124339563-0
                            • Opcode ID: ebe176bc09cc46980b4406287c88078fdef939d02463dc473df45a7677695488
                            • Instruction ID: a2427c9073794a6c3147dce035c03abd1dd55eb120b2e2d7b6067401a511f742
                            • Opcode Fuzzy Hash: ebe176bc09cc46980b4406287c88078fdef939d02463dc473df45a7677695488
                            • Instruction Fuzzy Hash: 4BA1C072408301EFD7029F60DC48A5BBBE9FF89320F108B19F962961E0DB78E850CB51
                            Function 00688D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                            Download Yara Rule
                            APIs
                            • DestroyWindow.USER32(?,?), ref: 00688E14
                            • SendMessageW.USER32(?,00001308,?,00000000), ref: 006C6AC5
                            • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 006C6AFE
                            • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 006C6F43
                              • Part of subcall function 00688F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00688BE8,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 00688FC5
                            • SendMessageW.USER32(?,00001053), ref: 006C6F7F
                            • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 006C6F96
                            • ImageList_Destroy.COMCTL32(00000000,?), ref: 006C6FAC
                            • ImageList_Destroy.COMCTL32(00000000,?), ref: 006C6FB7
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                            • String ID: 0
                            • API String ID: 2760611726-4108050209
                            • Opcode ID: d170739995704483a597b7aacaabb31daf33ffabfe69df646786994baee41b59
                            • Instruction ID: f988ef7456915119be41adc5b25143620da2f5b67fa974698144abb4eaf252b4
                            • Opcode Fuzzy Hash: d170739995704483a597b7aacaabb31daf33ffabfe69df646786994baee41b59
                            • Instruction Fuzzy Hash: 76128A34204241DFDB25EF14C848FB5B7A6FB49300F94866EF5958B261CB35EC92CB99
                            Function 006F2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                            Download Yara Rule
                            APIs
                            • DestroyWindow.USER32(00000000), ref: 006F273E
                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 006F286A
                            • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 006F28A9
                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 006F28B9
                            • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 006F2900
                            • GetClientRect.USER32(00000000,?), ref: 006F290C
                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 006F2955
                            • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 006F2964
                            • GetStockObject.GDI32(00000011), ref: 006F2974
                            • SelectObject.GDI32(00000000,00000000), ref: 006F2978
                            • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 006F2988
                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 006F2991
                            • DeleteDC.GDI32(00000000), ref: 006F299A
                            • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006F29C6
                            • SendMessageW.USER32(00000030,00000000,00000001), ref: 006F29DD
                            • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 006F2A1D
                            • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 006F2A31
                            • SendMessageW.USER32(00000404,00000001,00000000), ref: 006F2A42
                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 006F2A77
                            • GetStockObject.GDI32(00000011), ref: 006F2A82
                            • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 006F2A8D
                            • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 006F2A97
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                            • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                            • API String ID: 2910397461-517079104
                            • Opcode ID: 696f3e0107f4fc7b76ac07c2351ef2b14acd9523eb28f22d6df584193ee07d2d
                            • Instruction ID: 35ed174138669326dddc4491227292bb579106d225a59dbbcebefca7269b22d0
                            • Opcode Fuzzy Hash: 696f3e0107f4fc7b76ac07c2351ef2b14acd9523eb28f22d6df584193ee07d2d
                            • Instruction Fuzzy Hash: 11B15FB5A40209AFEB14DF68CC45FAE7BA9EB05710F108255FA14E7290DB74ED40CB94
                            Function 006E4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                            Download Yara Rule
                            APIs
                            • SetErrorMode.KERNEL32(00000001), ref: 006E4AED
                            • GetDriveTypeW.KERNEL32(?,0070CB68,?,\\.\,0070CC08), ref: 006E4BCA
                            • SetErrorMode.KERNEL32(00000000,0070CB68,?,\\.\,0070CC08), ref: 006E4D36
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorMode$DriveType
                            • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                            • API String ID: 2907320926-4222207086
                            • Opcode ID: a6033ff50615b9e403339223c23bd836e9edadd2181acba1d83a037acccc8dd3
                            • Instruction ID: b188f6abcccd14c55385fd8d1d9e04df31f4f0fc1e9dd5011be44d9d4b8afc6c
                            • Opcode Fuzzy Hash: a6033ff50615b9e403339223c23bd836e9edadd2181acba1d83a037acccc8dd3
                            • Instruction Fuzzy Hash: 37618F70707385ABDB04DF35C9829A977A2AB04B00B34C519F80AAB792DF29ED42DB55
                            Function 007073E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetSysColor.USER32(00000012), ref: 00707421
                            • SetTextColor.GDI32(?,?), ref: 00707425
                            • GetSysColorBrush.USER32(0000000F), ref: 0070743B
                            • GetSysColor.USER32(0000000F), ref: 00707446
                            • CreateSolidBrush.GDI32(?), ref: 0070744B
                            • GetSysColor.USER32(00000011), ref: 00707463
                            • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00707471
                            • SelectObject.GDI32(?,00000000), ref: 00707482
                            • SetBkColor.GDI32(?,00000000), ref: 0070748B
                            • SelectObject.GDI32(?,?), ref: 00707498
                            • InflateRect.USER32(?,000000FF,000000FF), ref: 007074B7
                            • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007074CE
                            • GetWindowLongW.USER32(00000000,000000F0), ref: 007074DB
                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0070752A
                            • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00707554
                            • InflateRect.USER32(?,000000FD,000000FD), ref: 00707572
                            • DrawFocusRect.USER32(?,?), ref: 0070757D
                            • GetSysColor.USER32(00000011), ref: 0070758E
                            • SetTextColor.GDI32(?,00000000), ref: 00707596
                            • DrawTextW.USER32(?,007070F5,000000FF,?,00000000), ref: 007075A8
                            • SelectObject.GDI32(?,?), ref: 007075BF
                            • DeleteObject.GDI32(?), ref: 007075CA
                            • SelectObject.GDI32(?,?), ref: 007075D0
                            • DeleteObject.GDI32(?), ref: 007075D5
                            • SetTextColor.GDI32(?,?), ref: 007075DB
                            • SetBkColor.GDI32(?,?), ref: 007075E5
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                            • String ID:
                            • API String ID: 1996641542-0
                            • Opcode ID: 34c1b46e5932134cdd99208041478e44c0256eee6f12a065c5776aebb5e0c07e
                            • Instruction ID: 4c698fd6d2f536f6d0fd030573a2f09124f4ace0c535c9791a85ade6c55e9d71
                            • Opcode Fuzzy Hash: 34c1b46e5932134cdd99208041478e44c0256eee6f12a065c5776aebb5e0c07e
                            • Instruction Fuzzy Hash: 38616175D00218EFDB059FA4DC49ADE7FB9EB09320F108315F911A72E1DB79A950CB94
                            Function 00700FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetCursorPos.USER32(?), ref: 00701128
                            • GetDesktopWindow.USER32 ref: 0070113D
                            • GetWindowRect.USER32(00000000), ref: 00701144
                            • GetWindowLongW.USER32(?,000000F0), ref: 00701199
                            • DestroyWindow.USER32(?), ref: 007011B9
                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007011ED
                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0070120B
                            • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0070121D
                            • SendMessageW.USER32(00000000,00000421,?,?), ref: 00701232
                            • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00701245
                            • IsWindowVisible.USER32(00000000), ref: 007012A1
                            • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 007012BC
                            • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 007012D0
                            • GetWindowRect.USER32(00000000,?), ref: 007012E8
                            • MonitorFromPoint.USER32(?,?,00000002), ref: 0070130E
                            • GetMonitorInfoW.USER32(00000000,?), ref: 00701328
                            • CopyRect.USER32(?,?), ref: 0070133F
                            • SendMessageW.USER32(00000000,00000412,00000000), ref: 007013AA
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                            • String ID: ($0$tooltips_class32
                            • API String ID: 698492251-4156429822
                            • Opcode ID: 20895521438700935bae97159d7ecc6596d2146e130dcf14b68f99af15ef36bc
                            • Instruction ID: eac9baa84f8ec238a7903e951229ccf19310ddb58f817442a7291fa91a529a1c
                            • Opcode Fuzzy Hash: 20895521438700935bae97159d7ecc6596d2146e130dcf14b68f99af15ef36bc
                            • Instruction Fuzzy Hash: 6CB19A71604341EFD714DF64C884B6ABBE5FF84704F408A1CF9999B2A1DB35E844CBA6
                            Function 00688891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                            Download Yara Rule
                            APIs
                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00688968
                            • GetSystemMetrics.USER32(00000007), ref: 00688970
                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0068899B
                            • GetSystemMetrics.USER32(00000008), ref: 006889A3
                            • GetSystemMetrics.USER32(00000004), ref: 006889C8
                            • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 006889E5
                            • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 006889F5
                            • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00688A28
                            • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00688A3C
                            • GetClientRect.USER32(00000000,000000FF), ref: 00688A5A
                            • GetStockObject.GDI32(00000011), ref: 00688A76
                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 00688A81
                              • Part of subcall function 0068912D: GetCursorPos.USER32(?), ref: 00689141
                              • Part of subcall function 0068912D: ScreenToClient.USER32(00000000,?), ref: 0068915E
                              • Part of subcall function 0068912D: GetAsyncKeyState.USER32(00000001), ref: 00689183
                              • Part of subcall function 0068912D: GetAsyncKeyState.USER32(00000002), ref: 0068919D
                            • SetTimer.USER32(00000000,00000000,00000028,006890FC), ref: 00688AA8
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                            • String ID: AutoIt v3 GUI
                            • API String ID: 1458621304-248962490
                            • Opcode ID: 79e84bb425a83ea9440d9dad12620ae0ed6e3a838edece491787aec04df95acb
                            • Instruction ID: e292f0fe049c92a77113830cafe8063d66d9b63c768a3dd094945118f36f81da
                            • Opcode Fuzzy Hash: 79e84bb425a83ea9440d9dad12620ae0ed6e3a838edece491787aec04df95acb
                            • Instruction Fuzzy Hash: 6CB15D75A00209DFDF14EF68CC45BEE3BB6FB48314F508229FA15AB290DB74A841CB59
                            Function 006D0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006D1114
                              • Part of subcall function 006D10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1120
                              • Part of subcall function 006D10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D112F
                              • Part of subcall function 006D10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1136
                              • Part of subcall function 006D10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006D114D
                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006D0DF5
                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 006D0E29
                            • GetLengthSid.ADVAPI32(?), ref: 006D0E40
                            • GetAce.ADVAPI32(?,00000000,?), ref: 006D0E7A
                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006D0E96
                            • GetLengthSid.ADVAPI32(?), ref: 006D0EAD
                            • GetProcessHeap.KERNEL32(00000008,00000008), ref: 006D0EB5
                            • HeapAlloc.KERNEL32(00000000), ref: 006D0EBC
                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 006D0EDD
                            • CopySid.ADVAPI32(00000000), ref: 006D0EE4
                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 006D0F13
                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006D0F35
                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 006D0F47
                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0F6E
                            • HeapFree.KERNEL32(00000000), ref: 006D0F75
                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0F7E
                            • HeapFree.KERNEL32(00000000), ref: 006D0F85
                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D0F8E
                            • HeapFree.KERNEL32(00000000), ref: 006D0F95
                            • GetProcessHeap.KERNEL32(00000000,?), ref: 006D0FA1
                            • HeapFree.KERNEL32(00000000), ref: 006D0FA8
                              • Part of subcall function 006D1193: GetProcessHeap.KERNEL32(00000008,006D0BB1,?,00000000,?,006D0BB1,?), ref: 006D11A1
                              • Part of subcall function 006D1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,006D0BB1,?), ref: 006D11A8
                              • Part of subcall function 006D1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,006D0BB1,?), ref: 006D11B7
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                            • String ID:
                            • API String ID: 4175595110-0
                            • Opcode ID: 928871adc3f51b7526fb8d6638c58b74363bd9261a757b87d7939d2bfc9b4315
                            • Instruction ID: 836f0e3bb80143aba7e723c97debb08c8034f8066f5400fb9399bd3ebf8f046e
                            • Opcode Fuzzy Hash: 928871adc3f51b7526fb8d6638c58b74363bd9261a757b87d7939d2bfc9b4315
                            • Instruction Fuzzy Hash: D8716F72D0020AEBEF21DFA4DC49FEEBBB9BF05300F148216F915A6291DB759905CB60
                            Function 006FC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                            Download Yara Rule
                            APIs
                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006FC4BD
                            • RegCreateKeyExW.ADVAPI32(?,?,00000000,0070CC08,00000000,?,00000000,?,?), ref: 006FC544
                            • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 006FC5A4
                            • _wcslen.LIBCMT ref: 006FC5F4
                            • _wcslen.LIBCMT ref: 006FC66F
                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 006FC6B2
                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 006FC7C1
                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 006FC84D
                            • RegCloseKey.ADVAPI32(?), ref: 006FC881
                            • RegCloseKey.ADVAPI32(00000000), ref: 006FC88E
                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 006FC960
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                            • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                            • API String ID: 9721498-966354055
                            • Opcode ID: 5d77420cd363820ccb3310154938cf232df580fa0266088d730d53e2ffb62ae3
                            • Instruction ID: d502c211b537eb71d196fb8d3a3192a2754ec1e8f5f39ec74323159bec38a47e
                            • Opcode Fuzzy Hash: 5d77420cd363820ccb3310154938cf232df580fa0266088d730d53e2ffb62ae3
                            • Instruction Fuzzy Hash: C3127A352042059FDB54DF24C981E6ABBE6FF88724F14885CF95A9B3A2DB31EC41CB85
                            Function 0070091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                            Download Yara Rule
                            APIs
                            • CharUpperBuffW.USER32(?,?), ref: 007009C6
                            • _wcslen.LIBCMT ref: 00700A01
                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00700A54
                            • _wcslen.LIBCMT ref: 00700A8A
                            • _wcslen.LIBCMT ref: 00700B06
                            • _wcslen.LIBCMT ref: 00700B81
                              • Part of subcall function 0068F9F2: _wcslen.LIBCMT ref: 0068F9FD
                              • Part of subcall function 006D2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006D2BFA
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$MessageSend$BuffCharUpper
                            • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                            • API String ID: 1103490817-4258414348
                            • Opcode ID: 12fa7edd9e623404519a0025117f33da2dbd51a880fec528de1c63e729ff74b1
                            • Instruction ID: 306b09a6e2f24b963d4c380a53561e7afd80b490e0f28e1792780382172332dd
                            • Opcode Fuzzy Hash: 12fa7edd9e623404519a0025117f33da2dbd51a880fec528de1c63e729ff74b1
                            • Instruction Fuzzy Hash: 07E1AE71208301DFC754DF24C450A2AB7E2BF98324F148A5DF89A9B3A2DB38ED45CB95
                            Function 006FC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$BuffCharUpper
                            • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                            • API String ID: 1256254125-909552448
                            • Opcode ID: 15a59103e9784133d0b0560c6d09221a85c2b49145686ff508be85c978b66bd0
                            • Instruction ID: a3196f16ff9bd80926c90e57bcc90088531d5bdbd10ef4fbc72a38f88ea86990
                            • Opcode Fuzzy Hash: 15a59103e9784133d0b0560c6d09221a85c2b49145686ff508be85c978b66bd0
                            • Instruction Fuzzy Hash: AB71F27260012E8BCB20DE7CCA519FA3397AFA0774F214528FA6697385EA35DD45C3A0
                            Function 0070833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                            Download Yara Rule
                            APIs
                            • _wcslen.LIBCMT ref: 0070835A
                            • _wcslen.LIBCMT ref: 0070836E
                            • _wcslen.LIBCMT ref: 00708391
                            • _wcslen.LIBCMT ref: 007083B4
                            • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007083F2
                            • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0070361A,?), ref: 0070844E
                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00708487
                            • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007084CA
                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00708501
                            • FreeLibrary.KERNEL32(?), ref: 0070850D
                            • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0070851D
                            • DestroyIcon.USER32(?), ref: 0070852C
                            • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00708549
                            • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00708555
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                            • String ID: .dll$.exe$.icl
                            • API String ID: 799131459-1154884017
                            • Opcode ID: 0e057f0269ad623b7d87102cfe6b77bb6ba620d822a9fd106360663c0cebab71
                            • Instruction ID: 678b275b1f108bc1f449337ece912b9545d1d8d8ddda8db9439918338ec9ad86
                            • Opcode Fuzzy Hash: 0e057f0269ad623b7d87102cfe6b77bb6ba620d822a9fd106360663c0cebab71
                            • Instruction Fuzzy Hash: C461EE71500219FAEB54CF64CC81BBE77ACBB08B21F108709F855D61D1DFB8AA91CBA0
                            Function 00677778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                            • API String ID: 0-1645009161
                            • Opcode ID: 25d3139f5c5fde1a13a3960a220dff363b0168d847e5670cb4738a33703cc2cf
                            • Instruction ID: 6b6594b348eb29eb1a123d16122a5f32f511e989c3067384951d0f3350905454
                            • Opcode Fuzzy Hash: 25d3139f5c5fde1a13a3960a220dff363b0168d847e5670cb4738a33703cc2cf
                            • Instruction Fuzzy Hash: C181FBB1604205BFDF65AF64CC42FEE37ABAF15300F048128F909AB296EB74D951C7A5
                            Function 006D5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                            Download Yara Rule
                            APIs
                            • LoadIconW.USER32(00000063), ref: 006D5A2E
                            • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 006D5A40
                            • SetWindowTextW.USER32(?,?), ref: 006D5A57
                            • GetDlgItem.USER32(?,000003EA), ref: 006D5A6C
                            • SetWindowTextW.USER32(00000000,?), ref: 006D5A72
                            • GetDlgItem.USER32(?,000003E9), ref: 006D5A82
                            • SetWindowTextW.USER32(00000000,?), ref: 006D5A88
                            • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 006D5AA9
                            • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 006D5AC3
                            • GetWindowRect.USER32(?,?), ref: 006D5ACC
                            • _wcslen.LIBCMT ref: 006D5B33
                            • SetWindowTextW.USER32(?,?), ref: 006D5B6F
                            • GetDesktopWindow.USER32 ref: 006D5B75
                            • GetWindowRect.USER32(00000000), ref: 006D5B7C
                            • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 006D5BD3
                            • GetClientRect.USER32(?,?), ref: 006D5BE0
                            • PostMessageW.USER32(?,00000005,00000000,?), ref: 006D5C05
                            • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 006D5C2F
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                            • String ID:
                            • API String ID: 895679908-0
                            • Opcode ID: e9071c0ca5da6a311cfe11efd4aabf59db701a3367422df5f83f2defa766695e
                            • Instruction ID: 549e0144f63d7bafb84393e0ce737fe214a942d5bd8d3b4d97ef366b97106a79
                            • Opcode Fuzzy Hash: e9071c0ca5da6a311cfe11efd4aabf59db701a3367422df5f83f2defa766695e
                            • Instruction Fuzzy Hash: 7C716F31900B05DFDB21DFA8CD55AAEBBF6FF48704F10461AE143A66A0DB75E940CB54
                            Function 006D30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen
                            • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[s
                            • API String ID: 176396367-691173368
                            • Opcode ID: 0b5aa5d379020f217f10e730503a8d7b32d94c198a049fe518ac63ea10c8066a
                            • Instruction ID: f7a017c7ccd8b3f7d290792f94386030da3c90c0fc6ab691979c92c368197316
                            • Opcode Fuzzy Hash: 0b5aa5d379020f217f10e730503a8d7b32d94c198a049fe518ac63ea10c8066a
                            • Instruction Fuzzy Hash: 7FE1D432E00626ABCF549FA4C8516EEFBB6BF54710F54822BE456E7340DB30AF4587A1
                            Function 006900C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                            Download Yara Rule
                            APIs
                            • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006900C6
                              • Part of subcall function 006900ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0074070C,00000FA0,C1DEEC9B,?,?,?,?,006B23B3,000000FF), ref: 0069011C
                              • Part of subcall function 006900ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,006B23B3,000000FF), ref: 00690127
                              • Part of subcall function 006900ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,006B23B3,000000FF), ref: 00690138
                              • Part of subcall function 006900ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0069014E
                              • Part of subcall function 006900ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0069015C
                              • Part of subcall function 006900ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0069016A
                              • Part of subcall function 006900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00690195
                              • Part of subcall function 006900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006901A0
                            • ___scrt_fastfail.LIBCMT ref: 006900E7
                              • Part of subcall function 006900A3: __onexit.LIBCMT ref: 006900A9
                            Strings
                            • kernel32.dll, xrefs: 00690133
                            • WakeAllConditionVariable, xrefs: 00690162
                            • SleepConditionVariableCS, xrefs: 00690154
                            • InitializeConditionVariable, xrefs: 00690148
                            • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00690122
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                            • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                            • API String ID: 66158676-1714406822
                            • Opcode ID: 28104ff3620a2ec61c26e1337d78d4201518cc95c3e35147db0697054c875466
                            • Instruction ID: 1d74f1f66d9a00a7c08c56f118d28354d55c5a508f631c4209af495d7c6e6e32
                            • Opcode Fuzzy Hash: 28104ff3620a2ec61c26e1337d78d4201518cc95c3e35147db0697054c875466
                            • Instruction Fuzzy Hash: 7821DA72644710EFFF225BB4AC09B6937D9DB05B61F14432AF901A2AD1DF7858008A99
                            Function 006E44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                            Download Yara Rule
                            APIs
                            • CharLowerBuffW.USER32(00000000,00000000,0070CC08), ref: 006E4527
                            • _wcslen.LIBCMT ref: 006E453B
                            • _wcslen.LIBCMT ref: 006E4599
                            • _wcslen.LIBCMT ref: 006E45F4
                            • _wcslen.LIBCMT ref: 006E463F
                            • _wcslen.LIBCMT ref: 006E46A7
                              • Part of subcall function 0068F9F2: _wcslen.LIBCMT ref: 0068F9FD
                            • GetDriveTypeW.KERNEL32(?,00736BF0,00000061), ref: 006E4743
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$BuffCharDriveLowerType
                            • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                            • API String ID: 2055661098-1000479233
                            • Opcode ID: 4469ecb6167d18353b1c40cf5d020051fc31341506b5d21b0d41cd104ad4c239
                            • Instruction ID: 4358a9c1b0e613d9d106cf324919749ce16a9b165629012781b1015b8fac889d
                            • Opcode Fuzzy Hash: 4469ecb6167d18353b1c40cf5d020051fc31341506b5d21b0d41cd104ad4c239
                            • Instruction Fuzzy Hash: 8AB1F4716093429FC710DF39C8909AAB7E6BFA5720F508A1DF496C7391EB30D845CBA2
                            Function 0070911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00689BB2
                            • DragQueryPoint.SHELL32(?,?), ref: 00709147
                              • Part of subcall function 00707674: ClientToScreen.USER32(?,?), ref: 0070769A
                              • Part of subcall function 00707674: GetWindowRect.USER32(?,?), ref: 00707710
                              • Part of subcall function 00707674: PtInRect.USER32(?,?,00708B89), ref: 00707720
                            • SendMessageW.USER32(?,000000B0,?,?), ref: 007091B0
                            • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007091BB
                            • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007091DE
                            • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00709225
                            • SendMessageW.USER32(?,000000B0,?,?), ref: 0070923E
                            • SendMessageW.USER32(?,000000B1,?,?), ref: 00709255
                            • SendMessageW.USER32(?,000000B1,?,?), ref: 00709277
                            • DragFinish.SHELL32(?), ref: 0070927E
                            • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00709371
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                            • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#t
                            • API String ID: 221274066-656513400
                            • Opcode ID: e625f9d0d9788443bb395797c9ce895f01800505d44bf44566121bfb69b37f66
                            • Instruction ID: 95bea6864283e363dce9de3e3acc54390e6fdf14af80ede72e1f12f808a41909
                            • Opcode Fuzzy Hash: e625f9d0d9788443bb395797c9ce895f01800505d44bf44566121bfb69b37f66
                            • Instruction Fuzzy Hash: 1B618871108301AFD701EF60CC85DAFBBE9EF89350F004A2EF695921A1DB349A49CB66
                            Function 006FAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                            Download Yara Rule
                            APIs
                            • _wcslen.LIBCMT ref: 006FB198
                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006FB1B0
                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006FB1D4
                            • _wcslen.LIBCMT ref: 006FB200
                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006FB214
                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006FB236
                            • _wcslen.LIBCMT ref: 006FB332
                              • Part of subcall function 006E05A7: GetStdHandle.KERNEL32(000000F6), ref: 006E05C6
                            • _wcslen.LIBCMT ref: 006FB34B
                            • _wcslen.LIBCMT ref: 006FB366
                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006FB3B6
                            • GetLastError.KERNEL32(00000000), ref: 006FB407
                            • CloseHandle.KERNEL32(?), ref: 006FB439
                            • CloseHandle.KERNEL32(00000000), ref: 006FB44A
                            • CloseHandle.KERNEL32(00000000), ref: 006FB45C
                            • CloseHandle.KERNEL32(00000000), ref: 006FB46E
                            • CloseHandle.KERNEL32(?), ref: 006FB4E3
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                            • String ID:
                            • API String ID: 2178637699-0
                            • Opcode ID: d2c2fe14e73aa08d075d09a7b795ae1dd117008319cbfcdc28834759cace1c35
                            • Instruction ID: 53031fc71143cad1ecf6eb795f298e7a4db1b32d07f2927e334e9d183f47b268
                            • Opcode Fuzzy Hash: d2c2fe14e73aa08d075d09a7b795ae1dd117008319cbfcdc28834759cace1c35
                            • Instruction Fuzzy Hash: C3F198316083049FDB54EF24C891B6EBBE6AF85314F18855DF9898B3A2DB31EC41CB56
                            Function 0067326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetMenuItemCount.USER32(00741990), ref: 006B2F8D
                            • GetMenuItemCount.USER32(00741990), ref: 006B303D
                            • GetCursorPos.USER32(?), ref: 006B3081
                            • SetForegroundWindow.USER32(00000000), ref: 006B308A
                            • TrackPopupMenuEx.USER32(00741990,00000000,?,00000000,00000000,00000000), ref: 006B309D
                            • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006B30A9
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                            • String ID: 0
                            • API String ID: 36266755-4108050209
                            • Opcode ID: 12036b50c64eac29de874c2a50156011d723d7acc710ec84ad9717acb091a029
                            • Instruction ID: ffc8fd55a0e9d98331ce6de9ee6d22408742d87410d5ca3fa520ceb991968e97
                            • Opcode Fuzzy Hash: 12036b50c64eac29de874c2a50156011d723d7acc710ec84ad9717acb091a029
                            • Instruction Fuzzy Hash: CB710AB0640216BEEB219F25CC59FEABFAAFF04364F204306F5246A3D1C7B19950D754
                            Function 00706CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                            Download Yara Rule
                            APIs
                            • DestroyWindow.USER32(?,?), ref: 00706DEB
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00706E5F
                            • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00706E81
                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00706E94
                            • DestroyWindow.USER32(?), ref: 00706EB5
                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00670000,00000000), ref: 00706EE4
                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00706EFD
                            • GetDesktopWindow.USER32 ref: 00706F16
                            • GetWindowRect.USER32(00000000), ref: 00706F1D
                            • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00706F35
                            • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00706F4D
                              • Part of subcall function 00689944: GetWindowLongW.USER32(?,000000EB), ref: 00689952
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                            • String ID: 0$tooltips_class32
                            • API String ID: 2429346358-3619404913
                            • Opcode ID: 1e43481e1d4e52d8b9d93997ab649c74df8d4334a4e4260234bada270ad0445c
                            • Instruction ID: db5c046a0f1a0c83a11a0a61f0605d3c5278f525b9ac6afd20dd6fce8de2f7e7
                            • Opcode Fuzzy Hash: 1e43481e1d4e52d8b9d93997ab649c74df8d4334a4e4260234bada270ad0445c
                            • Instruction Fuzzy Hash: C2719974100341EFDB21DF18DC54EAABBE9FB89300F444A1EF989872A1CB79E956CB15
                            Function 006EC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                            Download Yara Rule
                            APIs
                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006EC4B0
                            • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 006EC4C3
                            • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 006EC4D7
                            • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 006EC4F0
                            • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 006EC533
                            • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 006EC549
                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006EC554
                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006EC584
                            • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 006EC5DC
                            • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 006EC5F0
                            • InternetCloseHandle.WININET(00000000), ref: 006EC5FB
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                            • String ID:
                            • API String ID: 3800310941-3916222277
                            • Opcode ID: 89c763eb7f0c2b632a4f80c5030ca9aec357e0616ee0081af24e7dd655ebf6c2
                            • Instruction ID: aa9acb23e9a288607340cac32de04122cec3343b3b36e12a8487a0869bb40499
                            • Opcode Fuzzy Hash: 89c763eb7f0c2b632a4f80c5030ca9aec357e0616ee0081af24e7dd655ebf6c2
                            • Instruction Fuzzy Hash: 1B518DB1101348FFDB229F62C948AAB7BFDFF08364F00861AF94596250DB34E9159F60
                            Function 0070856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                            Download Yara Rule
                            APIs
                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00708592
                            • GetFileSize.KERNEL32(00000000,00000000), ref: 007085A2
                            • GlobalAlloc.KERNEL32(00000002,00000000), ref: 007085AD
                            • CloseHandle.KERNEL32(00000000), ref: 007085BA
                            • GlobalLock.KERNEL32(00000000), ref: 007085C8
                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 007085D7
                            • GlobalUnlock.KERNEL32(00000000), ref: 007085E0
                            • CloseHandle.KERNEL32(00000000), ref: 007085E7
                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 007085F8
                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,0070FC38,?), ref: 00708611
                            • GlobalFree.KERNEL32(00000000), ref: 00708621
                            • GetObjectW.GDI32(?,00000018,000000FF), ref: 00708641
                            • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00708671
                            • DeleteObject.GDI32(00000000), ref: 00708699
                            • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007086AF
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                            • String ID:
                            • API String ID: 3840717409-0
                            • Opcode ID: bd0e34d7fe67fee954d1bf3dc07806171dc1f8214affd4601dd70fe6ccade01d
                            • Instruction ID: fef4db96f3d22c5dd1d29420dca76733941e1e89e767fbb7e12b8582f661bc8b
                            • Opcode Fuzzy Hash: bd0e34d7fe67fee954d1bf3dc07806171dc1f8214affd4601dd70fe6ccade01d
                            • Instruction Fuzzy Hash: DF414C71600208EFDB119FA5CC88EAE7BB8FF89715F108258F905E72A0DB399D01CB25
                            Function 006E14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                            Download Yara Rule
                            APIs
                            • VariantInit.OLEAUT32(00000000), ref: 006E1502
                            • VariantCopy.OLEAUT32(?,?), ref: 006E150B
                            • VariantClear.OLEAUT32(?), ref: 006E1517
                            • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 006E15FB
                            • VarR8FromDec.OLEAUT32(?,?), ref: 006E1657
                            • VariantInit.OLEAUT32(?), ref: 006E1708
                            • SysFreeString.OLEAUT32(?), ref: 006E178C
                            • VariantClear.OLEAUT32(?), ref: 006E17D8
                            • VariantClear.OLEAUT32(?), ref: 006E17E7
                            • VariantInit.OLEAUT32(00000000), ref: 006E1823
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                            • String ID: %4d%02d%02d%02d%02d%02d$Default
                            • API String ID: 1234038744-3931177956
                            • Opcode ID: 19adada5b4946b23dfef771eaa79e2459ac00d8b165334b2978e9ee63936c7ea
                            • Instruction ID: 1748d6fa86bf9f3c57b8d25920ec8c0bebbea06af2582455468cdccb3c13bd9f
                            • Opcode Fuzzy Hash: 19adada5b4946b23dfef771eaa79e2459ac00d8b165334b2978e9ee63936c7ea
                            • Instruction Fuzzy Hash: 90D1F6B1601245DBDB00AF66D889BBDB7B7BF46700F10815AF846AF285DB34DC42EB61
                            Function 006FB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                              • Part of subcall function 006FC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006FB6AE,?,?), ref: 006FC9B5
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FC9F1
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FCA68
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FCA9E
                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006FB6F4
                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006FB772
                            • RegDeleteValueW.ADVAPI32(?,?), ref: 006FB80A
                            • RegCloseKey.ADVAPI32(?), ref: 006FB87E
                            • RegCloseKey.ADVAPI32(?), ref: 006FB89C
                            • LoadLibraryA.KERNEL32(advapi32.dll), ref: 006FB8F2
                            • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006FB904
                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 006FB922
                            • FreeLibrary.KERNEL32(00000000), ref: 006FB983
                            • RegCloseKey.ADVAPI32(00000000), ref: 006FB994
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                            • String ID: RegDeleteKeyExW$advapi32.dll
                            • API String ID: 146587525-4033151799
                            • Opcode ID: cbf40aab7dfeec946a0c6f7d6b8bd63ddca5e641b8f908f9b7921e2c6292a28f
                            • Instruction ID: 863cce5a82a7463230aece935edf4af96cefc5f8ac0337b68c279ca6daa6dafd
                            • Opcode Fuzzy Hash: cbf40aab7dfeec946a0c6f7d6b8bd63ddca5e641b8f908f9b7921e2c6292a28f
                            • Instruction Fuzzy Hash: 61C19B30208205EFD710DF24C495F6ABBE6BF85318F14D55CE6AA8B3A2CB75E845CB91
                            Function 006F255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetDC.USER32(00000000), ref: 006F25D8
                            • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 006F25E8
                            • CreateCompatibleDC.GDI32(?), ref: 006F25F4
                            • SelectObject.GDI32(00000000,?), ref: 006F2601
                            • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 006F266D
                            • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 006F26AC
                            • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 006F26D0
                            • SelectObject.GDI32(?,?), ref: 006F26D8
                            • DeleteObject.GDI32(?), ref: 006F26E1
                            • DeleteDC.GDI32(?), ref: 006F26E8
                            • ReleaseDC.USER32(00000000,?), ref: 006F26F3
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                            • String ID: (
                            • API String ID: 2598888154-3887548279
                            • Opcode ID: 35c464bf84f3e773fbab7a2996f7463c2af6e27bc8bc39aef9967a00a9e39fb5
                            • Instruction ID: 54db8824486c2797e9829b2e7b455b45d54158bae1769e59836f914865038e97
                            • Opcode Fuzzy Hash: 35c464bf84f3e773fbab7a2996f7463c2af6e27bc8bc39aef9967a00a9e39fb5
                            • Instruction Fuzzy Hash: 596102B5D00219EFCF05CFA4D884AAEBBF6FF48310F208629EA55A7250D774A951CF54
                            Function 006ADA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • ___free_lconv_mon.LIBCMT ref: 006ADAA1
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD659
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD66B
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD67D
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD68F
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD6A1
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD6B3
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD6C5
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD6D7
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD6E9
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD6FB
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD70D
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD71F
                              • Part of subcall function 006AD63C: _free.LIBCMT ref: 006AD731
                            • _free.LIBCMT ref: 006ADA96
                              • Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
                              • Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0
                            • _free.LIBCMT ref: 006ADAB8
                            • _free.LIBCMT ref: 006ADACD
                            • _free.LIBCMT ref: 006ADAD8
                            • _free.LIBCMT ref: 006ADAFA
                            • _free.LIBCMT ref: 006ADB0D
                            • _free.LIBCMT ref: 006ADB1B
                            • _free.LIBCMT ref: 006ADB26
                            • _free.LIBCMT ref: 006ADB5E
                            • _free.LIBCMT ref: 006ADB65
                            • _free.LIBCMT ref: 006ADB82
                            • _free.LIBCMT ref: 006ADB9A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                            • String ID:
                            • API String ID: 161543041-0
                            • Opcode ID: 70c4333d9b0fda56b661903dcec1ea116630b195453d43c24483f06b4a5941f2
                            • Instruction ID: 1ebd3fb5c79a634863c6bc585441c4c363ad43937f4dce768ced554f2dc7d1a4
                            • Opcode Fuzzy Hash: 70c4333d9b0fda56b661903dcec1ea116630b195453d43c24483f06b4a5941f2
                            • Instruction Fuzzy Hash: 30315C716442069FEBA1BA39E845B9BB7EAFF02B10F11442DE44AD7691DA30BC408F25
                            Function 006D365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                            Download Yara Rule
                            APIs
                            • GetClassNameW.USER32(?,?,00000100), ref: 006D369C
                            • _wcslen.LIBCMT ref: 006D36A7
                            • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 006D3797
                            • GetClassNameW.USER32(?,?,00000400), ref: 006D380C
                            • GetDlgCtrlID.USER32(?), ref: 006D385D
                            • GetWindowRect.USER32(?,?), ref: 006D3882
                            • GetParent.USER32(?), ref: 006D38A0
                            • ScreenToClient.USER32(00000000), ref: 006D38A7
                            • GetClassNameW.USER32(?,?,00000100), ref: 006D3921
                            • GetWindowTextW.USER32(?,?,00000400), ref: 006D395D
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                            • String ID: %s%u
                            • API String ID: 4010501982-679674701
                            • Opcode ID: 58c60f5c4044c24b7a73589b2678a36b4f84a655e547eb750959bcf9be91283c
                            • Instruction ID: 63149561687df5882569f05b0d7f50496c3859f4612485d26879a620cabb4fb2
                            • Opcode Fuzzy Hash: 58c60f5c4044c24b7a73589b2678a36b4f84a655e547eb750959bcf9be91283c
                            • Instruction Fuzzy Hash: E491D771600616EFD715DF24C895FEAB7AAFF44350F00861AF999C6390EB30EA45CB92
                            Function 006D4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                            Download Yara Rule
                            APIs
                            • GetClassNameW.USER32(?,?,00000400), ref: 006D4994
                            • GetWindowTextW.USER32(?,?,00000400), ref: 006D49DA
                            • _wcslen.LIBCMT ref: 006D49EB
                            • CharUpperBuffW.USER32(?,00000000), ref: 006D49F7
                            • _wcsstr.LIBVCRUNTIME ref: 006D4A2C
                            • GetClassNameW.USER32(00000018,?,00000400), ref: 006D4A64
                            • GetWindowTextW.USER32(?,?,00000400), ref: 006D4A9D
                            • GetClassNameW.USER32(00000018,?,00000400), ref: 006D4AE6
                            • GetClassNameW.USER32(?,?,00000400), ref: 006D4B20
                            • GetWindowRect.USER32(?,?), ref: 006D4B8B
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                            • String ID: ThumbnailClass
                            • API String ID: 1311036022-1241985126
                            • Opcode ID: 5f5e244aeb2631e008293074124ebf09226b11f8ade0a44f67214b8f4205a17e
                            • Instruction ID: a98f9e25d6cf7a22c60696f235545f149ec19f354c600e9561211ab150df462c
                            • Opcode Fuzzy Hash: 5f5e244aeb2631e008293074124ebf09226b11f8ade0a44f67214b8f4205a17e
                            • Instruction Fuzzy Hash: 4E91DC318082059FDB05CF10C985BAA77EAFF94304F04856BFD8A9A296DF34ED45CBA1
                            Function 006FCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                            Download Yara Rule
                            APIs
                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 006FCC64
                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 006FCC8D
                            • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 006FCD48
                              • Part of subcall function 006FCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 006FCCAA
                              • Part of subcall function 006FCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 006FCCBD
                              • Part of subcall function 006FCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006FCCCF
                              • Part of subcall function 006FCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 006FCD05
                              • Part of subcall function 006FCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 006FCD28
                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 006FCCF3
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                            • String ID: RegDeleteKeyExW$advapi32.dll
                            • API String ID: 2734957052-4033151799
                            • Opcode ID: f7674d3f8ee197b39b3cdfaa5254bbff9e690a10a737bc635b382cc58d56e17b
                            • Instruction ID: 447dacb32c4b7b5dc55ce00c400781d541affac7b0b29563d51eac4516926066
                            • Opcode Fuzzy Hash: f7674d3f8ee197b39b3cdfaa5254bbff9e690a10a737bc635b382cc58d56e17b
                            • Instruction Fuzzy Hash: 64318FB190112CFBDB218B50DD88EFFBB7DEF45760F004265BA06E2240DB349A45DAA4
                            Function 006DE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                            Download Yara Rule
                            APIs
                            • timeGetTime.WINMM ref: 006DE6B4
                              • Part of subcall function 0068E551: timeGetTime.WINMM(?,?,006DE6D4), ref: 0068E555
                            • Sleep.KERNEL32(0000000A), ref: 006DE6E1
                            • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 006DE705
                            • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 006DE727
                            • SetActiveWindow.USER32 ref: 006DE746
                            • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 006DE754
                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 006DE773
                            • Sleep.KERNEL32(000000FA), ref: 006DE77E
                            • IsWindow.USER32 ref: 006DE78A
                            • EndDialog.USER32(00000000), ref: 006DE79B
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                            • String ID: BUTTON
                            • API String ID: 1194449130-3405671355
                            • Opcode ID: 262f18fa949fe684f5aae555c054d75495ecfa1341515ff92f1469c0e097e107
                            • Instruction ID: 050a483cf642a69000bafb7abe46d150fe8b6c33a3453b5634a3619e15c583ae
                            • Opcode Fuzzy Hash: 262f18fa949fe684f5aae555c054d75495ecfa1341515ff92f1469c0e097e107
                            • Instruction Fuzzy Hash: BD21C5B8740244EFEB116F20EC89E363B6AE756348F508627F405857A2DF7B9C11CA1D
                            Function 006DE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 006DEA5D
                            • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 006DEA73
                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006DEA84
                            • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 006DEA96
                            • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 006DEAA7
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: SendString$_wcslen
                            • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                            • API String ID: 2420728520-1007645807
                            • Opcode ID: bcd433877ac56361c67d50dea20c438eb049dc85651a225822388d57251b7141
                            • Instruction ID: 1436753c3632b2f9b69f81b0a54a1e02250c22f4f3f7e8b10628e3fbd05cbe9c
                            • Opcode Fuzzy Hash: bcd433877ac56361c67d50dea20c438eb049dc85651a225822388d57251b7141
                            • Instruction Fuzzy Hash: 1B11A371A90269B9E720F7A1DC4AEFF6B7DEBD1B00F04842E7415A61D1EE701905C5B0
                            Function 006D5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                            Download Yara Rule
                            APIs
                            • GetDlgItem.USER32(?,00000001), ref: 006D5CE2
                            • GetWindowRect.USER32(00000000,?), ref: 006D5CFB
                            • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 006D5D59
                            • GetDlgItem.USER32(?,00000002), ref: 006D5D69
                            • GetWindowRect.USER32(00000000,?), ref: 006D5D7B
                            • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 006D5DCF
                            • GetDlgItem.USER32(?,000003E9), ref: 006D5DDD
                            • GetWindowRect.USER32(00000000,?), ref: 006D5DEF
                            • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 006D5E31
                            • GetDlgItem.USER32(?,000003EA), ref: 006D5E44
                            • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 006D5E5A
                            • InvalidateRect.USER32(?,00000000,00000001), ref: 006D5E67
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$ItemMoveRect$Invalidate
                            • String ID:
                            • API String ID: 3096461208-0
                            • Opcode ID: 98bfd2f5e22b1f88b17dc59e569d18dbe3f6f7626d0d65b8cd3548bd52bf3ed1
                            • Instruction ID: b8890e923de6b125a03da367865ef3d5df263d0e8778939ca38c849b01d291c1
                            • Opcode Fuzzy Hash: 98bfd2f5e22b1f88b17dc59e569d18dbe3f6f7626d0d65b8cd3548bd52bf3ed1
                            • Instruction Fuzzy Hash: F8510F71E00605AFDB19DF68DD89AAE7BB6EF48300F148229F516E6790DB749E00CB64
                            Function 00688BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00688F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00688BE8,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 00688FC5
                            • DestroyWindow.USER32(?), ref: 00688C81
                            • KillTimer.USER32(00000000,?,?,?,?,00688BBA,00000000,?), ref: 00688D1B
                            • DestroyAcceleratorTable.USER32(00000000), ref: 006C6973
                            • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 006C69A1
                            • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00688BBA,00000000,?), ref: 006C69B8
                            • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00688BBA,00000000), ref: 006C69D4
                            • DeleteObject.GDI32(00000000), ref: 006C69E6
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                            • String ID:
                            • API String ID: 641708696-0
                            • Opcode ID: aaf47ed9c6cc6f320251c6b64ddc872e59e06962512f3fb33fec506f31cb1681
                            • Instruction ID: 1ca89b431d50c5069f4d831457f0a260187e184a06f5488fdec6be964d5a07eb
                            • Opcode Fuzzy Hash: aaf47ed9c6cc6f320251c6b64ddc872e59e06962512f3fb33fec506f31cb1681
                            • Instruction Fuzzy Hash: BB618A34502701DFDB22AF18DA48B6577F2FB41312F94861DE0429B6A4CB79B9C1CF98
                            Function 00689838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689944: GetWindowLongW.USER32(?,000000EB), ref: 00689952
                            • GetSysColor.USER32(0000000F), ref: 00689862
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ColorLongWindow
                            • String ID:
                            • API String ID: 259745315-0
                            • Opcode ID: 328cb60297e60e9bf15300406d301148116d0df6aa026a30e1c8f777823848aa
                            • Instruction ID: e52e004d583642cb01283189c00defd61ce432b574e60e9f3f89c614e2938649
                            • Opcode Fuzzy Hash: 328cb60297e60e9bf15300406d301148116d0df6aa026a30e1c8f777823848aa
                            • Instruction Fuzzy Hash: F0419671104645EFDB216F389C44BB93766EB06334F188B19F9A28B2E1DB759C42DB20
                            Function 006D96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,006BF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 006D9717
                            • LoadStringW.USER32(00000000,?,006BF7F8,00000001), ref: 006D9720
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,006BF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 006D9742
                            • LoadStringW.USER32(00000000,?,006BF7F8,00000001), ref: 006D9745
                            • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 006D9866
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: HandleLoadModuleString$Message_wcslen
                            • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                            • API String ID: 747408836-2268648507
                            • Opcode ID: f218c632600391795562a37485fc94745407adae8903452e2b4b7d3dbeed3941
                            • Instruction ID: e88a33200d289d6c6b95c8ef20e301fcce249961e015a2614b5129aea5058c98
                            • Opcode Fuzzy Hash: f218c632600391795562a37485fc94745407adae8903452e2b4b7d3dbeed3941
                            • Instruction Fuzzy Hash: 90416C72C00219AADF44EBE0CD82DEEB37AAF15300F108529F60972192EB356F48CB75
                            Function 006D06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                            • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 006D07A2
                            • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 006D07BE
                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 006D07DA
                            • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 006D0804
                            • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 006D082C
                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006D0837
                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006D083C
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                            • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                            • API String ID: 323675364-22481851
                            • Opcode ID: a9881d0144a0a05913e14e8e5d124ddd87658b370fac4669da6d6e9cfdd7caaf
                            • Instruction ID: 0ed36880d66cbd24368fc716ecac9dd041d006da39c4ec6a8097c00d51165bd1
                            • Opcode Fuzzy Hash: a9881d0144a0a05913e14e8e5d124ddd87658b370fac4669da6d6e9cfdd7caaf
                            • Instruction Fuzzy Hash: 08410A72C10229EBDF15EBA4DC95DEDB779BF44350F048229E905A72A1EB346E04CBA4
                            Function 006F3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                            Download Yara Rule
                            APIs
                            • VariantInit.OLEAUT32(?), ref: 006F3C5C
                            • CoInitialize.OLE32(00000000), ref: 006F3C8A
                            • CoUninitialize.OLE32 ref: 006F3C94
                            • _wcslen.LIBCMT ref: 006F3D2D
                            • GetRunningObjectTable.OLE32(00000000,?), ref: 006F3DB1
                            • SetErrorMode.KERNEL32(00000001,00000029), ref: 006F3ED5
                            • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 006F3F0E
                            • CoGetObject.OLE32(?,00000000,0070FB98,?), ref: 006F3F2D
                            • SetErrorMode.KERNEL32(00000000), ref: 006F3F40
                            • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 006F3FC4
                            • VariantClear.OLEAUT32(?), ref: 006F3FD8
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                            • String ID:
                            • API String ID: 429561992-0
                            • Opcode ID: 12c4439d26d736bc30bed016d242f205dbeacd21f68ec14685d377ec7dcc396c
                            • Instruction ID: 4a8118ed2c5f70a036d2bd05c45ab184e61aff1f501f153b86f7dfccd54ccecf
                            • Opcode Fuzzy Hash: 12c4439d26d736bc30bed016d242f205dbeacd21f68ec14685d377ec7dcc396c
                            • Instruction Fuzzy Hash: 50C134716082199FD700DF68C88496BB7EAFF89744F104A1DFA8A9B350DB30EE45CB52
                            Function 006E7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                            Download Yara Rule
                            APIs
                            • CoInitialize.OLE32(00000000), ref: 006E7AF3
                            • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 006E7B8F
                            • SHGetDesktopFolder.SHELL32(?), ref: 006E7BA3
                            • CoCreateInstance.OLE32(0070FD08,00000000,00000001,00736E6C,?), ref: 006E7BEF
                            • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 006E7C74
                            • CoTaskMemFree.OLE32(?,?), ref: 006E7CCC
                            • SHBrowseForFolderW.SHELL32(?), ref: 006E7D57
                            • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 006E7D7A
                            • CoTaskMemFree.OLE32(00000000), ref: 006E7D81
                            • CoTaskMemFree.OLE32(00000000), ref: 006E7DD6
                            • CoUninitialize.OLE32 ref: 006E7DDC
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                            • String ID:
                            • API String ID: 2762341140-0
                            • Opcode ID: 6f4c9f2fc47643ea8de3317b68c1ef10ccefb17d1c6bf1c58daff180c2ee3d6e
                            • Instruction ID: 74d85b28364ef1653eaa2a56cf05f6dde8a0b73ccb3bd0f83c222d77a08fedef
                            • Opcode Fuzzy Hash: 6f4c9f2fc47643ea8de3317b68c1ef10ccefb17d1c6bf1c58daff180c2ee3d6e
                            • Instruction Fuzzy Hash: E6C12B75A04249EFDB14DFA5C884DAEBBFAFF48304B148598E4199B361DB30ED41CB94
                            Function 0070541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00705504
                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00705515
                            • CharNextW.USER32(00000158), ref: 00705544
                            • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00705585
                            • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0070559B
                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007055AC
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$CharNext
                            • String ID:
                            • API String ID: 1350042424-0
                            • Opcode ID: 327be51e2c9e1a74ccf626f39fd0134430ecbab8084fce7a0057384488596e6b
                            • Instruction ID: a734c807abe54dd48093e0c75fb0ce57bfccc1ba558619dafd82c643c879ed4c
                            • Opcode Fuzzy Hash: 327be51e2c9e1a74ccf626f39fd0134430ecbab8084fce7a0057384488596e6b
                            • Instruction Fuzzy Hash: 13615B74900608EBDF219F54CC84DFF7BB9EB05720F108245F925AA2D0DB799A81DF60
                            Function 006CFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                            Download Yara Rule
                            APIs
                            • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 006CFAAF
                            • SafeArrayAllocData.OLEAUT32(?), ref: 006CFB08
                            • VariantInit.OLEAUT32(?), ref: 006CFB1A
                            • SafeArrayAccessData.OLEAUT32(?,?), ref: 006CFB3A
                            • VariantCopy.OLEAUT32(?,?), ref: 006CFB8D
                            • SafeArrayUnaccessData.OLEAUT32(?), ref: 006CFBA1
                            • VariantClear.OLEAUT32(?), ref: 006CFBB6
                            • SafeArrayDestroyData.OLEAUT32(?), ref: 006CFBC3
                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006CFBCC
                            • VariantClear.OLEAUT32(?), ref: 006CFBDE
                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006CFBE9
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                            • String ID:
                            • API String ID: 2706829360-0
                            • Opcode ID: 57ab6e5875efb83cf7ff0572f58bac005fb5340e0f5dd77bfef27b310f1f8488
                            • Instruction ID: 181a7d2077082db62aa23a4df02752fdf68bbdb2603554ef9a56183b50353b3c
                            • Opcode Fuzzy Hash: 57ab6e5875efb83cf7ff0572f58bac005fb5340e0f5dd77bfef27b310f1f8488
                            • Instruction Fuzzy Hash: 0C412D35A00219DFCB01DFA4C854EAEBBBAFF48354F008169F945A7261CB34A945CBA4
                            Function 006D9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                            Download Yara Rule
                            APIs
                            • GetKeyboardState.USER32(?), ref: 006D9CA1
                            • GetAsyncKeyState.USER32(000000A0), ref: 006D9D22
                            • GetKeyState.USER32(000000A0), ref: 006D9D3D
                            • GetAsyncKeyState.USER32(000000A1), ref: 006D9D57
                            • GetKeyState.USER32(000000A1), ref: 006D9D6C
                            • GetAsyncKeyState.USER32(00000011), ref: 006D9D84
                            • GetKeyState.USER32(00000011), ref: 006D9D96
                            • GetAsyncKeyState.USER32(00000012), ref: 006D9DAE
                            • GetKeyState.USER32(00000012), ref: 006D9DC0
                            • GetAsyncKeyState.USER32(0000005B), ref: 006D9DD8
                            • GetKeyState.USER32(0000005B), ref: 006D9DEA
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: State$Async$Keyboard
                            • String ID:
                            • API String ID: 541375521-0
                            • Opcode ID: ffc35d464b064dcc2fe2f3f342ab2ee89f0ae8e065074cc6c9abd8e13ad10c8b
                            • Instruction ID: 5a30da5daaa968037de1f73e417270c2614892c234c451546d896a52e3368c9e
                            • Opcode Fuzzy Hash: ffc35d464b064dcc2fe2f3f342ab2ee89f0ae8e065074cc6c9abd8e13ad10c8b
                            • Instruction Fuzzy Hash: B641C634D04BC969FF31976088043F5BEA3AF12344F04815BDAC6567C2EBA599C8CBB2
                            Function 006F055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                            Download Yara Rule
                            APIs
                            • WSAStartup.WSOCK32(00000101,?), ref: 006F05BC
                            • inet_addr.WSOCK32(?), ref: 006F061C
                            • gethostbyname.WSOCK32(?), ref: 006F0628
                            • IcmpCreateFile.IPHLPAPI ref: 006F0636
                            • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006F06C6
                            • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006F06E5
                            • IcmpCloseHandle.IPHLPAPI(?), ref: 006F07B9
                            • WSACleanup.WSOCK32 ref: 006F07BF
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                            • String ID: Ping
                            • API String ID: 1028309954-2246546115
                            • Opcode ID: 775c5b89742647b63f47cbbf640a47d6fa78c756694e214f89d9f8d6b5aaa7e6
                            • Instruction ID: d1b404af06126d7a71fa56de53c2b067b551c47ffdcd0e2d3ac908411c2ffa36
                            • Opcode Fuzzy Hash: 775c5b89742647b63f47cbbf640a47d6fa78c756694e214f89d9f8d6b5aaa7e6
                            • Instruction Fuzzy Hash: C3918E75608205EFE720DF15C488F6ABBE2AF44318F1486A9F5698B7A2C774EC41CF91
                            Function 006F8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$BuffCharLower
                            • String ID: cdecl$none$stdcall$winapi
                            • API String ID: 707087890-567219261
                            • Opcode ID: b61a649eb86b0846f53e913e0a36edb375c92a6729bcc895bbb516ab15cda69e
                            • Instruction ID: b0d4fb03cef16580cd8028ebff4218d2a3d975d9bd7987a602127c064e313e1b
                            • Opcode Fuzzy Hash: b61a649eb86b0846f53e913e0a36edb375c92a6729bcc895bbb516ab15cda69e
                            • Instruction Fuzzy Hash: 6B519E32A0451A9FCF24DF68C9518FEB7A7AF64320B2042A9E626E7385DB34DD41C790
                            Function 006F372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                            Download Yara Rule
                            APIs
                            • CoInitialize.OLE32 ref: 006F3774
                            • CoUninitialize.OLE32 ref: 006F377F
                            • CoCreateInstance.OLE32(?,00000000,00000017,0070FB78,?), ref: 006F37D9
                            • IIDFromString.OLE32(?,?), ref: 006F384C
                            • VariantInit.OLEAUT32(?), ref: 006F38E4
                            • VariantClear.OLEAUT32(?), ref: 006F3936
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                            • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                            • API String ID: 636576611-1287834457
                            • Opcode ID: ca1595b1b73097d9e7054436b86c5c5ba2444f72b391f7893bfcfc508d679485
                            • Instruction ID: 728f2c91f1d38496da38f506c30bada1fc0b5692b257b17e82ad5021262fc189
                            • Opcode Fuzzy Hash: ca1595b1b73097d9e7054436b86c5c5ba2444f72b391f7893bfcfc508d679485
                            • Instruction Fuzzy Hash: 2E61D1B0608315AFD310EF54C849BAAB7E6EF48740F10490DFA959B391C774EE49CB9A
                            Function 006E3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                            Download Yara Rule
                            APIs
                            • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 006E33CF
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 006E33F0
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LoadString$_wcslen
                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                            • API String ID: 4099089115-3080491070
                            • Opcode ID: 36fc71dfe559c3e2d8e63f1aad4a75d3ae90e3a326a8ae3857bc2247fc7ebd21
                            • Instruction ID: 6332a1571332a80c1a12b0048c682531dd1445d6e6c6d1eb5d57d30b44fc5816
                            • Opcode Fuzzy Hash: 36fc71dfe559c3e2d8e63f1aad4a75d3ae90e3a326a8ae3857bc2247fc7ebd21
                            • Instruction Fuzzy Hash: 8D51B371C00259BADF15EBA0CD46DEEB7BAAF04300F108169F10973292EB352F58DB65
                            Function 006DB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$BuffCharUpper
                            • String ID: APPEND$EXISTS$KEYS$REMOVE
                            • API String ID: 1256254125-769500911
                            • Opcode ID: d0dd55cb5235c66e5266a18c2eaf958ac2582ca189e5d53547ca5e023834583b
                            • Instruction ID: c07c7f91aa5c155e24574400f58cf3a28726ab3745187b0d98c3348f4dea4880
                            • Opcode Fuzzy Hash: d0dd55cb5235c66e5266a18c2eaf958ac2582ca189e5d53547ca5e023834583b
                            • Instruction Fuzzy Hash: A841D632E00066DBCB205F7D88905FE77A7AFA5B54B26522BE425D7388E735CD82C790
                            Function 006E5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                            Download Yara Rule
                            APIs
                            • SetErrorMode.KERNEL32(00000001), ref: 006E53A0
                            • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 006E5416
                            • GetLastError.KERNEL32 ref: 006E5420
                            • SetErrorMode.KERNEL32(00000000,READY), ref: 006E54A7
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Error$Mode$DiskFreeLastSpace
                            • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                            • API String ID: 4194297153-14809454
                            • Opcode ID: 137c6b1f4c97a972b94867157da81f31cc24563ba5cdc47bbb07ecf85cce6d39
                            • Instruction ID: ac43dc98e7e11303504f6328590e8d4bdc9b4bfb5596be3d7344ed7217b4b1ad
                            • Opcode Fuzzy Hash: 137c6b1f4c97a972b94867157da81f31cc24563ba5cdc47bbb07ecf85cce6d39
                            • Instruction Fuzzy Hash: C731AC35A01244DFDB11DF69C484AEABBF6EB04309F14C069E406CB392DB74DD86CBA1
                            Function 00703C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                            Download Yara Rule
                            APIs
                            • CreateMenu.USER32 ref: 00703C79
                            • SetMenu.USER32(?,00000000), ref: 00703C88
                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00703D10
                            • IsMenu.USER32(?), ref: 00703D24
                            • CreatePopupMenu.USER32 ref: 00703D2E
                            • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00703D5B
                            • DrawMenuBar.USER32 ref: 00703D63
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Menu$CreateItem$DrawInfoInsertPopup
                            • String ID: 0$F
                            • API String ID: 161812096-3044882817
                            • Opcode ID: b6137f507a5e15da5d220fe19247360a4d3aaf24f2c28cfb71b214849973b37c
                            • Instruction ID: 8c8d0fcb77cd4084e3e267be4c64758d3de50dd981e6d71230554a24ea59f265
                            • Opcode Fuzzy Hash: b6137f507a5e15da5d220fe19247360a4d3aaf24f2c28cfb71b214849973b37c
                            • Instruction Fuzzy Hash: 1D417C79A01209EFDB14CF64D844EAA7BF9FF49350F144229F946973A0D738AA10DF94
                            Function 00703A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00703A9D
                            • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00703AA0
                            • GetWindowLongW.USER32(?,000000F0), ref: 00703AC7
                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00703AEA
                            • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00703B62
                            • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00703BAC
                            • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00703BC7
                            • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00703BE2
                            • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00703BF6
                            • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00703C13
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$LongWindow
                            • String ID:
                            • API String ID: 312131281-0
                            • Opcode ID: 80e6f623b977867c3f8ceacc3ee196842cc9995b33ddcde4c2c7264bf7cafc8e
                            • Instruction ID: 269b861bf384352031b736c45742c4dfefb650575eecca30bf3f780f22a4608e
                            • Opcode Fuzzy Hash: 80e6f623b977867c3f8ceacc3ee196842cc9995b33ddcde4c2c7264bf7cafc8e
                            • Instruction Fuzzy Hash: F7616975900248EFDB10DFA8CC81EEE77F8AB09704F10419AFA15E72D1D778AA81DB64
                            Function 006DB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentThreadId.KERNEL32 ref: 006DB151
                            • GetForegroundWindow.USER32(00000000,?,?,?,?,?,006DA1E1,?,00000001), ref: 006DB165
                            • GetWindowThreadProcessId.USER32(00000000), ref: 006DB16C
                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006DA1E1,?,00000001), ref: 006DB17B
                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 006DB18D
                            • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,006DA1E1,?,00000001), ref: 006DB1A6
                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006DA1E1,?,00000001), ref: 006DB1B8
                            • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,006DA1E1,?,00000001), ref: 006DB1FD
                            • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,006DA1E1,?,00000001), ref: 006DB212
                            • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,006DA1E1,?,00000001), ref: 006DB21D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                            • String ID:
                            • API String ID: 2156557900-0
                            • Opcode ID: 709db3c2d605a110ee1de1f72972df33dfe07301fd35ddd4137e5bcf8a55d026
                            • Instruction ID: 4d44701a26dec6edc523765ff71ca5aaf90a7c126363c9b605291b6250ed83b5
                            • Opcode Fuzzy Hash: 709db3c2d605a110ee1de1f72972df33dfe07301fd35ddd4137e5bcf8a55d026
                            • Instruction Fuzzy Hash: A331D476900204FFDB219F24EC84BBD7B7BBB11355F159206F904CA360C7B99A008F28
                            Function 006A2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                            Download Yara Rule
                            APIs
                            • _free.LIBCMT ref: 006A2C94
                              • Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
                              • Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0
                            • _free.LIBCMT ref: 006A2CA0
                            • _free.LIBCMT ref: 006A2CAB
                            • _free.LIBCMT ref: 006A2CB6
                            • _free.LIBCMT ref: 006A2CC1
                            • _free.LIBCMT ref: 006A2CCC
                            • _free.LIBCMT ref: 006A2CD7
                            • _free.LIBCMT ref: 006A2CE2
                            • _free.LIBCMT ref: 006A2CED
                            • _free.LIBCMT ref: 006A2CFB
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free$ErrorFreeHeapLast
                            • String ID:
                            • API String ID: 776569668-0
                            • Opcode ID: 16eb800bdcc9db27220e0630d8d83e263acc969aadf3040afade471a50d397ef
                            • Instruction ID: 2480636e62e1127ee3153409c0342597b5ae6d768a43d625537857cd2ceee47b
                            • Opcode Fuzzy Hash: 16eb800bdcc9db27220e0630d8d83e263acc969aadf3040afade471a50d397ef
                            • Instruction Fuzzy Hash: DA11B476140109AFCB82FF59D852CDE3BA6BF06B50F4144A8FA485B222D631FE509F95
                            Function 00671410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                            Download Yara Rule
                            APIs
                            • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00671459
                            • OleUninitialize.OLE32(?,00000000), ref: 006714F8
                            • UnregisterHotKey.USER32(?), ref: 006716DD
                            • DestroyWindow.USER32(?), ref: 006B24B9
                            • FreeLibrary.KERNEL32(?), ref: 006B251E
                            • VirtualFree.KERNEL32(?,00000000,00008000), ref: 006B254B
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                            • String ID: close all
                            • API String ID: 469580280-3243417748
                            • Opcode ID: 856892b5a5606782d831c6a495c4e96ee88cabd23999be56aac0b108226e2b31
                            • Instruction ID: 927b685f9bbf8cfe650c89af0845d1b7cbd8d0ad1a0f7164b3d11022540d3d52
                            • Opcode Fuzzy Hash: 856892b5a5606782d831c6a495c4e96ee88cabd23999be56aac0b108226e2b31
                            • Instruction Fuzzy Hash: 62D18E71701212CFDB29EF18C4A9AA9F7E2BF05700F1482AEE54A6B351DB30AD52CF55
                            Function 00675BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                            Download Yara Rule
                            APIs
                            • SetWindowLongW.USER32(?,000000EB), ref: 00675C7A
                              • Part of subcall function 00675D0A: GetClientRect.USER32(?,?), ref: 00675D30
                              • Part of subcall function 00675D0A: GetWindowRect.USER32(?,?), ref: 00675D71
                              • Part of subcall function 00675D0A: ScreenToClient.USER32(?,?), ref: 00675D99
                            • GetDC.USER32 ref: 006B46F5
                            • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 006B4708
                            • SelectObject.GDI32(00000000,00000000), ref: 006B4716
                            • SelectObject.GDI32(00000000,00000000), ref: 006B472B
                            • ReleaseDC.USER32(?,00000000), ref: 006B4733
                            • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 006B47C4
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                            • String ID: U
                            • API String ID: 4009187628-3372436214
                            • Opcode ID: ff04cab823feff746b34d3623d4e0730097820abae555fc08eb0b52d3d73e30c
                            • Instruction ID: 56a4a7f4c551402d30aa8a1c753861c8eb8c94e1a921f43753e733e01f9e371b
                            • Opcode Fuzzy Hash: ff04cab823feff746b34d3623d4e0730097820abae555fc08eb0b52d3d73e30c
                            • Instruction Fuzzy Hash: 4971E274400205DFCF228F64C984AFA3BB7FF4A320F148269E9565A2A7DF359881DF50
                            Function 006E359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                            Download Yara Rule
                            APIs
                            • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006E35E4
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • LoadStringW.USER32(00742390,?,00000FFF,?), ref: 006E360A
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LoadString$_wcslen
                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                            • API String ID: 4099089115-2391861430
                            • Opcode ID: f556bbcb8fbaa060eef07c1fe9aed4f83925a3fa0ab40b92da91887a16fd59a8
                            • Instruction ID: 289bf1b2a2f7ef3a4ab94a7f569c0a6635afa9856c27148bfbcd2b5301964a42
                            • Opcode Fuzzy Hash: f556bbcb8fbaa060eef07c1fe9aed4f83925a3fa0ab40b92da91887a16fd59a8
                            • Instruction Fuzzy Hash: B6519171C00259BADF15EBA0CC46EEEBB76AF14300F148129F10972292EB355B99DF69
                            Function 006EC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                            Download Yara Rule
                            APIs
                            • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006EC272
                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006EC29A
                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006EC2CA
                            • GetLastError.KERNEL32 ref: 006EC322
                            • SetEvent.KERNEL32(?), ref: 006EC336
                            • InternetCloseHandle.WININET(00000000), ref: 006EC341
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                            • String ID:
                            • API String ID: 3113390036-3916222277
                            • Opcode ID: 534321841cdee73a0bd96cbf20d4494e9afd67dbf064f1bc0ad7a32b2873500a
                            • Instruction ID: 6b8dc29ae11dd4f7baabd4194764310d4b09079b7dc793e85ce2b8364c37bc74
                            • Opcode Fuzzy Hash: 534321841cdee73a0bd96cbf20d4494e9afd67dbf064f1bc0ad7a32b2873500a
                            • Instruction Fuzzy Hash: 4231A0B1501344AFD7229F66CC88AAB7BFEEB49760F14861DF446D3200DB34DD069B65
                            Function 006D989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,006B3AAF,?,?,Bad directive syntax error,0070CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 006D98BC
                            • LoadStringW.USER32(00000000,?,006B3AAF,?), ref: 006D98C3
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 006D9987
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: HandleLoadMessageModuleString_wcslen
                            • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                            • API String ID: 858772685-4153970271
                            • Opcode ID: 0e62534a549bab04a9cc680941c7856668960b578afbbc960446cb70cbd4106a
                            • Instruction ID: f0ee5a71202398247aa237a0f0fe28285e375a8d004a621424737556ab49968c
                            • Opcode Fuzzy Hash: 0e62534a549bab04a9cc680941c7856668960b578afbbc960446cb70cbd4106a
                            • Instruction Fuzzy Hash: 94219171C0021AFBDF26AF90CC16EEE777AFF18300F04851AF519661A2EB359618DB25
                            Function 006D209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetParent.USER32 ref: 006D20AB
                            • GetClassNameW.USER32(00000000,?,00000100), ref: 006D20C0
                            • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 006D214D
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ClassMessageNameParentSend
                            • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                            • API String ID: 1290815626-3381328864
                            • Opcode ID: b41218cc65bf28b62434a9ab74909b6c7e2e0f6123a34fe110dccd862d7c2bd5
                            • Instruction ID: 68ed46c8bfa399d94d3b2bc990430dafc8b527ab5ceaa0c4279dfb5e14adf831
                            • Opcode Fuzzy Hash: b41218cc65bf28b62434a9ab74909b6c7e2e0f6123a34fe110dccd862d7c2bd5
                            • Instruction Fuzzy Hash: 6D110AB6A84707B9FA112221DC17DE6779DCF25724F20821BF704A52D2EE6558435618
                            Function 006ACE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                            • String ID:
                            • API String ID: 1282221369-0
                            • Opcode ID: 133253ee5374471779c4172d7abc5b92c3ba4258a56ac5eefa124f9cd37f2f61
                            • Instruction ID: a5c455049e7455b1a96b77c536fd450dc88ee893fd5376cb2bc9e6dd28625f22
                            • Opcode Fuzzy Hash: 133253ee5374471779c4172d7abc5b92c3ba4258a56ac5eefa124f9cd37f2f61
                            • Instruction Fuzzy Hash: 4E6159B2A04301AFDF21BFB89851AAA7B97AF03730F04416EFA5597381D7359D018FA5
                            Function 007050D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00705186
                            • ShowWindow.USER32(?,00000000), ref: 007051C7
                            • ShowWindow.USER32(?,00000005,?,00000000), ref: 007051CD
                            • SetFocus.USER32(?,?,00000005,?,00000000), ref: 007051D1
                              • Part of subcall function 00706FBA: DeleteObject.GDI32(00000000), ref: 00706FE6
                            • GetWindowLongW.USER32(?,000000F0), ref: 0070520D
                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0070521A
                            • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0070524D
                            • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00705287
                            • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00705296
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                            • String ID:
                            • API String ID: 3210457359-0
                            • Opcode ID: 13a5069e973a49cdbb1f52b41b4e2ef9b8201fb5861d674d9071d545811cda96
                            • Instruction ID: b55219d3064e295784a008a0e40e111670cd3c32dbd18cd714c80928bc60ec33
                            • Opcode Fuzzy Hash: 13a5069e973a49cdbb1f52b41b4e2ef9b8201fb5861d674d9071d545811cda96
                            • Instruction Fuzzy Hash: FF516D70A50A08FEEF209F28CC49B9A3BE5BF05321F148315F615962E1C779A990DF55
                            Function 00688B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                            Download Yara Rule
                            APIs
                            • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 006C6890
                            • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 006C68A9
                            • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 006C68B9
                            • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 006C68D1
                            • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 006C68F2
                            • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00688874,00000000,00000000,00000000,000000FF,00000000), ref: 006C6901
                            • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 006C691E
                            • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00688874,00000000,00000000,00000000,000000FF,00000000), ref: 006C692D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Icon$DestroyExtractImageLoadMessageSend
                            • String ID:
                            • API String ID: 1268354404-0
                            • Opcode ID: 83eee9bb4338ece1ca243d5ade8f9222c247673d17612b82696b385c777376f1
                            • Instruction ID: 11c1b7d6e4c4fd7440daaefc27349bbe68ec01c10865dc60e74c4faa74f3f2c3
                            • Opcode Fuzzy Hash: 83eee9bb4338ece1ca243d5ade8f9222c247673d17612b82696b385c777376f1
                            • Instruction Fuzzy Hash: 73518A70600209EFDB20EF24CC95FAA7BB6FB98750F10861CF906972A0DB75E991DB54
                            Function 006EC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                            Download Yara Rule
                            APIs
                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006EC182
                            • GetLastError.KERNEL32 ref: 006EC195
                            • SetEvent.KERNEL32(?), ref: 006EC1A9
                              • Part of subcall function 006EC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006EC272
                              • Part of subcall function 006EC253: GetLastError.KERNEL32 ref: 006EC322
                              • Part of subcall function 006EC253: SetEvent.KERNEL32(?), ref: 006EC336
                              • Part of subcall function 006EC253: InternetCloseHandle.WININET(00000000), ref: 006EC341
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                            • String ID:
                            • API String ID: 337547030-0
                            • Opcode ID: 4bde984bd5a0a5102e1fa382b73acccb489b9f2b38515589985090938373ffef
                            • Instruction ID: 3f852aab8c719eeacf9336fcba470bb4d767cc59c85f59e8b132b2dc38c49155
                            • Opcode Fuzzy Hash: 4bde984bd5a0a5102e1fa382b73acccb489b9f2b38515589985090938373ffef
                            • Instruction Fuzzy Hash: 7E31A371101781EFDB219FA6DC04AA6BBFAFF14320B00861DFA5683610DB34E9169B64
                            Function 006D25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006D3A57
                              • Part of subcall function 006D3A3D: GetCurrentThreadId.KERNEL32 ref: 006D3A5E
                              • Part of subcall function 006D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006D25B3), ref: 006D3A65
                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 006D25BD
                            • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006D25DB
                            • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 006D25DF
                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 006D25E9
                            • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 006D2601
                            • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 006D2605
                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 006D260F
                            • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 006D2623
                            • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 006D2627
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                            • String ID:
                            • API String ID: 2014098862-0
                            • Opcode ID: 42bcdcc8216e6f440b01744f77bfa3ac36723d3d482e0630b665d0cd65ee62ee
                            • Instruction ID: 78124d093e3c95c5c994b836859b608e8672a83bf00d1a3de96a0930037dff10
                            • Opcode Fuzzy Hash: 42bcdcc8216e6f440b01744f77bfa3ac36723d3d482e0630b665d0cd65ee62ee
                            • Instruction Fuzzy Hash: 5301D870790214FBFB2167689C8AF593F59DB5EB11F104246F314AF1D1CDE258448AAE
                            Function 006D1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                            Download Yara Rule
                            APIs
                            • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,006D1449,?,?,00000000), ref: 006D180C
                            • HeapAlloc.KERNEL32(00000000,?,006D1449,?,?,00000000), ref: 006D1813
                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,006D1449,?,?,00000000), ref: 006D1828
                            • GetCurrentProcess.KERNEL32(?,00000000,?,006D1449,?,?,00000000), ref: 006D1830
                            • DuplicateHandle.KERNEL32(00000000,?,006D1449,?,?,00000000), ref: 006D1833
                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,006D1449,?,?,00000000), ref: 006D1843
                            • GetCurrentProcess.KERNEL32(006D1449,00000000,?,006D1449,?,?,00000000), ref: 006D184B
                            • DuplicateHandle.KERNEL32(00000000,?,006D1449,?,?,00000000), ref: 006D184E
                            • CreateThread.KERNEL32(00000000,00000000,006D1874,00000000,00000000,00000000), ref: 006D1868
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                            • String ID:
                            • API String ID: 1957940570-0
                            • Opcode ID: ef672dc6a7adb94e9f1a8c74c72bb4892f120e7c400fedcefb95a5c3decefa95
                            • Instruction ID: eb80c960bd1e4e1e56d19bb185b584f443b2bd7f861571f33673b222af157613
                            • Opcode Fuzzy Hash: ef672dc6a7adb94e9f1a8c74c72bb4892f120e7c400fedcefb95a5c3decefa95
                            • Instruction Fuzzy Hash: 1E01ACB5640308FFE611EB65DC4AF577B6CEB89B11F018611FA05DB191CA749800CB24
                            Function 006FA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006DD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 006DD501
                              • Part of subcall function 006DD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 006DD50F
                              • Part of subcall function 006DD4DC: CloseHandle.KERNEL32(00000000), ref: 006DD5DC
                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 006FA16D
                            • GetLastError.KERNEL32 ref: 006FA180
                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 006FA1B3
                            • TerminateProcess.KERNEL32(00000000,00000000), ref: 006FA268
                            • GetLastError.KERNEL32(00000000), ref: 006FA273
                            • CloseHandle.KERNEL32(00000000), ref: 006FA2C4
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                            • String ID: SeDebugPrivilege
                            • API String ID: 2533919879-2896544425
                            • Opcode ID: e0d3e699506787f02dc4f3318e44963931f2818e6f9fd1c74c04ed9a07d09146
                            • Instruction ID: 5aff731c2cb228ab64cf7577421d54f0aa21ffd12b1a4c9f7018611e4f2106aa
                            • Opcode Fuzzy Hash: e0d3e699506787f02dc4f3318e44963931f2818e6f9fd1c74c04ed9a07d09146
                            • Instruction Fuzzy Hash: 7D61B0B02042429FD710DF58C494F69BBE2AF44318F18C58CE56A4B7A3C776ED45CB96
                            Function 00703886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00703925
                            • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0070393A
                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00703954
                            • _wcslen.LIBCMT ref: 00703999
                            • SendMessageW.USER32(?,00001057,00000000,?), ref: 007039C6
                            • SendMessageW.USER32(?,00001061,?,0000000F), ref: 007039F4
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$Window_wcslen
                            • String ID: SysListView32
                            • API String ID: 2147712094-78025650
                            • Opcode ID: 45b8f4a1b36e9b1665477addd177c8265be09fd54c07bac0a3de18a97d0a1e0d
                            • Instruction ID: 6a04596dacc7579b1bf9a65f365954b6a0a13a3359edfcdffeb357a65b6c391e
                            • Opcode Fuzzy Hash: 45b8f4a1b36e9b1665477addd177c8265be09fd54c07bac0a3de18a97d0a1e0d
                            • Instruction Fuzzy Hash: 3241B271A00219EBEF219F64CC49BEA77EDEF08354F10426AF958E72C1D7799980CB94
                            Function 006DBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006DBCFD
                            • IsMenu.USER32(00000000), ref: 006DBD1D
                            • CreatePopupMenu.USER32 ref: 006DBD53
                            • GetMenuItemCount.USER32(00D04D40), ref: 006DBDA4
                            • InsertMenuItemW.USER32(00D04D40,?,00000001,00000030), ref: 006DBDCC
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Menu$Item$CountCreateInfoInsertPopup
                            • String ID: 0$2
                            • API String ID: 93392585-3793063076
                            • Opcode ID: f02747dc1e7ad89c70dae8c27a68677f28f715c5778d199a7794ffdf1d1114ea
                            • Instruction ID: 67e2e791c30c30440180751ad8677cd07bd525d73a6c99bf25441ff0efcd3803
                            • Opcode Fuzzy Hash: f02747dc1e7ad89c70dae8c27a68677f28f715c5778d199a7794ffdf1d1114ea
                            • Instruction Fuzzy Hash: 3751AC70E00209EBDB21CFA8D884BEEBBF7AF49314F25921AE441D7398D7709941CB65
                            Function 00692D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON
                            Download Yara Rule
                            APIs
                            • _ValidateLocalCookies.LIBCMT ref: 00692D4B
                            • ___except_validate_context_record.LIBVCRUNTIME ref: 00692D53
                            • _ValidateLocalCookies.LIBCMT ref: 00692DE1
                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00692E0C
                            • _ValidateLocalCookies.LIBCMT ref: 00692E61
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                            • String ID: &Hi$csm
                            • API String ID: 1170836740-3182968335
                            • Opcode ID: 909f681e87e1e587ee92a4b9eb82afdf5526e11797724bdb8d726598732fcb99
                            • Instruction ID: 3205d1a90cf8b17c2e74eb8b6ecceb0443587f409363a963727d850fb2be1d8c
                            • Opcode Fuzzy Hash: 909f681e87e1e587ee92a4b9eb82afdf5526e11797724bdb8d726598732fcb99
                            • Instruction Fuzzy Hash: A941A434A0121AABCF10DF68C855ADEBBBABF44324F148159E8146B792D7359A45CBD0
                            Function 006DC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                            Download Yara Rule
                            APIs
                            • LoadIconW.USER32(00000000,00007F03), ref: 006DC913
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: IconLoad
                            • String ID: blank$info$question$stop$warning
                            • API String ID: 2457776203-404129466
                            • Opcode ID: e9d624c311c0e71f7b73fe18215acae04106180f67581b12c18cb07225661f46
                            • Instruction ID: 52e4f56932625c58140859cf7a9a9701aba3c97470f322aa8a4e4dc35698d684
                            • Opcode Fuzzy Hash: e9d624c311c0e71f7b73fe18215acae04106180f67581b12c18cb07225661f46
                            • Instruction Fuzzy Hash: AA110D31E8930FBAEB015B55DC93CEA679DDF15374B50412FF504AA382EF745D029268
                            Function 006DED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$LocalTime
                            • String ID:
                            • API String ID: 952045576-0
                            • Opcode ID: 93a89ff810cfe9e4dbb9530c6e21bfcad32dad85b7d329cf7135e2ac6aefaef2
                            • Instruction ID: 6f74209bb422ebd463b90c110a7ff70d944093fd40f6959a18d3bd15cc6144fb
                            • Opcode Fuzzy Hash: 93a89ff810cfe9e4dbb9530c6e21bfcad32dad85b7d329cf7135e2ac6aefaef2
                            • Instruction Fuzzy Hash: DD418E65C1021865CF51EBB4C88A9CFB7AEAF45710F50856BF518E3622EB34E345C3E9
                            Function 0068F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                            Download Yara Rule
                            APIs
                            • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,006C682C,00000004,00000000,00000000), ref: 0068F953
                            • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,006C682C,00000004,00000000,00000000), ref: 006CF3D1
                            • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,006C682C,00000004,00000000,00000000), ref: 006CF454
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ShowWindow
                            • String ID:
                            • API String ID: 1268545403-0
                            • Opcode ID: ca43b4238af6012c062c7364d1455d49cb1c7e6e58f5f5f1de72d825ec9d365b
                            • Instruction ID: 4761b7dd533359bf66a192223f631e206caa7a11c7099864f218f7b46d230085
                            • Opcode Fuzzy Hash: ca43b4238af6012c062c7364d1455d49cb1c7e6e58f5f5f1de72d825ec9d365b
                            • Instruction Fuzzy Hash: F8410B31604680FACF39AB29C888BBA7BD7EB56310F14873DF14756661CA3AA881C751
                            Function 00702D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                            Download Yara Rule
                            APIs
                            • DeleteObject.GDI32(00000000), ref: 00702D1B
                            • GetDC.USER32(00000000), ref: 00702D23
                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00702D2E
                            • ReleaseDC.USER32(00000000,00000000), ref: 00702D3A
                            • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00702D76
                            • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00702D87
                            • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00705A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00702DC2
                            • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00702DE1
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                            • String ID:
                            • API String ID: 3864802216-0
                            • Opcode ID: 5c46a6ed5478c71badfeb5d148e0a94dbef7f655205e1987a8c25bde12ca5f6f
                            • Instruction ID: 18cb79cbd0deb4d6c4d8faab1d6acae193abd08c1e2e90dfddf28b907ba514ef
                            • Opcode Fuzzy Hash: 5c46a6ed5478c71badfeb5d148e0a94dbef7f655205e1987a8c25bde12ca5f6f
                            • Instruction Fuzzy Hash: DE316D72201214BBEB254F50CC89FEB3BADEB09715F048255FE089A2D1CA799C51C7A4
                            Function 006D5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _memcmp
                            • String ID:
                            • API String ID: 2931989736-0
                            • Opcode ID: 7df87ae49d766603cf6a19365a65cd6d9f1030a32d5bc69e109d775fbe36b23f
                            • Instruction ID: 9c42e6554a52075350f9fe4fb24d8afaf7adb4879f997c180c38f0434f5be617
                            • Opcode Fuzzy Hash: 7df87ae49d766603cf6a19365a65cd6d9f1030a32d5bc69e109d775fbe36b23f
                            • Instruction Fuzzy Hash: 78213AA1E40A09F7E61456208DA2FFB33AFAF11384F640026FD065EF81FB24ED1181A8
                            Function 006F4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: NULL Pointer assignment$Not an Object type
                            • API String ID: 0-572801152
                            • Opcode ID: 86527bc4a2d3e94db38770d9caedd0f90f36e0ecd94c05a0ab9615b276793e70
                            • Instruction ID: 71a0a4d318dd0594008c0298ac2c4c7607c3ed9f5874e6f9424cdcab5b8d76f8
                            • Opcode Fuzzy Hash: 86527bc4a2d3e94db38770d9caedd0f90f36e0ecd94c05a0ab9615b276793e70
                            • Instruction Fuzzy Hash: 5AD18071A0060AAFDB14DF98C881BFEB7B6BF48344F148169EA16AB281E771DD45CB50
                            Function 006B1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                            Download Yara Rule
                            APIs
                            • GetCPInfo.KERNEL32(?,?), ref: 006B15CE
                            • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 006B1651
                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006B16E4
                            • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 006B16FB
                              • Part of subcall function 006A3820: RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852
                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006B1777
                            • __freea.LIBCMT ref: 006B17A2
                            • __freea.LIBCMT ref: 006B17AE
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                            • String ID:
                            • API String ID: 2829977744-0
                            • Opcode ID: fbda61ab4bf939caf0dbc5d51a61adcd8fb8a223ebdb97ea10148ecbd8e86301
                            • Instruction ID: ab08c8e059c0d446a027033824565beb3ada17191038664e6749f4d833db0e0f
                            • Opcode Fuzzy Hash: fbda61ab4bf939caf0dbc5d51a61adcd8fb8a223ebdb97ea10148ecbd8e86301
                            • Instruction Fuzzy Hash: 1B91A7F2E10216BADF219F64C861AEE7BB79F46310F944669E801EF241DB35DD81CB60
                            Function 006F4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$ClearInit
                            • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                            • API String ID: 2610073882-625585964
                            • Opcode ID: 632fbe3ddabe770a88802926a2fe7acd91da340ec6deda15110d18e9e44603ed
                            • Instruction ID: ccafdae2eaa156d9244f70069079c10319f6425691eccd07fed930571519d92a
                            • Opcode Fuzzy Hash: 632fbe3ddabe770a88802926a2fe7acd91da340ec6deda15110d18e9e44603ed
                            • Instruction Fuzzy Hash: A3919171A00219ABDF24DFA5C884FEF7BBAEF45710F108559F605AB280DB709941CFA0
                            Function 006E1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                            Download Yara Rule
                            APIs
                            • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 006E125C
                            • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 006E1284
                            • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 006E12A8
                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006E12D8
                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006E135F
                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006E13C4
                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006E1430
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ArraySafe$Data$Access$UnaccessVartype
                            • String ID:
                            • API String ID: 2550207440-0
                            • Opcode ID: 15e9e9102cb110894187046a00b0b1f5216b0747f88f085feeabfd7a9e12ca9c
                            • Instruction ID: ee3364e34539cad95b8ae3c80cd2547d54f0e75e349922a3cbed448b5a3df7cd
                            • Opcode Fuzzy Hash: 15e9e9102cb110894187046a00b0b1f5216b0747f88f085feeabfd7a9e12ca9c
                            • Instruction Fuzzy Hash: EC91CE71A013499FDB019FA5C884BFEB7B6FF46314F148129EA00EB291D774A981DB94
                            Function 0068948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ObjectSelect$BeginCreatePath
                            • String ID:
                            • API String ID: 3225163088-0
                            • Opcode ID: 8591dfef9a5a902f2cab8b6d58c38f83a6a6b79bed83c862ad59c1bc14455917
                            • Instruction ID: dc2012e2870f37fbf3d9463bcf97227a1db985ade4a88fc053a53e675483b50e
                            • Opcode Fuzzy Hash: 8591dfef9a5a902f2cab8b6d58c38f83a6a6b79bed83c862ad59c1bc14455917
                            • Instruction Fuzzy Hash: A7912871900219EFCB11DFA9CC84AEEBBB9FF49320F148259E515B7251D778AA42CF60
                            Function 006F3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                            Download Yara Rule
                            APIs
                            • VariantInit.OLEAUT32(?), ref: 006F396B
                            • CharUpperBuffW.USER32(?,?), ref: 006F3A7A
                            • _wcslen.LIBCMT ref: 006F3A8A
                            • VariantClear.OLEAUT32(?), ref: 006F3C1F
                              • Part of subcall function 006E0CDF: VariantInit.OLEAUT32(00000000), ref: 006E0D1F
                              • Part of subcall function 006E0CDF: VariantCopy.OLEAUT32(?,?), ref: 006E0D28
                              • Part of subcall function 006E0CDF: VariantClear.OLEAUT32(?), ref: 006E0D34
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                            • String ID: AUTOIT.ERROR$Incorrect Parameter format
                            • API String ID: 4137639002-1221869570
                            • Opcode ID: af8c6c5ae6ed3389f7ca34bdb801a4f9e094d49fb7a4c9134b4f01d101d9cc5f
                            • Instruction ID: 5a028cc8bece9984f7a8d3b7f64f13a1693ac79d1b269c990f76979706ca671d
                            • Opcode Fuzzy Hash: af8c6c5ae6ed3389f7ca34bdb801a4f9e094d49fb7a4c9134b4f01d101d9cc5f
                            • Instruction Fuzzy Hash: 4A919A746083059FC744EF24C49186AB7E6FF88314F14892DF98A9B351DB31EE46CB96
                            Function 006F4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?,?,006D035E), ref: 006D002B
                              • Part of subcall function 006D000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0046
                              • Part of subcall function 006D000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0054
                              • Part of subcall function 006D000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?), ref: 006D0064
                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 006F4C51
                            • _wcslen.LIBCMT ref: 006F4D59
                            • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 006F4DCF
                            • CoTaskMemFree.OLE32(?), ref: 006F4DDA
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                            • String ID: NULL Pointer assignment
                            • API String ID: 614568839-2785691316
                            • Opcode ID: bc0f47f79175b9ea75e6bd5d76fc8e258bee3a4f75774733753b778523d4fa87
                            • Instruction ID: ab5772f8b430c3d32abf7a4a95d494ba78dbc0cd82398f652e193c267042c56a
                            • Opcode Fuzzy Hash: bc0f47f79175b9ea75e6bd5d76fc8e258bee3a4f75774733753b778523d4fa87
                            • Instruction Fuzzy Hash: 12912971D0021DEFDF14DFA4C891AEEB7BABF48310F10816AE519A7251EB345A45CFA4
                            Function 007020FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetMenu.USER32(?), ref: 00702183
                            • GetMenuItemCount.USER32(00000000), ref: 007021B5
                            • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007021DD
                            • _wcslen.LIBCMT ref: 00702213
                            • GetMenuItemID.USER32(?,?), ref: 0070224D
                            • GetSubMenu.USER32(?,?), ref: 0070225B
                              • Part of subcall function 006D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006D3A57
                              • Part of subcall function 006D3A3D: GetCurrentThreadId.KERNEL32 ref: 006D3A5E
                              • Part of subcall function 006D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006D25B3), ref: 006D3A65
                            • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007022E3
                              • Part of subcall function 006DE97B: Sleep.KERNEL32 ref: 006DE9F3
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                            • String ID:
                            • API String ID: 4196846111-0
                            • Opcode ID: b34c5b771d78fddbb202812a2127619e09321dfb459d4302c2fbf7003f6e665f
                            • Instruction ID: 9c9a81992fed742fddc66f718af10f91ba5d456708ba18accb8b395fc1e3456c
                            • Opcode Fuzzy Hash: b34c5b771d78fddbb202812a2127619e09321dfb459d4302c2fbf7003f6e665f
                            • Instruction Fuzzy Hash: E8717376E00205EFCB51DFA4C845AAEB7F5FF48310F158559E816EB392DB38AD428B90
                            Function 006DAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetParent.USER32(?), ref: 006DAEF9
                            • GetKeyboardState.USER32(?), ref: 006DAF0E
                            • SetKeyboardState.USER32(?), ref: 006DAF6F
                            • PostMessageW.USER32(?,00000101,00000010,?), ref: 006DAF9D
                            • PostMessageW.USER32(?,00000101,00000011,?), ref: 006DAFBC
                            • PostMessageW.USER32(?,00000101,00000012,?), ref: 006DAFFD
                            • PostMessageW.USER32(?,00000101,0000005B,?), ref: 006DB020
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessagePost$KeyboardState$Parent
                            • String ID:
                            • API String ID: 87235514-0
                            • Opcode ID: 043af0cb1be4700f9fe427f778701e8547483125b6af02a8bf9c2a297f7fabc5
                            • Instruction ID: 2b0489891ab7864c9d52ffbce37fd8ca7648c4fd1601cba0003b2506cd738a61
                            • Opcode Fuzzy Hash: 043af0cb1be4700f9fe427f778701e8547483125b6af02a8bf9c2a297f7fabc5
                            • Instruction Fuzzy Hash: 2A51E1A1E083D17DFB3643748845BFBBEAA5B06304F08858AE1D985AC2C399A9C8D751
                            Function 006DACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetParent.USER32(00000000), ref: 006DAD19
                            • GetKeyboardState.USER32(?), ref: 006DAD2E
                            • SetKeyboardState.USER32(?), ref: 006DAD8F
                            • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 006DADBB
                            • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 006DADD8
                            • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 006DAE17
                            • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 006DAE38
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessagePost$KeyboardState$Parent
                            • String ID:
                            • API String ID: 87235514-0
                            • Opcode ID: c54d3b21f73a98c052cdd55a403d0c1d1d514e8f54e158fe3b728a14135bdf79
                            • Instruction ID: 218ac6f0fbc4ace1fb4c08258d0be01ac91a568c254b1f1694179c89aa322723
                            • Opcode Fuzzy Hash: c54d3b21f73a98c052cdd55a403d0c1d1d514e8f54e158fe3b728a14135bdf79
                            • Instruction Fuzzy Hash: 1651C4B1D087D53DFB3243A48C55BBA7FAB5F46300F08858AE1D546B82C694EC84E766
                            Function 006A542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetConsoleCP.KERNEL32(006B3CD6,?,?,?,?,?,?,?,?,006A5BA3,?,?,006B3CD6,?,?), ref: 006A5470
                            • __fassign.LIBCMT ref: 006A54EB
                            • __fassign.LIBCMT ref: 006A5506
                            • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,006B3CD6,00000005,00000000,00000000), ref: 006A552C
                            • WriteFile.KERNEL32(?,006B3CD6,00000000,006A5BA3,00000000,?,?,?,?,?,?,?,?,?,006A5BA3,?), ref: 006A554B
                            • WriteFile.KERNEL32(?,?,00000001,006A5BA3,00000000,?,?,?,?,?,?,?,?,?,006A5BA3,?), ref: 006A5584
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                            • String ID:
                            • API String ID: 1324828854-0
                            • Opcode ID: 016ac131edd1c08c35bbdabb11c70abed8abf0a652261ceadfdb5cee7b8d7a2c
                            • Instruction ID: c5186868d9ee7a636b5210b62c84bf92ab4b83b227b928ce1e3f662060fbbecb
                            • Opcode Fuzzy Hash: 016ac131edd1c08c35bbdabb11c70abed8abf0a652261ceadfdb5cee7b8d7a2c
                            • Instruction Fuzzy Hash: 395191B0D006499FDB11DFA8D845AEEBBFAEF0A300F14415AE956E7291D730AE41CF64
                            Function 006F10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006F304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 006F307A
                              • Part of subcall function 006F304E: _wcslen.LIBCMT ref: 006F309B
                            • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 006F1112
                            • WSAGetLastError.WSOCK32 ref: 006F1121
                            • WSAGetLastError.WSOCK32 ref: 006F11C9
                            • closesocket.WSOCK32(00000000), ref: 006F11F9
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                            • String ID:
                            • API String ID: 2675159561-0
                            • Opcode ID: 29746eddab90c23ffdfeee4bad7dbda2359ce4604650bcb88c4de17ffcd5db65
                            • Instruction ID: 651cef68260162f32d1c9dbc8b9e0b2d87867c891ab678f505f7b37e079a4987
                            • Opcode Fuzzy Hash: 29746eddab90c23ffdfeee4bad7dbda2359ce4604650bcb88c4de17ffcd5db65
                            • Instruction Fuzzy Hash: 3A41D331600208EFDB10DF24C844BB9B7AAEF46368F14C159FA199F391CB74AD41CBA5
                            Function 006DCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006DCF22,?), ref: 006DDDFD
                              • Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006DCF22,?), ref: 006DDE16
                            • lstrcmpiW.KERNEL32(?,?), ref: 006DCF45
                            • MoveFileW.KERNEL32(?,?), ref: 006DCF7F
                            • _wcslen.LIBCMT ref: 006DD005
                            • _wcslen.LIBCMT ref: 006DD01B
                            • SHFileOperationW.SHELL32(?), ref: 006DD061
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                            • String ID: \*.*
                            • API String ID: 3164238972-1173974218
                            • Opcode ID: aed1806e83c82b340136760e81c4db8c90b998489998a8bb29fbc80188dff5b7
                            • Instruction ID: 97bdcb6724369ddac1b51a96835b40c2aa56c4e55b4509a83d3e5c7f9c7946f1
                            • Opcode Fuzzy Hash: aed1806e83c82b340136760e81c4db8c90b998489998a8bb29fbc80188dff5b7
                            • Instruction Fuzzy Hash: 9A414671D4521D9FDF52EBA4CD81EDDB7BAAF48340F1000EBE505EB241EA34A685CB54
                            Function 00702DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00702E1C
                            • GetWindowLongW.USER32(00000000,000000F0), ref: 00702E4F
                            • GetWindowLongW.USER32(00000000,000000F0), ref: 00702E84
                            • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00702EB6
                            • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00702EE0
                            • GetWindowLongW.USER32(00000000,000000F0), ref: 00702EF1
                            • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00702F0B
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LongWindow$MessageSend
                            • String ID:
                            • API String ID: 2178440468-0
                            • Opcode ID: 1f9e6a0e6c944f76ce761bca823f7a13b9e8992206747e358760c08bfcb1f029
                            • Instruction ID: fdae566cf3ca6a9e678b6a3c1bbfed0c9f183b755405ae6570089816d347c564
                            • Opcode Fuzzy Hash: 1f9e6a0e6c944f76ce761bca823f7a13b9e8992206747e358760c08bfcb1f029
                            • Instruction Fuzzy Hash: 2E311436684140EFDB219F58DC8CF6537E4EB4A750F1542A5FA048B2F2CB79A8829B04
                            Function 006D7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                            Download Yara Rule
                            APIs
                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006D7769
                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006D778F
                            • SysAllocString.OLEAUT32(00000000), ref: 006D7792
                            • SysAllocString.OLEAUT32(?), ref: 006D77B0
                            • SysFreeString.OLEAUT32(?), ref: 006D77B9
                            • StringFromGUID2.OLE32(?,?,00000028), ref: 006D77DE
                            • SysAllocString.OLEAUT32(?), ref: 006D77EC
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                            • String ID:
                            • API String ID: 3761583154-0
                            • Opcode ID: 8bc35160c672719d950970d2597458af920f3e052b7ed16bd319f91df8b9b600
                            • Instruction ID: 425391c5ff01bef7c846609a36971bbdce046f4215e3a3ae972892aea3272c02
                            • Opcode Fuzzy Hash: 8bc35160c672719d950970d2597458af920f3e052b7ed16bd319f91df8b9b600
                            • Instruction Fuzzy Hash: 1021B576A04219AFDB10DFA8CC88CFB77ADFB093647008626F904DB390EA74DC418765
                            Function 006D77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                            Download Yara Rule
                            APIs
                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006D7842
                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006D7868
                            • SysAllocString.OLEAUT32(00000000), ref: 006D786B
                            • SysAllocString.OLEAUT32 ref: 006D788C
                            • SysFreeString.OLEAUT32 ref: 006D7895
                            • StringFromGUID2.OLE32(?,?,00000028), ref: 006D78AF
                            • SysAllocString.OLEAUT32(?), ref: 006D78BD
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                            • String ID:
                            • API String ID: 3761583154-0
                            • Opcode ID: fb48c44d902d91136b3c411a2c64e37b3f934f35600cbd68736340fc198ab916
                            • Instruction ID: e434b4a86a5bfda965b90659265c98dbe2e51124cb0544ddd6acedb42984ed83
                            • Opcode Fuzzy Hash: fb48c44d902d91136b3c411a2c64e37b3f934f35600cbd68736340fc198ab916
                            • Instruction Fuzzy Hash: D5216271A04104AFDB10AFA8DC8DDAA77ADFB097607108236F915CB3A1EA74DC41DB69
                            Function 006E04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                            Download Yara Rule
                            APIs
                            • GetStdHandle.KERNEL32(0000000C), ref: 006E04F2
                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006E052E
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateHandlePipe
                            • String ID: nul
                            • API String ID: 1424370930-2873401336
                            • Opcode ID: 144ea9f116a60e5478c443dea72d9b07f926be5e622533d9e817849a9e51efb5
                            • Instruction ID: e14574a9fba22bd092472241783d43391e149fa9a6d9df02a37f0164bc7ac107
                            • Opcode Fuzzy Hash: 144ea9f116a60e5478c443dea72d9b07f926be5e622533d9e817849a9e51efb5
                            • Instruction Fuzzy Hash: D22171B5501345EFEB209F2ADD44A9A77B5BF45724F608A19F8A1D72E0D7B0D980CF20
                            Function 006E05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                            Download Yara Rule
                            APIs
                            • GetStdHandle.KERNEL32(000000F6), ref: 006E05C6
                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006E0601
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateHandlePipe
                            • String ID: nul
                            • API String ID: 1424370930-2873401336
                            • Opcode ID: 4c93b143a92ec3a732fac788a834d03dba4972aa0c5536c1f4251bd4c4c34d1f
                            • Instruction ID: 12b89ac456c36b0bfe59ce2e0efb3d7852655cc4762fb695ec8371236c67dfbf
                            • Opcode Fuzzy Hash: 4c93b143a92ec3a732fac788a834d03dba4972aa0c5536c1f4251bd4c4c34d1f
                            • Instruction Fuzzy Hash: FA21A175501345EBEB208F6A9C04B9A77E5BF85720F204B19F8A1E32E0DBF098A1CB14
                            Function 007040AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 0067600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0067604C
                              • Part of subcall function 0067600E: GetStockObject.GDI32(00000011), ref: 00676060
                              • Part of subcall function 0067600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0067606A
                            • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00704112
                            • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0070411F
                            • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0070412A
                            • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00704139
                            • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00704145
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$CreateObjectStockWindow
                            • String ID: Msctls_Progress32
                            • API String ID: 1025951953-3636473452
                            • Opcode ID: e6825231cefd151e5008d72f1bca5bb07ee54e1551d64f1ab2b4a448b4458a75
                            • Instruction ID: 7f5853f06ab22ebde8b485ac2a9c3db848af54572bb50d62699d60477ea7a71e
                            • Opcode Fuzzy Hash: e6825231cefd151e5008d72f1bca5bb07ee54e1551d64f1ab2b4a448b4458a75
                            • Instruction Fuzzy Hash: 2A11B6B215011DBEEF119F64CC85EE77F9DEF08798F004211B718A2090CB769C61DBA4
                            Function 006AD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006AD7A3: _free.LIBCMT ref: 006AD7CC
                            • _free.LIBCMT ref: 006AD82D
                              • Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
                              • Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0
                            • _free.LIBCMT ref: 006AD838
                            • _free.LIBCMT ref: 006AD843
                            • _free.LIBCMT ref: 006AD897
                            • _free.LIBCMT ref: 006AD8A2
                            • _free.LIBCMT ref: 006AD8AD
                            • _free.LIBCMT ref: 006AD8B8
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free$ErrorFreeHeapLast
                            • String ID:
                            • API String ID: 776569668-0
                            • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                            • Instruction ID: a64499e1e086aba0b0841a00f6f938f4c1c42f1387912513222f46eea773221f
                            • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                            • Instruction Fuzzy Hash: EC115171580B04AAD5A1BFB1CC47FCB7BDE6F02B00F40082DB29AA68A2DA65FD054E55
                            Function 006DDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 006DDA74
                            • LoadStringW.USER32(00000000), ref: 006DDA7B
                            • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 006DDA91
                            • LoadStringW.USER32(00000000), ref: 006DDA98
                            • MessageBoxW.USER32(00000000,?,?,00011010), ref: 006DDADC
                            Strings
                            • %s (%d) : ==> %s: %s %s, xrefs: 006DDAB9
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: HandleLoadModuleString$Message
                            • String ID: %s (%d) : ==> %s: %s %s
                            • API String ID: 4072794657-3128320259
                            • Opcode ID: a0169f0420ee0beefbaaea15fdd0a99841e8abfef74d5ce5207f3b2a2985e9d4
                            • Instruction ID: b6c12f62774040c66ffb1e3685be5e9f31ad69b6a6eab6131c83b6a59b332128
                            • Opcode Fuzzy Hash: a0169f0420ee0beefbaaea15fdd0a99841e8abfef74d5ce5207f3b2a2985e9d4
                            • Instruction Fuzzy Hash: 88018BF6900208BFF711A7A4DD89EE7336CD704701F448656B706E2181EA789E844F74
                            Function 006E096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                            Download Yara Rule
                            APIs
                            • InterlockedExchange.KERNEL32(00CFD118,00CFD118), ref: 006E097B
                            • EnterCriticalSection.KERNEL32(00CFD0F8,00000000), ref: 006E098D
                            • TerminateThread.KERNEL32(00000000,000001F6), ref: 006E099B
                            • WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 006E09A9
                            • CloseHandle.KERNEL32(00000000), ref: 006E09B8
                            • InterlockedExchange.KERNEL32(00CFD118,000001F6), ref: 006E09C8
                            • LeaveCriticalSection.KERNEL32(00CFD0F8), ref: 006E09CF
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                            • String ID:
                            • API String ID: 3495660284-0
                            • Opcode ID: d30b6f619768579eae440c1a6b2b0b7855e4de60e22e75754e32e9f3373d763b
                            • Instruction ID: aeebc7be031bc00582d031b2e7e390bc6d61db46df9f2deccaafb9de2d0c33af
                            • Opcode Fuzzy Hash: d30b6f619768579eae440c1a6b2b0b7855e4de60e22e75754e32e9f3373d763b
                            • Instruction Fuzzy Hash: DDF0C932442A12EBE7525FA4EE89AD6BA29BF05702F406325F20294CA1CB799465CF94
                            Function 006A01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                            Download Yara Rule
                            APIs
                            • __allrem.LIBCMT ref: 006A00BA
                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A00D6
                            • __allrem.LIBCMT ref: 006A00ED
                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A010B
                            • __allrem.LIBCMT ref: 006A0122
                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A0140
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                            • String ID:
                            • API String ID: 1992179935-0
                            • Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                            • Instruction ID: 5828684f617a31139c901ac88bc7c8be95be4c906c107b71ee5772108c0cf703
                            • Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                            • Instruction Fuzzy Hash: 2981C372A00B06ABEB20AF68CC41BAA73EAAF42324F25452EF551D6781E770DD418F54
                            Function 006A61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                            Download Yara Rule
                            APIs
                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006982D9,006982D9,?,?,?,006A644F,00000001,00000001,8BE85006), ref: 006A6258
                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,006A644F,00000001,00000001,8BE85006,?,?,?), ref: 006A62DE
                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006A63D8
                            • __freea.LIBCMT ref: 006A63E5
                              • Part of subcall function 006A3820: RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852
                            • __freea.LIBCMT ref: 006A63EE
                            • __freea.LIBCMT ref: 006A6413
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ByteCharMultiWide__freea$AllocateHeap
                            • String ID:
                            • API String ID: 1414292761-0
                            • Opcode ID: 2092e0d47b353e31aa50229d1b38e31ea126135257bdc84f72e9705fe9c7585c
                            • Instruction ID: 9b79756a7182eb07860e8c6135a8e6feb4c502ba6e6caa75dd6735b809b9a1cb
                            • Opcode Fuzzy Hash: 2092e0d47b353e31aa50229d1b38e31ea126135257bdc84f72e9705fe9c7585c
                            • Instruction Fuzzy Hash: 7151B3B2600216ABDF25AF64CC81EEF77ABEF46750F194629FC05D6240DB34DD41CA60
                            Function 006FBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                              • Part of subcall function 006FC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006FB6AE,?,?), ref: 006FC9B5
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FC9F1
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FCA68
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FCA9E
                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006FBCCA
                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006FBD25
                            • RegCloseKey.ADVAPI32(00000000), ref: 006FBD6A
                            • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 006FBD99
                            • RegCloseKey.ADVAPI32(?,?,00000000), ref: 006FBDF3
                            • RegCloseKey.ADVAPI32(?), ref: 006FBDFF
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                            • String ID:
                            • API String ID: 1120388591-0
                            • Opcode ID: 6f98a2779ff869bc9b7d6fc73cd556266d24910b00fabf1359ce7250f056b4bd
                            • Instruction ID: 40c59e34cf46d9635542fc9f70b76406bb5d73dc14a62e5d084f96fb03563232
                            • Opcode Fuzzy Hash: 6f98a2779ff869bc9b7d6fc73cd556266d24910b00fabf1359ce7250f056b4bd
                            • Instruction Fuzzy Hash: 1681AD30208245EFD714DF24C885E6ABBE6FF84348F14995CF6598B2A2DB31ED45CB92
                            Function 006CF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                            Download Yara Rule
                            APIs
                            • VariantInit.OLEAUT32(00000035), ref: 006CF7B9
                            • SysAllocString.OLEAUT32(00000001), ref: 006CF860
                            • VariantCopy.OLEAUT32(006CFA64,00000000), ref: 006CF889
                            • VariantClear.OLEAUT32(006CFA64), ref: 006CF8AD
                            • VariantCopy.OLEAUT32(006CFA64,00000000), ref: 006CF8B1
                            • VariantClear.OLEAUT32(?), ref: 006CF8BB
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$ClearCopy$AllocInitString
                            • String ID:
                            • API String ID: 3859894641-0
                            • Opcode ID: f91d051f7aa51fc878d1186e79013aff7585219492911cf334178c9eb91a9efb
                            • Instruction ID: f15c8eccec6638d31e41447a5bb8febbda03871b044d0f847855cad2f7024dfb
                            • Opcode Fuzzy Hash: f91d051f7aa51fc878d1186e79013aff7585219492911cf334178c9eb91a9efb
                            • Instruction Fuzzy Hash: 0A51B131A01310ABCF64AB65D895F79B3E7EF45710B20946EF906DF291DB708C41CBAA
                            Function 006E910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00677620: _wcslen.LIBCMT ref: 00677625
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                            • GetOpenFileNameW.COMDLG32(00000058), ref: 006E94E5
                            • _wcslen.LIBCMT ref: 006E9506
                            • _wcslen.LIBCMT ref: 006E952D
                            • GetSaveFileNameW.COMDLG32(00000058), ref: 006E9585
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$FileName$OpenSave
                            • String ID: X
                            • API String ID: 83654149-3081909835
                            • Opcode ID: 97fd56f43642065d181f22480a5a564c41974b3649a88dffce05f30d6ca44c4a
                            • Instruction ID: ac10117f35e401a395bd90b94a47c4b1a303f48970a4628c3b3ab987c64d9954
                            • Opcode Fuzzy Hash: 97fd56f43642065d181f22480a5a564c41974b3649a88dffce05f30d6ca44c4a
                            • Instruction Fuzzy Hash: B8E1C231504340DFD764DF25C881AAAB7E6BF84314F04896DF8899B3A2EB31DD05CBA6
                            Function 0068920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00689BB2
                            • BeginPaint.USER32(?,?,?), ref: 00689241
                            • GetWindowRect.USER32(?,?), ref: 006892A5
                            • ScreenToClient.USER32(?,?), ref: 006892C2
                            • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 006892D3
                            • EndPaint.USER32(?,?,?,?,?), ref: 00689321
                            • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 006C71EA
                              • Part of subcall function 00689339: BeginPath.GDI32(00000000), ref: 00689357
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                            • String ID:
                            • API String ID: 3050599898-0
                            • Opcode ID: e653bf4c44fb3c0b228f06d7fb8794addfedd94565c081956bf318b149c63b63
                            • Instruction ID: 120e66054e95306fd7e4edd5b85d30fdd7f2330b4bba4cbdbd001fa2c5b2994b
                            • Opcode Fuzzy Hash: e653bf4c44fb3c0b228f06d7fb8794addfedd94565c081956bf318b149c63b63
                            • Instruction Fuzzy Hash: 6F419E70104200EFD721EF24DC94FBA7BAAEB46320F18436DF9A5872E1C775A845DB66
                            Function 006E07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                            Download Yara Rule
                            APIs
                            • InterlockedExchange.KERNEL32(?,000001F5), ref: 006E080C
                            • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 006E0847
                            • EnterCriticalSection.KERNEL32(?), ref: 006E0863
                            • LeaveCriticalSection.KERNEL32(?), ref: 006E08DC
                            • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 006E08F3
                            • InterlockedExchange.KERNEL32(?,000001F6), ref: 006E0921
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                            • String ID:
                            • API String ID: 3368777196-0
                            • Opcode ID: 5bc4b3f0ba4a3156a80c26e7613db3210c1c8fad3e89a4644bd8720008fb4c0f
                            • Instruction ID: 133d3a4e94090ddc0b104ac0dd7677956038edb6fa4abe4f83777ce3dcfd191a
                            • Opcode Fuzzy Hash: 5bc4b3f0ba4a3156a80c26e7613db3210c1c8fad3e89a4644bd8720008fb4c0f
                            • Instruction Fuzzy Hash: 37419E71900205EFEF15AF54DC85AAA777AFF44300F1081A9ED009E297DB74DE61CBA8
                            Function 007081DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                            Download Yara Rule
                            APIs
                            • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,006CF3AB,00000000,?,?,00000000,?,006C682C,00000004,00000000,00000000), ref: 0070824C
                            • EnableWindow.USER32(00000000,00000000), ref: 00708272
                            • ShowWindow.USER32(FFFFFFFF,00000000), ref: 007082D1
                            • ShowWindow.USER32(00000000,00000004), ref: 007082E5
                            • EnableWindow.USER32(00000000,00000001), ref: 0070830B
                            • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0070832F
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Show$Enable$MessageSend
                            • String ID:
                            • API String ID: 642888154-0
                            • Opcode ID: 4cd0432fc5fec056690d91500166435605558b17626b459ed0fe539a17edcb87
                            • Instruction ID: f0f73eca5965833b47b16edb397b114f9d06b5fef432b7e5df41a817c7c5d6cd
                            • Opcode Fuzzy Hash: 4cd0432fc5fec056690d91500166435605558b17626b459ed0fe539a17edcb87
                            • Instruction Fuzzy Hash: 3941A734601644EFDF61CF15C899BE87BE0FB4A714F1853A9E6484B2E2CB39A841CB56
                            Function 006D4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                            Download Yara Rule
                            APIs
                            • IsWindowVisible.USER32(?), ref: 006D4C95
                            • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006D4CB2
                            • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006D4CEA
                            • _wcslen.LIBCMT ref: 006D4D08
                            • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 006D4D10
                            • _wcsstr.LIBVCRUNTIME ref: 006D4D1A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                            • String ID:
                            • API String ID: 72514467-0
                            • Opcode ID: 28b205df141930d64b2829f767170e72659db0ca33e57c6fa7242023b1ca8907
                            • Instruction ID: ecbd7b254e79d0211498ff6ea0c78597edc6f75a970f887ef498e9328570876d
                            • Opcode Fuzzy Hash: 28b205df141930d64b2829f767170e72659db0ca33e57c6fa7242023b1ca8907
                            • Instruction Fuzzy Hash: F9212632A04200BBEB265B39EC49E7B7B9EDF45750F10816EF809CA391EE75CC4187A0
                            Function 006E581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00673AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00673A97,?,?,00672E7F,?,?,?,00000000), ref: 00673AC2
                            • _wcslen.LIBCMT ref: 006E587B
                            • CoInitialize.OLE32(00000000), ref: 006E5995
                            • CoCreateInstance.OLE32(0070FCF8,00000000,00000001,0070FB68,?), ref: 006E59AE
                            • CoUninitialize.OLE32 ref: 006E59CC
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                            • String ID: .lnk
                            • API String ID: 3172280962-24824748
                            • Opcode ID: afff93396fb172905abd0bb77818bab81cc1ea6e801e5907a3d902998ea714bb
                            • Instruction ID: 42487fa8fe76c7f85f6837b512aa28aa093f5921dcdb3a4329619e682e1d93f2
                            • Opcode Fuzzy Hash: afff93396fb172905abd0bb77818bab81cc1ea6e801e5907a3d902998ea714bb
                            • Instruction Fuzzy Hash: C7D17370604741DFC714DF25C480A6ABBE2EF89718F14895DF88A9B362DB31EC05CB92
                            Function 006D175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006D0FCA
                              • Part of subcall function 006D0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006D0FD6
                              • Part of subcall function 006D0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006D0FE5
                              • Part of subcall function 006D0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006D0FEC
                              • Part of subcall function 006D0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006D1002
                            • GetLengthSid.ADVAPI32(?,00000000,006D1335), ref: 006D17AE
                            • GetProcessHeap.KERNEL32(00000008,00000000), ref: 006D17BA
                            • HeapAlloc.KERNEL32(00000000), ref: 006D17C1
                            • CopySid.ADVAPI32(00000000,00000000,?), ref: 006D17DA
                            • GetProcessHeap.KERNEL32(00000000,00000000,006D1335), ref: 006D17EE
                            • HeapFree.KERNEL32(00000000), ref: 006D17F5
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                            • String ID:
                            • API String ID: 3008561057-0
                            • Opcode ID: b9dcb413e0d4c92d5187e8620e4ff579e4a78c0f4039adb224d899544ba87709
                            • Instruction ID: 784988f58872da0338934fbb307865636d7e6223d087657cadda0fc252b2d0ac
                            • Opcode Fuzzy Hash: b9dcb413e0d4c92d5187e8620e4ff579e4a78c0f4039adb224d899544ba87709
                            • Instruction Fuzzy Hash: 9F116A71A01205FBDB119FA4CC49BEE7BBAEB46355F10821AF441DB320DB79AA44CB64
                            Function 006D14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006D14FF
                            • OpenProcessToken.ADVAPI32(00000000), ref: 006D1506
                            • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 006D1515
                            • CloseHandle.KERNEL32(00000004), ref: 006D1520
                            • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006D154F
                            • DestroyEnvironmentBlock.USERENV(00000000), ref: 006D1563
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                            • String ID:
                            • API String ID: 1413079979-0
                            • Opcode ID: eea657ebebba06c2a014cdbdf12f944852bf14d757f96c5a897fd7675ccbf5ca
                            • Instruction ID: 012fa11f10b857b856997d639b704e8b743e6078dc57626953a1e304c3c1375e
                            • Opcode Fuzzy Hash: eea657ebebba06c2a014cdbdf12f944852bf14d757f96c5a897fd7675ccbf5ca
                            • Instruction Fuzzy Hash: 36115E7250020DFBDF12CF94DD49BDE7BAAEF45704F048215FA05A6260C7B58E60DB61
                            Function 00693382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetLastError.KERNEL32(?,?,00693379,00692FE5), ref: 00693390
                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0069339E
                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006933B7
                            • SetLastError.KERNEL32(00000000,?,00693379,00692FE5), ref: 00693409
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLastValue___vcrt_
                            • String ID:
                            • API String ID: 3852720340-0
                            • Opcode ID: ffaaa5470d73f039702597201237c1d40e112aa47c611a594e393a2df85ed454
                            • Instruction ID: 067a3a409bb4af13224c88f4bc4db8829fe5d26c2bb4b1b3c1d6cde4ad006e2d
                            • Opcode Fuzzy Hash: ffaaa5470d73f039702597201237c1d40e112aa47c611a594e393a2df85ed454
                            • Instruction Fuzzy Hash: 4801F13224D331AEEF2A27746C859A62A9EEB1577A320832DF41094BF0EF114D02564C
                            Function 006A2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetLastError.KERNEL32(?,?,006A5686,006B3CD6,?,00000000,?,006A5B6A,?,?,?,?,?,0069E6D1,?,00738A48), ref: 006A2D78
                            • _free.LIBCMT ref: 006A2DAB
                            • _free.LIBCMT ref: 006A2DD3
                            • SetLastError.KERNEL32(00000000,?,?,?,?,0069E6D1,?,00738A48,00000010,00674F4A,?,?,00000000,006B3CD6), ref: 006A2DE0
                            • SetLastError.KERNEL32(00000000,?,?,?,?,0069E6D1,?,00738A48,00000010,00674F4A,?,?,00000000,006B3CD6), ref: 006A2DEC
                            • _abort.LIBCMT ref: 006A2DF2
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLast$_free$_abort
                            • String ID:
                            • API String ID: 3160817290-0
                            • Opcode ID: 9c40227c4aa448c772406e30ade126ca1923424abc5718f10a86fa4fe1637068
                            • Instruction ID: e5c1febdbff7850fbc65bf89f893fd88296aad586d970beea1eb4a065565e5b4
                            • Opcode Fuzzy Hash: 9c40227c4aa448c772406e30ade126ca1923424abc5718f10a86fa4fe1637068
                            • Instruction Fuzzy Hash: BCF0F93158450267C263333D7C26B5B1657AFC3B61B20421CF424922D3EF289C015D69
                            Function 00708A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00689693
                              • Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896A2
                              • Part of subcall function 00689639: BeginPath.GDI32(?), ref: 006896B9
                              • Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896E2
                            • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00708A4E
                            • LineTo.GDI32(?,00000003,00000000), ref: 00708A62
                            • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00708A70
                            • LineTo.GDI32(?,00000000,00000003), ref: 00708A80
                            • EndPath.GDI32(?), ref: 00708A90
                            • StrokePath.GDI32(?), ref: 00708AA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                            • String ID:
                            • API String ID: 43455801-0
                            • Opcode ID: e26f03811dd2ff1cd3caa7c74a1f032b8159b5dea076738becdca903162c5bc6
                            • Instruction ID: 43f4fedd53da0435edc8d7f37495a298163fa564be564de37f7fdb59cb4d4faf
                            • Opcode Fuzzy Hash: e26f03811dd2ff1cd3caa7c74a1f032b8159b5dea076738becdca903162c5bc6
                            • Instruction Fuzzy Hash: B8110C7600014CFFEB129F90DC88EAA7F6DEB04354F04C212FA15991A1DB759D55DBA4
                            Function 006D51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                            Download Yara Rule
                            APIs
                            • GetDC.USER32(00000000), ref: 006D5218
                            • GetDeviceCaps.GDI32(00000000,00000058), ref: 006D5229
                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 006D5230
                            • ReleaseDC.USER32(00000000,00000000), ref: 006D5238
                            • MulDiv.KERNEL32(000009EC,?,00000000), ref: 006D524F
                            • MulDiv.KERNEL32(000009EC,00000001,?), ref: 006D5261
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CapsDevice$Release
                            • String ID:
                            • API String ID: 1035833867-0
                            • Opcode ID: c24421a448a5c3e30adde19dda441d42fa71fa07b84a8d4525a33095126b5650
                            • Instruction ID: a383e1a1da75fdd0b9e6695c9e13b488bafb6607fed43b19a9d9553399923793
                            • Opcode Fuzzy Hash: c24421a448a5c3e30adde19dda441d42fa71fa07b84a8d4525a33095126b5650
                            • Instruction Fuzzy Hash: A8018F75E00708FBEB119BA59C49F5EBFB9EB48351F048166FA05A7380DA709904CBA4
                            Function 00671BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                            Download Yara Rule
                            APIs
                            • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00671BF4
                            • MapVirtualKeyW.USER32(00000010,00000000), ref: 00671BFC
                            • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00671C07
                            • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00671C12
                            • MapVirtualKeyW.USER32(00000011,00000000), ref: 00671C1A
                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00671C22
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Virtual
                            • String ID:
                            • API String ID: 4278518827-0
                            • Opcode ID: 9f51a2371efd75792af16a13f9eb99924cbd1f59d7f52156ce7b130990422236
                            • Instruction ID: d68a60e6b6e8c438de954265f18b2041511159100e206ebb559d0eb12a289577
                            • Opcode Fuzzy Hash: 9f51a2371efd75792af16a13f9eb99924cbd1f59d7f52156ce7b130990422236
                            • Instruction Fuzzy Hash: 6E016CB0902759BDE3008F5A8C85B52FFA8FF19354F00415B915C47941C7F5A864CBE5
                            Function 006DEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                            Download Yara Rule
                            APIs
                            • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006DEB30
                            • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 006DEB46
                            • GetWindowThreadProcessId.USER32(?,?), ref: 006DEB55
                            • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006DEB64
                            • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006DEB6E
                            • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006DEB75
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                            • String ID:
                            • API String ID: 839392675-0
                            • Opcode ID: fe31608b93825c3ce8605206191cec97484a0dd2540c3722f10a83bc74a9138f
                            • Instruction ID: 2bdc17870ef43912a552c3e11c1d88777a7b7c11cec8d28298bf3c9362a5657b
                            • Opcode Fuzzy Hash: fe31608b93825c3ce8605206191cec97484a0dd2540c3722f10a83bc74a9138f
                            • Instruction Fuzzy Hash: 41F09072500118FBE72257529C0EEEF3A7CEFCAB11F008359F601D1190DBA51A01C6B9
                            Function 006C7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetClientRect.USER32(?), ref: 006C7452
                            • SendMessageW.USER32(?,00001328,00000000,?), ref: 006C7469
                            • GetWindowDC.USER32(?), ref: 006C7475
                            • GetPixel.GDI32(00000000,?,?), ref: 006C7484
                            • ReleaseDC.USER32(?,00000000), ref: 006C7496
                            • GetSysColor.USER32(00000005), ref: 006C74B0
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ClientColorMessagePixelRectReleaseSendWindow
                            • String ID:
                            • API String ID: 272304278-0
                            • Opcode ID: 1c15c0363d9dfc0bd25dbc52de4c39a9cfafd076c29ec7d5465d5b788d05dbd3
                            • Instruction ID: daa58f340d3dba5b5165cfac607ee21e4383d219b672dd9f3265269fe5f865c6
                            • Opcode Fuzzy Hash: 1c15c0363d9dfc0bd25dbc52de4c39a9cfafd076c29ec7d5465d5b788d05dbd3
                            • Instruction Fuzzy Hash: EF017831400205EFDB225F64DC08BAA7BB6FB04321F608264FA15A21A0CF352E52AF14
                            Function 006D1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                            Download Yara Rule
                            APIs
                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 006D187F
                            • UnloadUserProfile.USERENV(?,?), ref: 006D188B
                            • CloseHandle.KERNEL32(?), ref: 006D1894
                            • CloseHandle.KERNEL32(?), ref: 006D189C
                            • GetProcessHeap.KERNEL32(00000000,?), ref: 006D18A5
                            • HeapFree.KERNEL32(00000000), ref: 006D18AC
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                            • String ID:
                            • API String ID: 146765662-0
                            • Opcode ID: a951dc62f2c020cb168e4c5bf49b61e4aa9f7e6b89f87abff213c899cb1ea33c
                            • Instruction ID: c5c0785664a5739c708fafbd5812f959e97522910d96d9287638a772c05dab1e
                            • Opcode Fuzzy Hash: a951dc62f2c020cb168e4c5bf49b61e4aa9f7e6b89f87abff213c899cb1ea33c
                            • Instruction Fuzzy Hash: 74E0C276004105FBDA025BA1ED0C90ABB39FB49B22B10C320F225810B0CF369820DB98
                            Function 0067BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON
                            Download Yara Rule
                            APIs
                            • __Init_thread_footer.LIBCMT ref: 0067BEB3
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Init_thread_footer
                            • String ID: D%t$D%t$D%t$D%tD%t
                            • API String ID: 1385522511-535996708
                            • Opcode ID: 8354cb22951db66f1d0b49bba5f8906c64206985b804a661a601106f04ddc14f
                            • Instruction ID: 27e6ae4f684b36ddf0c40748186e0c2c53a911560dc711845b9ef400cf0c0594
                            • Opcode Fuzzy Hash: 8354cb22951db66f1d0b49bba5f8906c64206985b804a661a601106f04ddc14f
                            • Instruction Fuzzy Hash: C8913B75A0020ADFCB14CF58C0906AAB7F2FF58314F64D16AE949AB351E731A992CB90
                            Function 006F7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00690242: EnterCriticalSection.KERNEL32(0074070C,00741884,?,?,0068198B,00742518,?,?,?,006712F9,00000000), ref: 0069024D
                              • Part of subcall function 00690242: LeaveCriticalSection.KERNEL32(0074070C,?,0068198B,00742518,?,?,?,006712F9,00000000), ref: 0069028A
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                              • Part of subcall function 006900A3: __onexit.LIBCMT ref: 006900A9
                            • __Init_thread_footer.LIBCMT ref: 006F7BFB
                              • Part of subcall function 006901F8: EnterCriticalSection.KERNEL32(0074070C,?,?,00688747,00742514), ref: 00690202
                              • Part of subcall function 006901F8: LeaveCriticalSection.KERNEL32(0074070C,?,00688747,00742514), ref: 00690235
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                            • String ID: +Tl$5$G$Variable must be of type 'Object'.
                            • API String ID: 535116098-841633982
                            • Opcode ID: 18e6c98776b959c721c24464e29e9f3a093abe0d51ae5518a7a7579971d5589d
                            • Instruction ID: 8e4d9193399a2afd1df0c648d70784ad4c89f8c758cf2d938790f46decacf5a2
                            • Opcode Fuzzy Hash: 18e6c98776b959c721c24464e29e9f3a093abe0d51ae5518a7a7579971d5589d
                            • Instruction Fuzzy Hash: 2E916874A04209EFCB04EF94D8919FDB7B2AF49300F50815DFA06AB3A2DB71AE41CB55
                            Function 006DC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00677620: _wcslen.LIBCMT ref: 00677625
                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006DC6EE
                            • _wcslen.LIBCMT ref: 006DC735
                            • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006DC79C
                            • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 006DC7CA
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ItemMenu$Info_wcslen$Default
                            • String ID: 0
                            • API String ID: 1227352736-4108050209
                            • Opcode ID: 73582bf7de0e1fe597adb7fdcae80e3875f801d79cf43abbeec9ad334c79ed62
                            • Instruction ID: 47b7ef66369fc331b1c14820ca7ee2c3cf7f91f99edf1e7644ed6481a14c2c39
                            • Opcode Fuzzy Hash: 73582bf7de0e1fe597adb7fdcae80e3875f801d79cf43abbeec9ad334c79ed62
                            • Instruction Fuzzy Hash: DF510371A043469BD754EF28C884BAB77EAAF89320F040A2EF995D33D0DB74D844CB56
                            Function 006FAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                            Download Yara Rule
                            APIs
                            • ShellExecuteExW.SHELL32(0000003C), ref: 006FAEA3
                              • Part of subcall function 00677620: _wcslen.LIBCMT ref: 00677625
                            • GetProcessId.KERNEL32(00000000), ref: 006FAF38
                            • CloseHandle.KERNEL32(00000000), ref: 006FAF67
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CloseExecuteHandleProcessShell_wcslen
                            • String ID: <$@
                            • API String ID: 146682121-1426351568
                            • Opcode ID: d75c23dd67a0ae8885656b7b7488424731a7269da0e9ad436b4237192b9eb93e
                            • Instruction ID: 1a62866bececd0f80fc95c04c55d45aa1355ed97e3a0882c04a037b0854d308b
                            • Opcode Fuzzy Hash: d75c23dd67a0ae8885656b7b7488424731a7269da0e9ad436b4237192b9eb93e
                            • Instruction Fuzzy Hash: 40715B71A00219DFCB14DF94C485AAEBBF2BF08314F14849DE95AAB362CB74ED41CB95
                            Function 006D719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                            Download Yara Rule
                            APIs
                            • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006D7206
                            • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 006D723C
                            • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 006D724D
                            • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 006D72CF
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorMode$AddressCreateInstanceProc
                            • String ID: DllGetClassObject
                            • API String ID: 753597075-1075368562
                            • Opcode ID: b18cd1176def773b0fc40ac837dc35cd2252163fff3c268689c37208bacd6a9f
                            • Instruction ID: cde84acddf40b3b800bbb2ab577c84919988c3e66f143a79ec8e3864d3cfb622
                            • Opcode Fuzzy Hash: b18cd1176def773b0fc40ac837dc35cd2252163fff3c268689c37208bacd6a9f
                            • Instruction Fuzzy Hash: D34181B1A04204EFDB15CF54C884A9A7BAAEF44310F1481AEFD059F34AE7B4DA45CBA1
                            Function 006FC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen
                            • String ID: HKEY_LOCAL_MACHINE$HKLM
                            • API String ID: 176396367-4004644295
                            • Opcode ID: e8c546b488ce723f3be08ebbc8496deb173f90316a387f5ebf1cf14b219809fe
                            • Instruction ID: d1ba7414d1791eefe29aa67a682d6efc7bf9706d16501f04baae8b06f2064dd0
                            • Opcode Fuzzy Hash: e8c546b488ce723f3be08ebbc8496deb173f90316a387f5ebf1cf14b219809fe
                            • Instruction Fuzzy Hash: E6312873A0016D8BCB30DF2D8A514FE33935BA1760F154029ED45AB345EA71ED40D3A0
                            Function 00702F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00702F8D
                            • LoadLibraryW.KERNEL32(?), ref: 00702F94
                            • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00702FA9
                            • DestroyWindow.USER32(?), ref: 00702FB1
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$DestroyLibraryLoadWindow
                            • String ID: SysAnimate32
                            • API String ID: 3529120543-1011021900
                            • Opcode ID: fc54cb31c161be0095dda59ed7be3cbe59d25fe8c7a258da8dc08c1283245a10
                            • Instruction ID: b3d02ee2dd0417b003c9b82952fb87693e616c732b1e4c922e11954e870060af
                            • Opcode Fuzzy Hash: fc54cb31c161be0095dda59ed7be3cbe59d25fe8c7a258da8dc08c1283245a10
                            • Instruction Fuzzy Hash: 9F21BE72200206EBEB115F64DC48EBB77F9EB593A4F104718F910920E1C779EC429760
                            Function 00694D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00694D1E,006A28E9,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002), ref: 00694D8D
                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00694DA0
                            • FreeLibrary.KERNEL32(00000000,?,?,?,00694D1E,006A28E9,?,00694CBE,006A28E9,007388B8,0000000C,00694E15,006A28E9,00000002,00000000), ref: 00694DC3
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AddressFreeHandleLibraryModuleProc
                            • String ID: CorExitProcess$mscoree.dll
                            • API String ID: 4061214504-1276376045
                            • Opcode ID: 5403d0c4a607a27f459d73a536ad62066bb0f1cf51f0aff16972662e2e85aefb
                            • Instruction ID: f3419333c6cafe600decfdbb44184401b5e5f98341596a59bd61d97a57e01b37
                            • Opcode Fuzzy Hash: 5403d0c4a607a27f459d73a536ad62066bb0f1cf51f0aff16972662e2e85aefb
                            • Instruction Fuzzy Hash: C6F0A434500208FBDF125F94DC09BEDBBB9EF04712F044294F805A2690DF785981CBD4
                            Function 006CD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                            Download Yara Rule
                            APIs
                            • LoadLibraryA.KERNEL32 ref: 006CD3AD
                            • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 006CD3BF
                            • FreeLibrary.KERNEL32(00000000), ref: 006CD3E5
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Library$AddressFreeLoadProc
                            • String ID: GetSystemWow64DirectoryW$X64
                            • API String ID: 145871493-2590602151
                            • Opcode ID: 8950039e35c9f16d28b87ac302ef9f5229221ac5049a0e669f68d4287c855011
                            • Instruction ID: f6fc4af9b3735fdc9e7210f7232293c5cb90952285cf3d4d2df28ecd9c4f11d1
                            • Opcode Fuzzy Hash: 8950039e35c9f16d28b87ac302ef9f5229221ac5049a0e669f68d4287c855011
                            • Instruction Fuzzy Hash: ECF020B0801620DBD7362B108C18FBAB213EF12701F64837CE90AE1290DB28CE418692
                            Function 00674E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                            Download Yara Rule
                            APIs
                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E9C
                            • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00674EAE
                            • FreeLibrary.KERNEL32(00000000,?,?,00674EDD,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674EC0
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Library$AddressFreeLoadProc
                            • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                            • API String ID: 145871493-3689287502
                            • Opcode ID: c9887d07969b6d1e62ddb634e5ea42d239e10fa92c74628b10e073ca4317a7db
                            • Instruction ID: 0249ce306348c0d6603e60f2f9e1fd9cd093dfc2229196575c1797833a4abe88
                            • Opcode Fuzzy Hash: c9887d07969b6d1e62ddb634e5ea42d239e10fa92c74628b10e073ca4317a7db
                            • Instruction Fuzzy Hash: 01E08676A01622DBD23317256C1CAAB6555AF81B72B058315FC04D2241DF68CD0180A4
                            Function 00674E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                            Download Yara Rule
                            APIs
                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E62
                            • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00674E74
                            • FreeLibrary.KERNEL32(00000000,?,?,006B3CDE,?,00741418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00674E87
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Library$AddressFreeLoadProc
                            • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                            • API String ID: 145871493-1355242751
                            • Opcode ID: 83f0b41dab3f4fa1427622d50198f9b8b7c36b6c9ed502bd06c375e89840c1c6
                            • Instruction ID: 595221ff06e9a9cf671c12505fdd393fc52d049ebe353c8192ef9cf56c6a77c5
                            • Opcode Fuzzy Hash: 83f0b41dab3f4fa1427622d50198f9b8b7c36b6c9ed502bd06c375e89840c1c6
                            • Instruction Fuzzy Hash: F7D0C27250262197D6331B246C0CDCB2A1EEF85B213058310B808E2250CF68CD0182D4
                            Function 006FA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentProcessId.KERNEL32 ref: 006FA427
                            • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 006FA435
                            • GetProcessIoCounters.KERNEL32(00000000,?), ref: 006FA468
                            • CloseHandle.KERNEL32(?), ref: 006FA63D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$CloseCountersCurrentHandleOpen
                            • String ID:
                            • API String ID: 3488606520-0
                            • Opcode ID: dee14fe3df5a660377fcceaa324ad7bcf47529f5ad8af5b45a6c8ca7d7b0dbca
                            • Instruction ID: 055da942f9e7b55de0ebd746c81dec0c13e6dd58df95c87d01b0ed7126a2a0fd
                            • Opcode Fuzzy Hash: dee14fe3df5a660377fcceaa324ad7bcf47529f5ad8af5b45a6c8ca7d7b0dbca
                            • Instruction Fuzzy Hash: E0A181B16043009FE760DF24C886F2AB7E6AF84714F14895DF559DB392DBB0EC418B96
                            Function 006DE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006DCF22,?), ref: 006DDDFD
                              • Part of subcall function 006DDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006DCF22,?), ref: 006DDE16
                              • Part of subcall function 006DE199: GetFileAttributesW.KERNEL32(?,006DCF95), ref: 006DE19A
                            • lstrcmpiW.KERNEL32(?,?), ref: 006DE473
                            • MoveFileW.KERNEL32(?,?), ref: 006DE4AC
                            • _wcslen.LIBCMT ref: 006DE5EB
                            • _wcslen.LIBCMT ref: 006DE603
                            • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 006DE650
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                            • String ID:
                            • API String ID: 3183298772-0
                            • Opcode ID: 9b32fa79af43d33dc462f2f1e06437e17c9fd3c1ca70500a39b944df54660315
                            • Instruction ID: b2cf03a08b8956a4d595ee7323e97c2790993b0fabfa8cfe28c851ec602e8a34
                            • Opcode Fuzzy Hash: 9b32fa79af43d33dc462f2f1e06437e17c9fd3c1ca70500a39b944df54660315
                            • Instruction Fuzzy Hash: 445184B29083459BC764EB90DC819DF73EEAF84340F00491FF589D7251EF75A588876A
                            Function 006FB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                              • Part of subcall function 006FC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006FB6AE,?,?), ref: 006FC9B5
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FC9F1
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FCA68
                              • Part of subcall function 006FC998: _wcslen.LIBCMT ref: 006FCA9E
                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006FBAA5
                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006FBB00
                            • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 006FBB63
                            • RegCloseKey.ADVAPI32(?,?), ref: 006FBBA6
                            • RegCloseKey.ADVAPI32(00000000), ref: 006FBBB3
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                            • String ID:
                            • API String ID: 826366716-0
                            • Opcode ID: 8a3a77c7a6ea64d81b5900b937c56395bcc75f04a100d2d85e76e7084b32ff28
                            • Instruction ID: c1e3abf91b8147c660d8ffa9dcfbac2f7d2b4c7154c80fcdb7a07024978f2a45
                            • Opcode Fuzzy Hash: 8a3a77c7a6ea64d81b5900b937c56395bcc75f04a100d2d85e76e7084b32ff28
                            • Instruction Fuzzy Hash: E8617C31208245AFD714DF14C891E7ABBE6FF84308F14999CF5998B2A2DB31ED45CB92
                            Function 006D8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                            Download Yara Rule
                            APIs
                            • VariantInit.OLEAUT32(?), ref: 006D8BCD
                            • VariantClear.OLEAUT32 ref: 006D8C3E
                            • VariantClear.OLEAUT32 ref: 006D8C9D
                            • VariantClear.OLEAUT32(?), ref: 006D8D10
                            • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 006D8D3B
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$Clear$ChangeInitType
                            • String ID:
                            • API String ID: 4136290138-0
                            • Opcode ID: 8ed117dfaa6cd56f923234ad6c20304cd4d5d65759fb139f71bd5d7111e0ecfa
                            • Instruction ID: 420bac599c9e208299d8fffa15a29a8a379964d706c6b1db7e92eb172f757908
                            • Opcode Fuzzy Hash: 8ed117dfaa6cd56f923234ad6c20304cd4d5d65759fb139f71bd5d7111e0ecfa
                            • Instruction Fuzzy Hash: 56515CB5A00219EFCB14CF59C894AAAB7FAFF89310B15855AF905DB350E734E911CF90
                            Function 006E8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                            Download Yara Rule
                            APIs
                            • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 006E8BAE
                            • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 006E8BDA
                            • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 006E8C32
                            • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 006E8C57
                            • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 006E8C5F
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: PrivateProfile$SectionWrite$String
                            • String ID:
                            • API String ID: 2832842796-0
                            • Opcode ID: 094e6c6aa00c9b6b36606611df46f03766949bd2e6a4bf6b0f18ce897b09ce35
                            • Instruction ID: 2bc96327ea08724d6645005153950d73d9ae586f16e0eaa6767dbde850ce565a
                            • Opcode Fuzzy Hash: 094e6c6aa00c9b6b36606611df46f03766949bd2e6a4bf6b0f18ce897b09ce35
                            • Instruction Fuzzy Hash: 6C515B35A002149FDB05DF65C881AADBBF2FF49314F18C098E809AB362CB35ED41CB94
                            Function 006F8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                            Download Yara Rule
                            APIs
                            • LoadLibraryW.KERNEL32(?,00000000,?), ref: 006F8F40
                            • GetProcAddress.KERNEL32(00000000,?), ref: 006F8FD0
                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 006F8FEC
                            • GetProcAddress.KERNEL32(00000000,?), ref: 006F9032
                            • FreeLibrary.KERNEL32(00000000), ref: 006F9052
                              • Part of subcall function 0068F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,006E1043,?,753CE610), ref: 0068F6E6
                              • Part of subcall function 0068F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,006CFA64,00000000,00000000,?,?,006E1043,?,753CE610,?,006CFA64), ref: 0068F70D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                            • String ID:
                            • API String ID: 666041331-0
                            • Opcode ID: bdfe5459d1ff0bfbcc30aa5deab52e7f6f7314beb1a635b78fcbebb3ba265514
                            • Instruction ID: 9b4291502f4c9fa178d3d4d71208284d537956e7d2f4d2c61a28920d3bab7f9e
                            • Opcode Fuzzy Hash: bdfe5459d1ff0bfbcc30aa5deab52e7f6f7314beb1a635b78fcbebb3ba265514
                            • Instruction Fuzzy Hash: 00514834605209DFCB15DF58C4849ADBBF2FF49314B08C1A8E90A9B362DB31ED86CB95
                            Function 00706B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                            Download Yara Rule
                            APIs
                            • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00706C33
                            • SetWindowLongW.USER32(?,000000EC,?), ref: 00706C4A
                            • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00706C73
                            • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,006EAB79,00000000,00000000), ref: 00706C98
                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00706CC7
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Long$MessageSendShow
                            • String ID:
                            • API String ID: 3688381893-0
                            • Opcode ID: 83f1d204c93dcf4e4fc8bbb59bc351b561ec035aacc26d822ed35569f97f36f1
                            • Instruction ID: da1f02c41126808fc14f8207b385c3d361aa3f84185dc72472ee53023e2dc872
                            • Opcode Fuzzy Hash: 83f1d204c93dcf4e4fc8bbb59bc351b561ec035aacc26d822ed35569f97f36f1
                            • Instruction Fuzzy Hash: 0641C175A00104EFE725DF28CC68FAA7BE5EB09350F154368E895A72E0C779BD61CA60
                            Function 006A2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free
                            • String ID:
                            • API String ID: 269201875-0
                            • Opcode ID: a1ffe7c38bb6425ffda0414afd659e29e4e2957b0247edbe0b0068d68e986d2e
                            • Instruction ID: 93ed80413e6bf5e2696b2b737e515508600cbfd007d6ba2992475b540e7414eb
                            • Opcode Fuzzy Hash: a1ffe7c38bb6425ffda0414afd659e29e4e2957b0247edbe0b0068d68e986d2e
                            • Instruction Fuzzy Hash: FF41E472A40201AFCB24EF7CC890A9EB7E6EF8A714F1545A9E615EB351D631AD01CB80
                            Function 0068912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                            Download Yara Rule
                            APIs
                            • GetCursorPos.USER32(?), ref: 00689141
                            • ScreenToClient.USER32(00000000,?), ref: 0068915E
                            • GetAsyncKeyState.USER32(00000001), ref: 00689183
                            • GetAsyncKeyState.USER32(00000002), ref: 0068919D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: AsyncState$ClientCursorScreen
                            • String ID:
                            • API String ID: 4210589936-0
                            • Opcode ID: 376c658c9a3a1f32126495839a55feff738f6765081b432afe4bf29340b44fc4
                            • Instruction ID: fa323a27960a579774580cb5765dd110c11296f5e103839344fffb018ecf2953
                            • Opcode Fuzzy Hash: 376c658c9a3a1f32126495839a55feff738f6765081b432afe4bf29340b44fc4
                            • Instruction Fuzzy Hash: 44415E31A0850AFBDF15AF64C848BFEB776FB05324F288319E465A22D0CB345951CF61
                            Function 006E3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetInputState.USER32 ref: 006E38CB
                            • TranslateAcceleratorW.USER32(?,00000000,?), ref: 006E3922
                            • TranslateMessage.USER32(?), ref: 006E394B
                            • DispatchMessageW.USER32(?), ref: 006E3955
                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006E3966
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                            • String ID:
                            • API String ID: 2256411358-0
                            • Opcode ID: 26a01a69c573fd89d94eeeb0bb4a86d3249afb609f90754f754e412396d84abc
                            • Instruction ID: 03ad3e9f534c3544e592d74df42e691caff824fb60e957a7846cbe571977490c
                            • Opcode Fuzzy Hash: 26a01a69c573fd89d94eeeb0bb4a86d3249afb609f90754f754e412396d84abc
                            • Instruction Fuzzy Hash: 1C31E8745063D19EEB35DB36980CBF637A9AB02300F44456EE462C7392F7F89685CB25
                            Function 006ECF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                            Download Yara Rule
                            APIs
                            • InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 006ECF38
                            • InternetReadFile.WININET(?,00000000,?,?), ref: 006ECF6F
                            • GetLastError.KERNEL32(?,00000000,?,?,?,006EC21E,00000000), ref: 006ECFB4
                            • SetEvent.KERNEL32(?,?,00000000,?,?,?,006EC21E,00000000), ref: 006ECFC8
                            • SetEvent.KERNEL32(?,?,00000000,?,?,?,006EC21E,00000000), ref: 006ECFF2
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                            • String ID:
                            • API String ID: 3191363074-0
                            • Opcode ID: 6d2cc1e912bbf9499b89ee2bf4e99fd7c6742a4cf2408e08690fda4d26f33c25
                            • Instruction ID: 3265a58bf4a8f9609260a05815eb3d3157bb94ca0c633e9a4f753b4f5ed9beec
                            • Opcode Fuzzy Hash: 6d2cc1e912bbf9499b89ee2bf4e99fd7c6742a4cf2408e08690fda4d26f33c25
                            • Instruction Fuzzy Hash: A1314F71501345EFDB20DFA6C884AABBBFAEF14361B10852EF506D2240DB34AE42DB64
                            Function 006D1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                            Download Yara Rule
                            APIs
                            • GetWindowRect.USER32(?,?), ref: 006D1915
                            • PostMessageW.USER32(00000001,00000201,00000001), ref: 006D19C1
                            • Sleep.KERNEL32(00000000,?,?,?), ref: 006D19C9
                            • PostMessageW.USER32(00000001,00000202,00000000), ref: 006D19DA
                            • Sleep.KERNEL32(00000000,?,?,?,?), ref: 006D19E2
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessagePostSleep$RectWindow
                            • String ID:
                            • API String ID: 3382505437-0
                            • Opcode ID: 711f452232b365a9c974f9315f3f2dc3bc20d794e08b5d3e72838ba18cc1ad80
                            • Instruction ID: 05710fc7118f756866606f21fee0c8f107777457378249e1789e6338c9f81c63
                            • Opcode Fuzzy Hash: 711f452232b365a9c974f9315f3f2dc3bc20d794e08b5d3e72838ba18cc1ad80
                            • Instruction Fuzzy Hash: 51318171900219EFCB14CFA8C9A9ADE7BB6EB45315F108366F921AB3D1C7B09D54CB90
                            Function 00705706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00705745
                            • SendMessageW.USER32(?,00001074,?,00000001), ref: 0070579D
                            • _wcslen.LIBCMT ref: 007057AF
                            • _wcslen.LIBCMT ref: 007057BA
                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00705816
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$_wcslen
                            • String ID:
                            • API String ID: 763830540-0
                            • Opcode ID: 9c269a9dbf1518313f376ef657f4b6feb776e5cee8c9c5598d04d443ab57606e
                            • Instruction ID: 2b27743cd3c9c22b9b0c1c28b3e4f5099d1e1215df5075ae900ce6ee771f94ce
                            • Opcode Fuzzy Hash: 9c269a9dbf1518313f376ef657f4b6feb776e5cee8c9c5598d04d443ab57606e
                            • Instruction Fuzzy Hash: 98218F75904618EADB209FA0CC84EEE77BCFF04320F108356F929AA1C0E7789985CF54
                            Function 006F0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                            Download Yara Rule
                            APIs
                            • IsWindow.USER32(00000000), ref: 006F0951
                            • GetForegroundWindow.USER32 ref: 006F0968
                            • GetDC.USER32(00000000), ref: 006F09A4
                            • GetPixel.GDI32(00000000,?,00000003), ref: 006F09B0
                            • ReleaseDC.USER32(00000000,00000003), ref: 006F09E8
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$ForegroundPixelRelease
                            • String ID:
                            • API String ID: 4156661090-0
                            • Opcode ID: 69a92afe0da436c5b5c8b79fa41ab090ddddb67b4f3d9d70750e6936ea5aefc0
                            • Instruction ID: 32011708739cb50d28127319b5a4cb2855cd2c5f60e8270cd8f6309b23303868
                            • Opcode Fuzzy Hash: 69a92afe0da436c5b5c8b79fa41ab090ddddb67b4f3d9d70750e6936ea5aefc0
                            • Instruction Fuzzy Hash: 62218135600204EFE754EF65C885AAEBBE6EF49700F04C16CF94A9B362DB74AC04CB94
                            Function 006ACDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                            Download Yara Rule
                            APIs
                            • GetEnvironmentStringsW.KERNEL32 ref: 006ACDC6
                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006ACDE9
                              • Part of subcall function 006A3820: RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852
                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 006ACE0F
                            • _free.LIBCMT ref: 006ACE22
                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006ACE31
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                            • String ID:
                            • API String ID: 336800556-0
                            • Opcode ID: 0d4b69a073d2e0e7487231c1b6eb0912e17bc8a1526af968b05fb8239de96cb8
                            • Instruction ID: bfb05163912ced6b25cc3abd0863e6571d63691a5c7c40fada9268bcfa4307c7
                            • Opcode Fuzzy Hash: 0d4b69a073d2e0e7487231c1b6eb0912e17bc8a1526af968b05fb8239de96cb8
                            • Instruction Fuzzy Hash: 5B01D8726012157FA72137BA6C48C7BA96EEEC7BB1315426DF905D7301EE648D0289F4
                            Function 00689639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                            Download Yara Rule
                            APIs
                            • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00689693
                            • SelectObject.GDI32(?,00000000), ref: 006896A2
                            • BeginPath.GDI32(?), ref: 006896B9
                            • SelectObject.GDI32(?,00000000), ref: 006896E2
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ObjectSelect$BeginCreatePath
                            • String ID:
                            • API String ID: 3225163088-0
                            • Opcode ID: c3655b174bf1995f8f6f2012b3fe065c9625977bdba8cad07600eee2b28d2574
                            • Instruction ID: 8650cd9ef35c12f1583126adb5716dcf9b8a6c453a690b44c7fc5db2490488d9
                            • Opcode Fuzzy Hash: c3655b174bf1995f8f6f2012b3fe065c9625977bdba8cad07600eee2b28d2574
                            • Instruction Fuzzy Hash: 82217174801345EBEB11BF64DC047F93B66BB01315F548317F410A61A0E77868D1CFA8
                            Function 006D5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _memcmp
                            • String ID:
                            • API String ID: 2931989736-0
                            • Opcode ID: 34c16b7c07df049d01809d1f035037382d586bbd434a84876f6b1358b5620c93
                            • Instruction ID: 7232e8ae29602a62ab42674934e3db59d42fbbb70744b63a955e10776a617c3b
                            • Opcode Fuzzy Hash: 34c16b7c07df049d01809d1f035037382d586bbd434a84876f6b1358b5620c93
                            • Instruction Fuzzy Hash: D101D6A1A41605FAE61851109D42EFB739F9B22394B200026FD069EF81FA60ED1186B4
                            Function 006A2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • GetLastError.KERNEL32(?,?,?,0069F2DE,006A3863,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6), ref: 006A2DFD
                            • _free.LIBCMT ref: 006A2E32
                            • _free.LIBCMT ref: 006A2E59
                            • SetLastError.KERNEL32(00000000,00671129), ref: 006A2E66
                            • SetLastError.KERNEL32(00000000,00671129), ref: 006A2E6F
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLast$_free
                            • String ID:
                            • API String ID: 3170660625-0
                            • Opcode ID: 1e44963ec2f6b11c2dac8921102c53ba8c70c5233784b19bfab8661019634308
                            • Instruction ID: d36a7fed01397c3c2358aeb3016c633e995b14ada113311d059d0aa065371f94
                            • Opcode Fuzzy Hash: 1e44963ec2f6b11c2dac8921102c53ba8c70c5233784b19bfab8661019634308
                            • Instruction Fuzzy Hash: 470149322C46026BC613733D2C96D6B265BBBC3771720422CF421E2392EF38CC410D25
                            Function 006D000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                            Download Yara Rule
                            APIs
                            • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?,?,006D035E), ref: 006D002B
                            • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0046
                            • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0054
                            • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?), ref: 006D0064
                            • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,006CFF41,80070057,?,?), ref: 006D0070
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: From$Prog$FreeStringTasklstrcmpi
                            • String ID:
                            • API String ID: 3897988419-0
                            • Opcode ID: 0b6bda09415d5670352e7a485a80b97ea55f611c4217ab6bc4a6ecc5fe506de6
                            • Instruction ID: 4e96c80fc3a6c5e96ac05ee8196baa4cdf3badbb929bea343b415846fe9fec11
                            • Opcode Fuzzy Hash: 0b6bda09415d5670352e7a485a80b97ea55f611c4217ab6bc4a6ecc5fe506de6
                            • Instruction Fuzzy Hash: 6901A272A00204FFEB114F68DC04BAA7AEEEF84752F148225F905D6350DBB5DD408BA4
                            Function 006DE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                            Download Yara Rule
                            APIs
                            • QueryPerformanceCounter.KERNEL32(?), ref: 006DE997
                            • QueryPerformanceFrequency.KERNEL32(?), ref: 006DE9A5
                            • Sleep.KERNEL32(00000000), ref: 006DE9AD
                            • QueryPerformanceCounter.KERNEL32(?), ref: 006DE9B7
                            • Sleep.KERNEL32 ref: 006DE9F3
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: PerformanceQuery$CounterSleep$Frequency
                            • String ID:
                            • API String ID: 2833360925-0
                            • Opcode ID: 24574819aaa9ff204d7e2324cd3e416761820ef1ca20573d58acadcecf453de3
                            • Instruction ID: 576d54e9673b2ff76fb0b8d1e1b931f390cdcc18a5d9ac8edf40f7a53cde23a8
                            • Opcode Fuzzy Hash: 24574819aaa9ff204d7e2324cd3e416761820ef1ca20573d58acadcecf453de3
                            • Instruction Fuzzy Hash: 31016971C0262DDBCF00AFE4DC69AEDBB79FF08300F004656E502BA240CB399551CBA5
                            Function 006D10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                            Download Yara Rule
                            APIs
                            • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006D1114
                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1120
                            • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D112F
                            • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,006D0B9B,?,?,?), ref: 006D1136
                            • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006D114D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                            • String ID:
                            • API String ID: 842720411-0
                            • Opcode ID: bc4075c5ed620cbfb5757f2289a35287be4a53e2701a17504e5d5807131aa3be
                            • Instruction ID: 321a75c3afeb59e1bff40d88eb9cff5656137af84be594ac3c85cfbeaa973941
                            • Opcode Fuzzy Hash: bc4075c5ed620cbfb5757f2289a35287be4a53e2701a17504e5d5807131aa3be
                            • Instruction Fuzzy Hash: 35011D75500205FFEB124F65DC49AAA3B7EEF8A360B204615FA45D7350DE75DC009A64
                            Function 006D0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                            Download Yara Rule
                            APIs
                            • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006D0FCA
                            • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006D0FD6
                            • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006D0FE5
                            • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006D0FEC
                            • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006D1002
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: HeapInformationToken$AllocErrorLastProcess
                            • String ID:
                            • API String ID: 44706859-0
                            • Opcode ID: df0156e98fd5d1acd170b656df16914eb8c76faedd775361c81afdea70675c02
                            • Instruction ID: b4c4900f2e05f53a8cfedb713f31a5e681e6dba65859393bf1f0bcd353e0696b
                            • Opcode Fuzzy Hash: df0156e98fd5d1acd170b656df16914eb8c76faedd775361c81afdea70675c02
                            • Instruction Fuzzy Hash: 83F04F75600305FBD7225FA59C49F963B6EEF8A761F108615F945CA351CE74DC408A60
                            Function 006D1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                            Download Yara Rule
                            APIs
                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006D102A
                            • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006D1036
                            • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006D1045
                            • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006D104C
                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006D1062
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: HeapInformationToken$AllocErrorLastProcess
                            • String ID:
                            • API String ID: 44706859-0
                            • Opcode ID: de4ea7b628e3e44b1b02c113b97c0421d8b5c8738c848b1b12f20490e1dd8ed1
                            • Instruction ID: 3ecf9cd5a89387e4ec781d9ca001f7509f0e3fc5514ac8144c8775ff8fbd5bfc
                            • Opcode Fuzzy Hash: de4ea7b628e3e44b1b02c113b97c0421d8b5c8738c848b1b12f20490e1dd8ed1
                            • Instruction Fuzzy Hash: 26F04F75200305FBD7226FA4EC49F963B6EEF8A761F104615F945CA350CE74DC808A60
                            Function 006E030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                            Download Yara Rule
                            APIs
                            • CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0324
                            • CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0331
                            • CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E033E
                            • CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E034B
                            • CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0358
                            • CloseHandle.KERNEL32(?,?,?,?,006E017D,?,006E32FC,?,00000001,006B2592,?), ref: 006E0365
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CloseHandle
                            • String ID:
                            • API String ID: 2962429428-0
                            • Opcode ID: 6c758d888037d8d62c7e11ae46fe9c98a988773696d582e0c52b103fb5343bca
                            • Instruction ID: 1f826990833473cb5200e738e868ac3a560131eb1ca2ba254feffe262f751a37
                            • Opcode Fuzzy Hash: 6c758d888037d8d62c7e11ae46fe9c98a988773696d582e0c52b103fb5343bca
                            • Instruction Fuzzy Hash: C201E272801B42DFD7309F66D880442F7F6BF503053158A3FD19252A30C3B1A984CF80
                            Function 006AD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • _free.LIBCMT ref: 006AD752
                              • Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
                              • Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0
                            • _free.LIBCMT ref: 006AD764
                            • _free.LIBCMT ref: 006AD776
                            • _free.LIBCMT ref: 006AD788
                            • _free.LIBCMT ref: 006AD79A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free$ErrorFreeHeapLast
                            • String ID:
                            • API String ID: 776569668-0
                            • Opcode ID: 3e6019ffa026cca1e66410f55736b3a45a2d0e8ff19c1c788a3219b5a5353020
                            • Instruction ID: 25fa1911e4524342f1fb330f6d159d27089957e11b4ee9c507681f7c51d15bf0
                            • Opcode Fuzzy Hash: 3e6019ffa026cca1e66410f55736b3a45a2d0e8ff19c1c788a3219b5a5353020
                            • Instruction Fuzzy Hash: C4F0AF32141209AF82A6FB29F8C1C9B37DFBB06B11B950809F009E3A01C724FC808F68
                            Function 006D5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                            Download Yara Rule
                            APIs
                            • GetDlgItem.USER32(?,000003E9), ref: 006D5C58
                            • GetWindowTextW.USER32(00000000,?,00000100), ref: 006D5C6F
                            • MessageBeep.USER32(00000000), ref: 006D5C87
                            • KillTimer.USER32(?,0000040A), ref: 006D5CA3
                            • EndDialog.USER32(?,00000001), ref: 006D5CBD
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: BeepDialogItemKillMessageTextTimerWindow
                            • String ID:
                            • API String ID: 3741023627-0
                            • Opcode ID: 0ae64d59ed3e9526071ed430b249c887a22ff058517b1ebcd7161e1e9920dbdc
                            • Instruction ID: fd3cb8f96b2296db866d0d320ab11668d223341fb339ebfcc4b4c6fde08c38bd
                            • Opcode Fuzzy Hash: 0ae64d59ed3e9526071ed430b249c887a22ff058517b1ebcd7161e1e9920dbdc
                            • Instruction Fuzzy Hash: 9001D130900B04EBEB315B10DD4EFE67BB9BB00B01F04435EB583A16E1DFF5A9848A95
                            Function 006A22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                            Download Yara Rule
                            APIs
                            • _free.LIBCMT ref: 006A22BE
                              • Part of subcall function 006A29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000), ref: 006A29DE
                              • Part of subcall function 006A29C8: GetLastError.KERNEL32(00000000,?,006AD7D1,00000000,00000000,00000000,00000000,?,006AD7F8,00000000,00000007,00000000,?,006ADBF5,00000000,00000000), ref: 006A29F0
                            • _free.LIBCMT ref: 006A22D0
                            • _free.LIBCMT ref: 006A22E3
                            • _free.LIBCMT ref: 006A22F4
                            • _free.LIBCMT ref: 006A2305
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free$ErrorFreeHeapLast
                            • String ID:
                            • API String ID: 776569668-0
                            • Opcode ID: 965316b21283f1acdf0ddb5de9ce23b8aef36569cba1cbbaf40ee475e6dfef75
                            • Instruction ID: 3bc8ab9b5c6089a8eda4d2dde1eaa5205dc12e00835b55c6789424a9052c4578
                            • Opcode Fuzzy Hash: 965316b21283f1acdf0ddb5de9ce23b8aef36569cba1cbbaf40ee475e6dfef75
                            • Instruction Fuzzy Hash: 08F030785802118F8793BF69BC118493B66B71BF51740851BF510D2271C73C2D51AFED
                            Function 006895C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                            Download Yara Rule
                            APIs
                            • EndPath.GDI32(?), ref: 006895D4
                            • StrokeAndFillPath.GDI32(?,?,006C71F7,00000000,?,?,?), ref: 006895F0
                            • SelectObject.GDI32(?,00000000), ref: 00689603
                            • DeleteObject.GDI32 ref: 00689616
                            • StrokePath.GDI32(?), ref: 00689631
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Path$ObjectStroke$DeleteFillSelect
                            • String ID:
                            • API String ID: 2625713937-0
                            • Opcode ID: 91b3621ad0f37d5f91c102819a2034184ea9937b476fb0cd4e547b623c555a59
                            • Instruction ID: beb967f044e036a24ee2647f8e7b5d84cee544acee8fd2fe1295a3a1f75510a7
                            • Opcode Fuzzy Hash: 91b3621ad0f37d5f91c102819a2034184ea9937b476fb0cd4e547b623c555a59
                            • Instruction Fuzzy Hash: C6F03C38006248EBDB126F65ED1C7B43B62AB06322F48C315F429551F0DB7899D1DF28
                            Function 006A0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: __freea$_free
                            • String ID: a/p$am/pm
                            • API String ID: 3432400110-3206640213
                            • Opcode ID: 1b52a83e9b4fdd0bbc174c13733de805687d19653f7e45a70d7ed2574e3a9af2
                            • Instruction ID: 3ec76fce13a6bb5fa215643f342dc915cb2e49df7eeeb530cfadabe563ad1e71
                            • Opcode Fuzzy Hash: 1b52a83e9b4fdd0bbc174c13733de805687d19653f7e45a70d7ed2574e3a9af2
                            • Instruction Fuzzy Hash: 5CD1EE31900206DADF28AF68C855BFAB7B7EF07310F28415AE901AF751D6359E81CFA5
                            Function 006F61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00690242: EnterCriticalSection.KERNEL32(0074070C,00741884,?,?,0068198B,00742518,?,?,?,006712F9,00000000), ref: 0069024D
                              • Part of subcall function 00690242: LeaveCriticalSection.KERNEL32(0074070C,?,0068198B,00742518,?,?,?,006712F9,00000000), ref: 0069028A
                              • Part of subcall function 006900A3: __onexit.LIBCMT ref: 006900A9
                            • __Init_thread_footer.LIBCMT ref: 006F6238
                              • Part of subcall function 006901F8: EnterCriticalSection.KERNEL32(0074070C,?,?,00688747,00742514), ref: 00690202
                              • Part of subcall function 006901F8: LeaveCriticalSection.KERNEL32(0074070C,?,00688747,00742514), ref: 00690235
                              • Part of subcall function 006E359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006E35E4
                              • Part of subcall function 006E359C: LoadStringW.USER32(00742390,?,00000FFF,?), ref: 006E360A
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
                            • String ID: x#t$x#t$x#t
                            • API String ID: 1072379062-2514561250
                            • Opcode ID: 755b57864bcd30fbdcaa79cfe70b5a9d0f6ee130d8cf26d832308dae3b77e8ef
                            • Instruction ID: e04777438adb1b0f6af3bfe26cda23d9a4cd4cd14eee40992926063168454843
                            • Opcode Fuzzy Hash: 755b57864bcd30fbdcaa79cfe70b5a9d0f6ee130d8cf26d832308dae3b77e8ef
                            • Instruction Fuzzy Hash: 1DC16D71A00109AFDB14EF98C891DBEB7BAEF49300F148169FA15AB291DB70ED45CB94
                            Function 006A8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 006A8B6E
                            • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 006A8B7A
                            • __dosmaperr.LIBCMT ref: 006A8B81
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ByteCharErrorLastMultiWide__dosmaperr
                            • String ID: .i
                            • API String ID: 2434981716-2647164722
                            • Opcode ID: a386653e51266ebcd5670687cb90bf86fc04500dfd7cd1b3c70f9faeb1a1a7e2
                            • Instruction ID: 5353e6a9359748ff0b057722ab8543cfea4630a87829eef504b5a5398fef7f34
                            • Opcode Fuzzy Hash: a386653e51266ebcd5670687cb90bf86fc04500dfd7cd1b3c70f9faeb1a1a7e2
                            • Instruction Fuzzy Hash: D54160B0604145AFDB25AF54C880ABD7FE7DB87304B2881AAF98587652DE35CC028FA4
                            Function 006D2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006DB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006D21D0,?,?,00000034,00000800,?,00000034), ref: 006DB42D
                            • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 006D2760
                              • Part of subcall function 006DB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006D21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 006DB3F8
                              • Part of subcall function 006DB32A: GetWindowThreadProcessId.USER32(?,?), ref: 006DB355
                              • Part of subcall function 006DB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,006D2194,00000034,?,?,00001004,00000000,00000000), ref: 006DB365
                              • Part of subcall function 006DB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,006D2194,00000034,?,?,00001004,00000000,00000000), ref: 006DB37B
                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006D27CD
                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006D281A
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                            • String ID: @
                            • API String ID: 4150878124-2766056989
                            • Opcode ID: 9d0968765f3cdbb2a872a0bd396bf803fb5d3775ee298d25faaa6cb602158978
                            • Instruction ID: d37992d2b03a2f28155a0d984b076cd900de0fdae46f2b822658bdae49946043
                            • Opcode Fuzzy Hash: 9d0968765f3cdbb2a872a0bd396bf803fb5d3775ee298d25faaa6cb602158978
                            • Instruction Fuzzy Hash: A6414F72D00218AFDB10DBA4CC51EEEBBB9EF15300F00509AFA55B7281DB706E45DBA0
                            Function 006A172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                            Download Yara Rule
                            APIs
                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\1lAxaLKP7E.exe,00000104), ref: 006A1769
                            • _free.LIBCMT ref: 006A1834
                            • _free.LIBCMT ref: 006A183E
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free$FileModuleName
                            • String ID: C:\Users\user\Desktop\1lAxaLKP7E.exe
                            • API String ID: 2506810119-1547275962
                            • Opcode ID: 21dbe8b303686cbf3e6ae24327481f664d0b2be6fbbfc91c5b19d9cacacc44e0
                            • Instruction ID: ce58d4fb8749f1f9b09e2e8eddaca525c7820c8ce80987f4b24bec9e67795c08
                            • Opcode Fuzzy Hash: 21dbe8b303686cbf3e6ae24327481f664d0b2be6fbbfc91c5b19d9cacacc44e0
                            • Instruction Fuzzy Hash: 8D31A275A40218EFCB21EB999881D9EBBFEEB87310F50416AF404DB211D7B48E40CF94
                            Function 006DC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 006DC306
                            • DeleteMenu.USER32(?,00000007,00000000), ref: 006DC34C
                            • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00741990,00D04D40), ref: 006DC395
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Menu$Delete$InfoItem
                            • String ID: 0
                            • API String ID: 135850232-4108050209
                            • Opcode ID: 0f2c6121a08bedfe25fea75d26409e18a922bd55fad0f89348f0808e5e07363c
                            • Instruction ID: 519710a6c378a41f5498e19c61ffb1d05f92f80a3cc1f9808181bf1dc63c473a
                            • Opcode Fuzzy Hash: 0f2c6121a08bedfe25fea75d26409e18a922bd55fad0f89348f0808e5e07363c
                            • Instruction Fuzzy Hash: 1C41BF31A04346DFDB20DF28D884B5ABBE6AF85320F11861EF9A5973D1C730E904CB66
                            Function 00704416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                            Download Yara Rule
                            APIs
                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0070CC08,00000000,?,?,?,?), ref: 007044AA
                            • GetWindowLongW.USER32 ref: 007044C7
                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 007044D7
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Long
                            • String ID: SysTreeView32
                            • API String ID: 847901565-1698111956
                            • Opcode ID: 91ef53047b96758324edb57e52c487b2b8816e8455a12e17325d0e15fa4d6044
                            • Instruction ID: e1e66478e879de96f2a1e22fd76208cf89d6f87b095690ebd79752337acede82
                            • Opcode Fuzzy Hash: 91ef53047b96758324edb57e52c487b2b8816e8455a12e17325d0e15fa4d6044
                            • Instruction Fuzzy Hash: D1319CB1210245EBDB219F38DC45BEA77A9EB08334F208319FA79922D0DB78AC609750
                            Function 006D6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON
                            Download Yara Rule
                            APIs
                            • SysReAllocString.OLEAUT32(?,?), ref: 006D6EED
                            • VariantCopyInd.OLEAUT32(?,?), ref: 006D6F08
                            • VariantClear.OLEAUT32(?), ref: 006D6F12
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$AllocClearCopyString
                            • String ID: *jm
                            • API String ID: 2173805711-1720354028
                            • Opcode ID: da4c27788201152a0c6fd5d9752b8099981ea18968945bfaee912f28e549b3e7
                            • Instruction ID: e4938c505bcf07b240d03f7ac1783e22eadf15fe9531d5d4d8e26dcaa33f7e70
                            • Opcode Fuzzy Hash: da4c27788201152a0c6fd5d9752b8099981ea18968945bfaee912f28e549b3e7
                            • Instruction Fuzzy Hash: 3231CFB1A04645DBCB05AFA5E8909BE37B7FF80300B10459EF9024B3B1CB349D12CBA4
                            Function 006F304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006F335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,006F3077,?,?), ref: 006F3378
                            • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 006F307A
                            • _wcslen.LIBCMT ref: 006F309B
                            • htons.WSOCK32(00000000,?,?,00000000), ref: 006F3106
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                            • String ID: 255.255.255.255
                            • API String ID: 946324512-2422070025
                            • Opcode ID: b9507baac4f69ac285bdbf2679608bb24084f23bf96563d38788626a8672a776
                            • Instruction ID: 97308691bd579e6d052704c54b438f7f03688258ee6724a6005609df5105149d
                            • Opcode Fuzzy Hash: b9507baac4f69ac285bdbf2679608bb24084f23bf96563d38788626a8672a776
                            • Instruction Fuzzy Hash: 7E31C1356002199FCB10CF28C585EBA77E2EF15318F24C15AEA158B392DB72EE45C761
                            Function 00704653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00704705
                            • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00704713
                            • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0070471A
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$DestroyWindow
                            • String ID: msctls_updown32
                            • API String ID: 4014797782-2298589950
                            • Opcode ID: fc6b5b80054ef78ccd870a3b1917b3169a4fdc361cebc785272f88a9729068d0
                            • Instruction ID: c93b3136dc82cdf0f40b730f1d3f59ad17eafb89df05c32d7dae3903ab7ee1f6
                            • Opcode Fuzzy Hash: fc6b5b80054ef78ccd870a3b1917b3169a4fdc361cebc785272f88a9729068d0
                            • Instruction Fuzzy Hash: EC217CF5600209EFEB10DF68DC91DA637EDEB4A3A4B004149FA009B2A1CB35EC51CA64
                            Function 006D95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen
                            • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                            • API String ID: 176396367-2734436370
                            • Opcode ID: b2387e06a1641ace3964456289d9b7d7ccb801e814b6cd317d0ead11be213cc3
                            • Instruction ID: c5f4a7fc69e0ef67c70f35e114883e5c4f241930c023433f6b39cdf5643b900c
                            • Opcode Fuzzy Hash: b2387e06a1641ace3964456289d9b7d7ccb801e814b6cd317d0ead11be213cc3
                            • Instruction Fuzzy Hash: ED212672604151A6D771BB24A802FF773DA9F91310F10402BF94997782EB55ED92C3E9
                            Function 007037B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00703840
                            • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00703850
                            • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00703876
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend$MoveWindow
                            • String ID: Listbox
                            • API String ID: 3315199576-2633736733
                            • Opcode ID: 81389cf97d70e00d4a6c6c2d166f862ff0ad3d346ee3e29259f17e3eb96f19cd
                            • Instruction ID: 65bc9cc4aca2bb745a49bbb3eb903876e324758cf0b66d4803d6147dc9f20558
                            • Opcode Fuzzy Hash: 81389cf97d70e00d4a6c6c2d166f862ff0ad3d346ee3e29259f17e3eb96f19cd
                            • Instruction Fuzzy Hash: CE218072610118FBEB229F54CC85EBB37AEEF89764F108214F9449B1D0CA79DC5287A0
                            Function 006E49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                            Download Yara Rule
                            APIs
                            • SetErrorMode.KERNEL32(00000001), ref: 006E4A08
                            • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 006E4A5C
                            • SetErrorMode.KERNEL32(00000000,?,?,0070CC08), ref: 006E4AD0
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorMode$InformationVolume
                            • String ID: %lu
                            • API String ID: 2507767853-685833217
                            • Opcode ID: 93977e1c30094b7f16fdf09663966fa149141082c638d2b3cd09b2223471431e
                            • Instruction ID: ad027e66b38b363e68625cc83f392dd4e73765c27f9cfeff99918cb58212218d
                            • Opcode Fuzzy Hash: 93977e1c30094b7f16fdf09663966fa149141082c638d2b3cd09b2223471431e
                            • Instruction Fuzzy Hash: 19318170A00208AFDB11DF64C885EAA77F9EF08304F1480A9F409DB352DB75ED45CB65
                            Function 007041EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0070424F
                            • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00704264
                            • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00704271
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend
                            • String ID: msctls_trackbar32
                            • API String ID: 3850602802-1010561917
                            • Opcode ID: fccf9f28e5d052cb2fadf88d0f3e2bf4b9544da2480cee5603c03d1b72f6c291
                            • Instruction ID: ea3f1cff94321fd0b692d536d0aa9f628970cf00adb2be7ab8bb8d214e8220fc
                            • Opcode Fuzzy Hash: fccf9f28e5d052cb2fadf88d0f3e2bf4b9544da2480cee5603c03d1b72f6c291
                            • Instruction Fuzzy Hash: BE11C171240208BEEF209F28CC06FAB3BECEF85B64F014218FA55E20D0D675D8619B14
                            Function 006D2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                              • Part of subcall function 006D2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006D2DC5
                              • Part of subcall function 006D2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 006D2DD6
                              • Part of subcall function 006D2DA7: GetCurrentThreadId.KERNEL32 ref: 006D2DDD
                              • Part of subcall function 006D2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 006D2DE4
                            • GetFocus.USER32 ref: 006D2F78
                              • Part of subcall function 006D2DEE: GetParent.USER32(00000000), ref: 006D2DF9
                            • GetClassNameW.USER32(?,?,00000100), ref: 006D2FC3
                            • EnumChildWindows.USER32(?,006D303B), ref: 006D2FEB
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                            • String ID: %s%d
                            • API String ID: 1272988791-1110647743
                            • Opcode ID: d3cbca61e689a25c1c073a604d87042821aa6ae8881d510ff2b9af0dc0cc1516
                            • Instruction ID: 08f8c4c9c327fc762a85a1d07ef21181edffdcac21f47ac6e3eccd05056cfe2e
                            • Opcode Fuzzy Hash: d3cbca61e689a25c1c073a604d87042821aa6ae8881d510ff2b9af0dc0cc1516
                            • Instruction Fuzzy Hash: 5911E471A00205ABDF917F70CC95EEE376BAF94304F04817AF9099B392DE359A498B74
                            Function 00705882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007058C1
                            • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007058EE
                            • DrawMenuBar.USER32(?), ref: 007058FD
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Menu$InfoItem$Draw
                            • String ID: 0
                            • API String ID: 3227129158-4108050209
                            • Opcode ID: 9db32605d41c7cd3f74d2e312df3bf52037d1f45d879be4e934d56988956120f
                            • Instruction ID: 8fa6db693672f91ab4a3c7df229cb0456cd23e7a13c20ac84c5f90622a30a1da
                            • Opcode Fuzzy Hash: 9db32605d41c7cd3f74d2e312df3bf52037d1f45d879be4e934d56988956120f
                            • Instruction Fuzzy Hash: DF01A931500208EFDB219F11DC48BAFBBB5FB45361F1082A9F848D6191DB789A90EF20
                            Function 006D007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 4edc20ff8f08d7568b8b4f92a6a46c94f43bd7d416f3e88365520cb3844cb588
                            • Instruction ID: d48fa68240e5fcc047ed75daf11c009e5ad0fdb11ba66405f8a7f497f505a325
                            • Opcode Fuzzy Hash: 4edc20ff8f08d7568b8b4f92a6a46c94f43bd7d416f3e88365520cb3844cb588
                            • Instruction Fuzzy Hash: 33C13775A00216AFEB14CFA4C894BAEB7B6FF48304F218599E505EB351D731EE42CB90
                            Function 006F342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Variant$ClearInitInitializeUninitialize
                            • String ID:
                            • API String ID: 1998397398-0
                            • Opcode ID: a22fbbc3d13dd991269b3799dc95378052e524cd03e8b6836d7d9cc8b12b7272
                            • Instruction ID: 91d6aeb1cf4e81036346038786749cbbccca90f0cc622912a2b394e3e95f73a4
                            • Opcode Fuzzy Hash: a22fbbc3d13dd991269b3799dc95378052e524cd03e8b6836d7d9cc8b12b7272
                            • Instruction Fuzzy Hash: 9AA15B756043149FD740EF28C485A2AB7E6FF88714F14895DFA8A9B362DB30EE01CB95
                            Function 006D0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                            Download Yara Rule
                            APIs
                            • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0070FC08,?), ref: 006D05F0
                            • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0070FC08,?), ref: 006D0608
                            • CLSIDFromProgID.OLE32(?,?,00000000,0070CC40,000000FF,?,00000000,00000800,00000000,?,0070FC08,?), ref: 006D062D
                            • _memcmp.LIBVCRUNTIME ref: 006D064E
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FromProg$FreeTask_memcmp
                            • String ID:
                            • API String ID: 314563124-0
                            • Opcode ID: 6a5c4bcb4f5a52a56f71a926922e6301f6954a49c4308d87531bab47c530ec3f
                            • Instruction ID: 9545daa64f8d00855265fc8d297caacb1aba106b22422b0c37d153784d169273
                            • Opcode Fuzzy Hash: 6a5c4bcb4f5a52a56f71a926922e6301f6954a49c4308d87531bab47c530ec3f
                            • Instruction Fuzzy Hash: 96810D75E00109EFDB04DF94C984EEEB7BAFF89315F204599E506AB250DB71AE06CB60
                            Function 006B1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _free
                            • String ID:
                            • API String ID: 269201875-0
                            • Opcode ID: d48fc3ad084f29c3038847b65c276018edaacedc275325d8e0700d2d84ced069
                            • Instruction ID: 9a628888ba1285d9d6f947a8bc9a826ad20ca0d1bf66e8048acae57b92b499c8
                            • Opcode Fuzzy Hash: d48fc3ad084f29c3038847b65c276018edaacedc275325d8e0700d2d84ced069
                            • Instruction Fuzzy Hash: 3A4137B1600110BBDF217BF98C556EE3AEBEF43330F644269F419CA292EA348D814766
                            Function 00706278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                            Download Yara Rule
                            APIs
                            • GetWindowRect.USER32(00D0DCF8,?), ref: 007062E2
                            • ScreenToClient.USER32(?,?), ref: 00706315
                            • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00706382
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$ClientMoveRectScreen
                            • String ID:
                            • API String ID: 3880355969-0
                            • Opcode ID: f7cbfe4f9d93287f5b6493a6c3d5b072de9aed0475a1a38baba912aaec684edc
                            • Instruction ID: 994b7bb773e5bbaaac496766a0cd174d93538346fc15bee23dc941e10437617e
                            • Opcode Fuzzy Hash: f7cbfe4f9d93287f5b6493a6c3d5b072de9aed0475a1a38baba912aaec684edc
                            • Instruction Fuzzy Hash: AA512A75900249EFDF20DF54D890AAE7BF6FB45360F108259F915972D0D734AD91CB90
                            Function 006F1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                            Download Yara Rule
                            APIs
                            • socket.WSOCK32(00000002,00000002,00000011), ref: 006F1AFD
                            • WSAGetLastError.WSOCK32 ref: 006F1B0B
                            • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 006F1B8A
                            • WSAGetLastError.WSOCK32 ref: 006F1B94
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorLast$socket
                            • String ID:
                            • API String ID: 1881357543-0
                            • Opcode ID: e240cfb1e2856ae3a714cdb22fdc72cb06355b3d90be335b2f36c22b96f969a8
                            • Instruction ID: 40c8c39ba67267b8ea73a6c01c136f79412fc48c07316d21c46d06eff1f41baa
                            • Opcode Fuzzy Hash: e240cfb1e2856ae3a714cdb22fdc72cb06355b3d90be335b2f36c22b96f969a8
                            • Instruction Fuzzy Hash: 3C41BE34640200EFE760AF24C886F6A77E6AB45718F54C54CFA1A9F3D3D672ED428B94
                            Function 006AB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                            Download Yara Rule
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 59eade04012d86d120e427c93c684d68095e7dab366d3afc7731aa274f8e6637
                            • Instruction ID: a2c08efa17b77f7b94433d0efd1f8ff4a2446cc60a872e858c9e76c665e2f292
                            • Opcode Fuzzy Hash: 59eade04012d86d120e427c93c684d68095e7dab366d3afc7731aa274f8e6637
                            • Instruction Fuzzy Hash: 4841D371A00704BFD724AF78CC41BAABBEAEF8A710F10452EF551DB682D771AD418B94
                            Function 006E56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                            Download Yara Rule
                            APIs
                            • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 006E5783
                            • GetLastError.KERNEL32(?,00000000), ref: 006E57A9
                            • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 006E57CE
                            • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 006E57FA
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateHardLink$DeleteErrorFileLast
                            • String ID:
                            • API String ID: 3321077145-0
                            • Opcode ID: 6415a86d135d9491d22ceeabc0421df45ee6c752eb2fb11829afe1f15959b97e
                            • Instruction ID: ec53b9d0a3adce2431161d8b3f464251d327104b8ee0a65a17b473bf999fe7ca
                            • Opcode Fuzzy Hash: 6415a86d135d9491d22ceeabc0421df45ee6c752eb2fb11829afe1f15959b97e
                            • Instruction Fuzzy Hash: 94412939600610DFCB11EF15C584A5EBBE2EF89724B18C488E85AAB362CB34FD00CB95
                            Function 006AD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                            Download Yara Rule
                            APIs
                            • MultiByteToWideChar.KERNEL32(?,00000000,?,00696D71,00000000,00000000,006982D9,?,006982D9,?,00000001,00696D71,?,00000001,006982D9,006982D9), ref: 006AD910
                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006AD999
                            • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 006AD9AB
                            • __freea.LIBCMT ref: 006AD9B4
                              • Part of subcall function 006A3820: RtlAllocateHeap.NTDLL(00000000,?,00741444,?,0068FDF5,?,?,0067A976,00000010,00741440,006713FC,?,006713C6,?,00671129), ref: 006A3852
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                            • String ID:
                            • API String ID: 2652629310-0
                            • Opcode ID: a66779ae24c7e2d937671a693b508a1352316e21eaadf71cf47dc0412fa167b6
                            • Instruction ID: 3065ad20dc9e3b23ecec7c14bdeb99d5a71c30b05f44fb25311d38a33eb5dce8
                            • Opcode Fuzzy Hash: a66779ae24c7e2d937671a693b508a1352316e21eaadf71cf47dc0412fa167b6
                            • Instruction Fuzzy Hash: 2831A072A0020AABDF25AF64DC45EEF7BAAEF42310B054268FC05D7291EB35DD55CB90
                            Function 007052C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 00705352
                            • GetWindowLongW.USER32(?,000000F0), ref: 00705375
                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00705382
                            • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007053A8
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LongWindow$InvalidateMessageRectSend
                            • String ID:
                            • API String ID: 3340791633-0
                            • Opcode ID: 31a043048122f1d76eb392201ad9ba365ed50096284ec00a0c54dddc4d6f3639
                            • Instruction ID: cc00dbfaf580c3bf8d9201a6bb1c1e53c4e83ab052fa63496b8ace4355b2d9cb
                            • Opcode Fuzzy Hash: 31a043048122f1d76eb392201ad9ba365ed50096284ec00a0c54dddc4d6f3639
                            • Instruction Fuzzy Hash: F631C634A55A08EFEB309F14CC06BEAF7E5AB05394F584301FA10961E1C7BDA980DF55
                            Function 006DAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                            Download Yara Rule
                            APIs
                            • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 006DABF1
                            • SetKeyboardState.USER32(00000080,?,00008000), ref: 006DAC0D
                            • PostMessageW.USER32(00000000,00000101,00000000), ref: 006DAC74
                            • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 006DACC6
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: KeyboardState$InputMessagePostSend
                            • String ID:
                            • API String ID: 432972143-0
                            • Opcode ID: 5048f14fffc1b860e18c68337952a45e0fdcab34455c5f446f191f73b43a78bd
                            • Instruction ID: a6f3e7c864e2af0f380a691d5d44b4be262712d1c49ae3ae455c746aee66275e
                            • Opcode Fuzzy Hash: 5048f14fffc1b860e18c68337952a45e0fdcab34455c5f446f191f73b43a78bd
                            • Instruction Fuzzy Hash: 19310C30E68618AFFF35CBA58C047FA7767AB89330F04431BE485523D1C77589458756
                            Function 00707674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                            Download Yara Rule
                            APIs
                            • ClientToScreen.USER32(?,?), ref: 0070769A
                            • GetWindowRect.USER32(?,?), ref: 00707710
                            • PtInRect.USER32(?,?,00708B89), ref: 00707720
                            • MessageBeep.USER32(00000000), ref: 0070778C
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Rect$BeepClientMessageScreenWindow
                            • String ID:
                            • API String ID: 1352109105-0
                            • Opcode ID: 35a199f4cd0767ea9c1ea8937ecf8cb432643f9c07e7e6a9e99fff5dee2a725b
                            • Instruction ID: 8af11dd90015ec5f43ce150c388cba46651169716db28bae517dc0b7a168fa31
                            • Opcode Fuzzy Hash: 35a199f4cd0767ea9c1ea8937ecf8cb432643f9c07e7e6a9e99fff5dee2a725b
                            • Instruction Fuzzy Hash: 9941CE38A05254DFCB09DF58C894EA877F0FF49390F5992A9E8148B2A0C739F981CF90
                            Function 007016DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                            Download Yara Rule
                            APIs
                            • GetForegroundWindow.USER32 ref: 007016EB
                              • Part of subcall function 006D3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 006D3A57
                              • Part of subcall function 006D3A3D: GetCurrentThreadId.KERNEL32 ref: 006D3A5E
                              • Part of subcall function 006D3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006D25B3), ref: 006D3A65
                            • GetCaretPos.USER32(?), ref: 007016FF
                            • ClientToScreen.USER32(00000000,?), ref: 0070174C
                            • GetForegroundWindow.USER32 ref: 00701752
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                            • String ID:
                            • API String ID: 2759813231-0
                            • Opcode ID: 80c20f9eaa261f2996a926161b2155110dfe29db99a06dc9374d7136c8a23d9c
                            • Instruction ID: a2fe632ef4ec988028f1eda8eceaf29d77657881624a0cfc38344a0b95a13b29
                            • Opcode Fuzzy Hash: 80c20f9eaa261f2996a926161b2155110dfe29db99a06dc9374d7136c8a23d9c
                            • Instruction Fuzzy Hash: A8314175D00149EFC740DFA9C881CAEBBF9EF48304B5481AEE415E7251DB359E45CBA4
                            Function 006DD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                            Download Yara Rule
                            APIs
                            • CreateToolhelp32Snapshot.KERNEL32 ref: 006DD501
                            • Process32FirstW.KERNEL32(00000000,?), ref: 006DD50F
                            • Process32NextW.KERNEL32(00000000,?), ref: 006DD52F
                            • CloseHandle.KERNEL32(00000000), ref: 006DD5DC
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                            • String ID:
                            • API String ID: 420147892-0
                            • Opcode ID: 1bda895ad54642f572fbbc5279c37e710845745d1e40c2676e209f85a29561c9
                            • Instruction ID: a5fb10a84d72fb053baad1cdb4e4205b6868bbf83f9ae94bcf6fd3e2293a1f89
                            • Opcode Fuzzy Hash: 1bda895ad54642f572fbbc5279c37e710845745d1e40c2676e209f85a29561c9
                            • Instruction Fuzzy Hash: 1A31AF710083009FD305EF64D881AAFBBF9EF99354F104A2DF585862A2EB719945CBA3
                            Function 00708FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00689BB2
                            • GetCursorPos.USER32(?), ref: 00709001
                            • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,006C7711,?,?,?,?,?), ref: 00709016
                            • GetCursorPos.USER32(?), ref: 0070905E
                            • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,006C7711,?,?,?), ref: 00709094
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Cursor$LongMenuPopupProcTrackWindow
                            • String ID:
                            • API String ID: 2864067406-0
                            • Opcode ID: ec21751e967a046792547f45be657484a1bbd75690bf6ac2ff1fb77ebf86e4be
                            • Instruction ID: 563bd4982321b8b4e8656b791023126e50718da705f6b967542ff8cd041b7035
                            • Opcode Fuzzy Hash: ec21751e967a046792547f45be657484a1bbd75690bf6ac2ff1fb77ebf86e4be
                            • Instruction Fuzzy Hash: 8321A135600018EFDB269F94CC58EFB7BF9EF4A350F144269FA45472A2C739A990DB60
                            Function 006DD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                            Download Yara Rule
                            APIs
                            • GetFileAttributesW.KERNEL32(?,0070CB68), ref: 006DD2FB
                            • GetLastError.KERNEL32 ref: 006DD30A
                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 006DD319
                            • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0070CB68), ref: 006DD376
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateDirectory$AttributesErrorFileLast
                            • String ID:
                            • API String ID: 2267087916-0
                            • Opcode ID: 12bcf468aa62447e6ea3992e5e28aacd68e628e811995be1da7591bdf5273e52
                            • Instruction ID: 1bb99067e6bcce2ea6e12ebb493fb969a3defa2d96eef492ee06b86bf8f725a7
                            • Opcode Fuzzy Hash: 12bcf468aa62447e6ea3992e5e28aacd68e628e811995be1da7591bdf5273e52
                            • Instruction Fuzzy Hash: E4217F70909201DFC710EF28C8818AAB7E5AE56364F108B1EF499C73E1DB31D946CB97
                            Function 006D1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006D102A
                              • Part of subcall function 006D1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006D1036
                              • Part of subcall function 006D1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006D1045
                              • Part of subcall function 006D1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006D104C
                              • Part of subcall function 006D1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006D1062
                            • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006D15BE
                            • _memcmp.LIBVCRUNTIME ref: 006D15E1
                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 006D1617
                            • HeapFree.KERNEL32(00000000), ref: 006D161E
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                            • String ID:
                            • API String ID: 1592001646-0
                            • Opcode ID: ff3bfc52fde324755d084c798d46f20a479bdaf05cd03fdb4898c6692d6815fd
                            • Instruction ID: 87468ffac05f0d270cb0846c1f249ad84054e68813ae04c37f35500131298d1c
                            • Opcode Fuzzy Hash: ff3bfc52fde324755d084c798d46f20a479bdaf05cd03fdb4898c6692d6815fd
                            • Instruction Fuzzy Hash: A8216B71E00109FFDB10DFA4C945BEEB7B9EF45344F18855AE441AB341D774AA45CB50
                            Function 00702782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                            Download Yara Rule
                            APIs
                            • GetWindowLongW.USER32(?,000000EC), ref: 0070280A
                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00702824
                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00702832
                            • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00702840
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Long$AttributesLayered
                            • String ID:
                            • API String ID: 2169480361-0
                            • Opcode ID: b9c3434a73a0fcf99fe74106d36bd395803bf8fbb595c10a6a67e18259dbc27e
                            • Instruction ID: dcdc663f5b00815e75d2aeccac142d428b4d4cad4495afbe5f5808c6e011c5c6
                            • Opcode Fuzzy Hash: b9c3434a73a0fcf99fe74106d36bd395803bf8fbb595c10a6a67e18259dbc27e
                            • Instruction Fuzzy Hash: 1C21B236204111EFE7159B24CC48F6A7795AF45324F24C358F5168B6D3DB79EC42C790
                            Function 006D78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 006D8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,006D790A,?,000000FF,?,006D8754,00000000,?,0000001C,?,?), ref: 006D8D8C
                              • Part of subcall function 006D8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 006D8DB2
                              • Part of subcall function 006D8D7D: lstrcmpiW.KERNEL32(00000000,?,006D790A,?,000000FF,?,006D8754,00000000,?,0000001C,?,?), ref: 006D8DE3
                            • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,006D8754,00000000,?,0000001C,?,?,00000000), ref: 006D7923
                            • lstrcpyW.KERNEL32(00000000,?), ref: 006D7949
                            • lstrcmpiW.KERNEL32(00000002,cdecl,?,006D8754,00000000,?,0000001C,?,?,00000000), ref: 006D7984
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: lstrcmpilstrcpylstrlen
                            • String ID: cdecl
                            • API String ID: 4031866154-3896280584
                            • Opcode ID: dbbab9a402b8863b548398974955abad826f655f3c5995a4fff4e0d9d67bfa6d
                            • Instruction ID: 8c43e36b1625358e9ee549ea6d35e577f4a0d2ab8d14da98074a0cb851cd5801
                            • Opcode Fuzzy Hash: dbbab9a402b8863b548398974955abad826f655f3c5995a4fff4e0d9d67bfa6d
                            • Instruction Fuzzy Hash: FA11E43A600201AFCB155F34C855DBA77A6FF85350B00812BE802CB3A4FF319811C7A6
                            Function 00707CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                            Download Yara Rule
                            APIs
                            • GetWindowLongW.USER32(?,000000F0), ref: 00707D0B
                            • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00707D2A
                            • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00707D42
                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,006EB7AD,00000000), ref: 00707D6B
                              • Part of subcall function 00689BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00689BB2
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$Long
                            • String ID:
                            • API String ID: 847901565-0
                            • Opcode ID: ff66e5fa94f17c9dd9211848f0aea71fe75f1fb58b88f552f3389db1b247cbb5
                            • Instruction ID: b91945b4a3620a9bb6dd700a50b449a7ba6ede7af10cb0576efbe5d2eaa2f962
                            • Opcode Fuzzy Hash: ff66e5fa94f17c9dd9211848f0aea71fe75f1fb58b88f552f3389db1b247cbb5
                            • Instruction Fuzzy Hash: AB11CD35A05654EFDB14DF28CC04AA63BE9AF46360B258324F839CB2F0E738A950DB50
                            Function 00705660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,00001060,?,00000004), ref: 007056BB
                            • _wcslen.LIBCMT ref: 007056CD
                            • _wcslen.LIBCMT ref: 007056D8
                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00705816
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend_wcslen
                            • String ID:
                            • API String ID: 455545452-0
                            • Opcode ID: 933b60243ecd73e250db87a63e9ad1eac5d49c660b822dc81f8cd053e659b527
                            • Instruction ID: f65747736b150b5766ff8b647e7ce7734d5db30d701bc40286a274dc2b99c738
                            • Opcode Fuzzy Hash: 933b60243ecd73e250db87a63e9ad1eac5d49c660b822dc81f8cd053e659b527
                            • Instruction Fuzzy Hash: 6711BE75A00608E6DF209F61CC85EEF77ECEF11760B50826AF915D60C1EBB89A81CF64
                            Function 006D1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,000000B0,?,?), ref: 006D1A47
                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 006D1A59
                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 006D1A6F
                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 006D1A8A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend
                            • String ID:
                            • API String ID: 3850602802-0
                            • Opcode ID: 436cc3173b1fe0396af70cdb0e7cdc72ab2aa5b4a5069e628818555b86c53606
                            • Instruction ID: 48ea31594ea25bc8a3f133f0dba7aebca082d40166e27f0f2d918efeb190e85b
                            • Opcode Fuzzy Hash: 436cc3173b1fe0396af70cdb0e7cdc72ab2aa5b4a5069e628818555b86c53606
                            • Instruction Fuzzy Hash: D1113C3AD01219FFEB11DBA4CD85FADBB79EB04750F240092E600BB290D6B16E51DB94
                            Function 006DE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentThreadId.KERNEL32 ref: 006DE1FD
                            • MessageBoxW.USER32(?,?,?,?), ref: 006DE230
                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 006DE246
                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 006DE24D
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                            • String ID:
                            • API String ID: 2880819207-0
                            • Opcode ID: c9d61ff9ace108f5e12db7bc2a57f5e5e5a1dcfb5e86672ae652654ee9a1708a
                            • Instruction ID: 0933cfe72e15dc3b5bf2d61a339dc47d339f40ef68ab21620c879206ef99cff6
                            • Opcode Fuzzy Hash: c9d61ff9ace108f5e12db7bc2a57f5e5e5a1dcfb5e86672ae652654ee9a1708a
                            • Instruction Fuzzy Hash: CA110876D04258BBC702AFA89C05A9F7FAD9B46310F00831AF914D7390D775DA0487A4
                            Function 0069D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                            Download Yara Rule
                            APIs
                            • CreateThread.KERNEL32(00000000,?,0069CFF9,00000000,00000004,00000000), ref: 0069D218
                            • GetLastError.KERNEL32 ref: 0069D224
                            • __dosmaperr.LIBCMT ref: 0069D22B
                            • ResumeThread.KERNEL32(00000000), ref: 0069D249
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Thread$CreateErrorLastResume__dosmaperr
                            • String ID:
                            • API String ID: 173952441-0
                            • Opcode ID: 2e152da9e94343dd52750eec65cc5afe3c27d6c7336a6bd62b6251a4deac39f3
                            • Instruction ID: 5cdaa69ed5607275b4fe09ccb93dbc25bce8122441ef6889acfb2ff9c5b63ede
                            • Opcode Fuzzy Hash: 2e152da9e94343dd52750eec65cc5afe3c27d6c7336a6bd62b6251a4deac39f3
                            • Instruction Fuzzy Hash: 4101D236805208BBCF116BA5DC09BAA7A6EDF82730F204329FA25925D0CF70CA01C6A5
                            Function 0067600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                            Download Yara Rule
                            APIs
                            • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0067604C
                            • GetStockObject.GDI32(00000011), ref: 00676060
                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 0067606A
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CreateMessageObjectSendStockWindow
                            • String ID:
                            • API String ID: 3970641297-0
                            • Opcode ID: f1d4db99044eecd27bf5c43de2856d31300ffacb1c34186c7da92455a13385ed
                            • Instruction ID: ea9789bc735574af0e62fc9905b24d6bb1e4f977dee87f07c9e414fd3aa5710b
                            • Opcode Fuzzy Hash: f1d4db99044eecd27bf5c43de2856d31300ffacb1c34186c7da92455a13385ed
                            • Instruction Fuzzy Hash: B511A172101908FFEF125F94CD44EEA7B6AFF08364F008205FA0852110CB369C60DF90
                            Function 00693B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • ___BuildCatchObject.LIBVCRUNTIME ref: 00693B56
                              • Part of subcall function 00693AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00693AD2
                              • Part of subcall function 00693AA3: ___AdjustPointer.LIBCMT ref: 00693AED
                            • _UnwindNestedFrames.LIBCMT ref: 00693B6B
                            • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00693B7C
                            • CallCatchBlock.LIBVCRUNTIME ref: 00693BA4
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                            • String ID:
                            • API String ID: 737400349-0
                            • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                            • Instruction ID: 100aac76d4ad07843a2a445b962a9389ad04445e3afc9047f118d9730fd7df20
                            • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                            • Instruction Fuzzy Hash: 97012932100148BBDF126E95CC42EEB3B6EEF58B54F044018FE4896621C732E962EBA4
                            Function 006A3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                            Download Yara Rule
                            APIs
                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006713C6,00000000,00000000,?,006A301A,006713C6,00000000,00000000,00000000,?,006A328B,00000006,FlsSetValue), ref: 006A30A5
                            • GetLastError.KERNEL32(?,006A301A,006713C6,00000000,00000000,00000000,?,006A328B,00000006,FlsSetValue,00712290,FlsSetValue,00000000,00000364,?,006A2E46), ref: 006A30B1
                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,006A301A,006713C6,00000000,00000000,00000000,?,006A328B,00000006,FlsSetValue,00712290,FlsSetValue,00000000), ref: 006A30BF
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LibraryLoad$ErrorLast
                            • String ID:
                            • API String ID: 3177248105-0
                            • Opcode ID: 6d6724c7910ff8954a6222d7ab15c87ee31a24a678ae46d9388c64447203b192
                            • Instruction ID: 87d07e5a72c7b89641e273f09e4b467bdebea55dce233ec0377b87f718216b5f
                            • Opcode Fuzzy Hash: 6d6724c7910ff8954a6222d7ab15c87ee31a24a678ae46d9388c64447203b192
                            • Instruction Fuzzy Hash: 7D01F732301332EBCB319B799C449977B9AAF07BA1B208720F905E7380CB25DD01CAE4
                            Function 006D7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                            Download Yara Rule
                            APIs
                            • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 006D747F
                            • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 006D7497
                            • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 006D74AC
                            • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 006D74CA
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Type$Register$FileLoadModuleNameUser
                            • String ID:
                            • API String ID: 1352324309-0
                            • Opcode ID: 9438c7888ec7feb61e95f29769ce44e0c98935598ed6b815c3eb9c87eec9e5f3
                            • Instruction ID: f67d7e580b1d8913b4a01a88f6c36717c90e43f8ffe6b9e2fca089c150bb2387
                            • Opcode Fuzzy Hash: 9438c7888ec7feb61e95f29769ce44e0c98935598ed6b815c3eb9c87eec9e5f3
                            • Instruction Fuzzy Hash: 3911A1B1605314DBE722CF14DC08B92BFFDEB00B00F10866AF616D6291EB74E904DB52
                            Function 006DB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                            Download Yara Rule
                            APIs
                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,006DACD3,?,00008000), ref: 006DB0C4
                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,006DACD3,?,00008000), ref: 006DB0E9
                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,006DACD3,?,00008000), ref: 006DB0F3
                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,006DACD3,?,00008000), ref: 006DB126
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CounterPerformanceQuerySleep
                            • String ID:
                            • API String ID: 2875609808-0
                            • Opcode ID: 503eeb8ce365cd09bd55b35e233cfbc40d1b1c4a0af7522d8e0c6014fa751561
                            • Instruction ID: aab56c3b6d2984a8a7d4e8a33ba260fdb8b8a0fdd28178643e3aabc768e4b9a8
                            • Opcode Fuzzy Hash: 503eeb8ce365cd09bd55b35e233cfbc40d1b1c4a0af7522d8e0c6014fa751561
                            • Instruction Fuzzy Hash: 07118E70C0061CD7CF10AFE4ED596EEBB79FF0A311F028286D941B2245CF3449508B95
                            Function 006D2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 006D2DC5
                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 006D2DD6
                            • GetCurrentThreadId.KERNEL32 ref: 006D2DDD
                            • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 006D2DE4
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                            • String ID:
                            • API String ID: 2710830443-0
                            • Opcode ID: 806fa67157c03c18201fc8cb566045d2b8ef4b312fb39c18ef73c22943b2907f
                            • Instruction ID: 4fdd61997fa18cb6a346b43d3121e4ec08fb1ff3e92cfd9a76a53b948369dbf4
                            • Opcode Fuzzy Hash: 806fa67157c03c18201fc8cb566045d2b8ef4b312fb39c18ef73c22943b2907f
                            • Instruction Fuzzy Hash: CEE092B1501224BBD7315B729C0EFEB7E6EEF96BA1F004316F105D11809EA9C841C6B0
                            Function 00708863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00689639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00689693
                              • Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896A2
                              • Part of subcall function 00689639: BeginPath.GDI32(?), ref: 006896B9
                              • Part of subcall function 00689639: SelectObject.GDI32(?,00000000), ref: 006896E2
                            • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00708887
                            • LineTo.GDI32(?,?,?), ref: 00708894
                            • EndPath.GDI32(?), ref: 007088A4
                            • StrokePath.GDI32(?), ref: 007088B2
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                            • String ID:
                            • API String ID: 1539411459-0
                            • Opcode ID: f055b61192321cd29d024c6d34b94b389c61b5ff649454ec5b7b7590596ae458
                            • Instruction ID: 433806c6cd8e4c663475daaa991da80b0505b75db61312975b0acf19c2503e2e
                            • Opcode Fuzzy Hash: f055b61192321cd29d024c6d34b94b389c61b5ff649454ec5b7b7590596ae458
                            • Instruction Fuzzy Hash: 01F03A36041258FAEB136F94AC09FCA3E59AF06310F44C201FA11651E1CBB95551DBE9
                            Function 006898B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                            Download Yara Rule
                            APIs
                            • GetSysColor.USER32(00000008), ref: 006898CC
                            • SetTextColor.GDI32(?,?), ref: 006898D6
                            • SetBkMode.GDI32(?,00000001), ref: 006898E9
                            • GetStockObject.GDI32(00000005), ref: 006898F1
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Color$ModeObjectStockText
                            • String ID:
                            • API String ID: 4037423528-0
                            • Opcode ID: 52a477f48409e860a29389476552cad06fad7f12a49b6c695cf35700e1a1e8af
                            • Instruction ID: da0b77bc8536fed8a6f5ee0f15f1d089c992613b27184aef77a15b274fbf2d2f
                            • Opcode Fuzzy Hash: 52a477f48409e860a29389476552cad06fad7f12a49b6c695cf35700e1a1e8af
                            • Instruction Fuzzy Hash: 13E06D31244284EEDB225B74EC09BE83F61EB12336F18C319FAFA581E1CB7546509F20
                            Function 006D162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                            Download Yara Rule
                            APIs
                            • GetCurrentThread.KERNEL32 ref: 006D1634
                            • OpenThreadToken.ADVAPI32(00000000,?,?,?,006D11D9), ref: 006D163B
                            • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006D11D9), ref: 006D1648
                            • OpenProcessToken.ADVAPI32(00000000,?,?,?,006D11D9), ref: 006D164F
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CurrentOpenProcessThreadToken
                            • String ID:
                            • API String ID: 3974789173-0
                            • Opcode ID: 980822949a5566dbf2545132a75d8b05724a7c3584abea6f78038c18c9d90df2
                            • Instruction ID: 70b9a01de21879ca0e8d35a60a39cd65d5c7845811f72e4df4acda25ded0897b
                            • Opcode Fuzzy Hash: 980822949a5566dbf2545132a75d8b05724a7c3584abea6f78038c18c9d90df2
                            • Instruction Fuzzy Hash: F0E08C32A02211EBE7201FA0AE0DB963B7DAF45792F14CA09F245CD080EA788440CB68
                            Function 006CD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                            Download Yara Rule
                            APIs
                            • GetDesktopWindow.USER32 ref: 006CD858
                            • GetDC.USER32(00000000), ref: 006CD862
                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 006CD882
                            • ReleaseDC.USER32(?), ref: 006CD8A3
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CapsDesktopDeviceReleaseWindow
                            • String ID:
                            • API String ID: 2889604237-0
                            • Opcode ID: d1ea454b8d9c79edec59a8ef28533cfd4c9647708f7185449734d371711750a7
                            • Instruction ID: 96c871c4de380e3b198c398048365a2b29d81c695b70b7f51553d2b2f1415de1
                            • Opcode Fuzzy Hash: d1ea454b8d9c79edec59a8ef28533cfd4c9647708f7185449734d371711750a7
                            • Instruction Fuzzy Hash: 19E01AB0800204EFCF52AFA0D808A6DBBB2FB08310F10C219F846E7250CB3D8902AF54
                            Function 006CD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                            Download Yara Rule
                            APIs
                            • GetDesktopWindow.USER32 ref: 006CD86C
                            • GetDC.USER32(00000000), ref: 006CD876
                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 006CD882
                            • ReleaseDC.USER32(?), ref: 006CD8A3
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CapsDesktopDeviceReleaseWindow
                            • String ID:
                            • API String ID: 2889604237-0
                            • Opcode ID: e6ba0305685304b966c75a9add4a52b3d2104492052807b9d31f32f17ae708a2
                            • Instruction ID: 1a8d0dc2a18b20755e1ee1d3fceeb41194b5d365abe74081514b64b6529ab118
                            • Opcode Fuzzy Hash: e6ba0305685304b966c75a9add4a52b3d2104492052807b9d31f32f17ae708a2
                            • Instruction Fuzzy Hash: B3E09A75800204DFCF52AFA0D80866DBBB6BB48311F14C649E94AE7250CB3D59019F54
                            Function 006E4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00677620: _wcslen.LIBCMT ref: 00677625
                            • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 006E4ED4
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Connection_wcslen
                            • String ID: *$LPT
                            • API String ID: 1725874428-3443410124
                            • Opcode ID: 891427177586e5724c7f2101476574898536bd5a24e31e97ce320bc6eb84ae32
                            • Instruction ID: 657a00c8fef383a14a45a23f8a323f8d27d1a6f9065b2934310a6c3c5ebebd1a
                            • Opcode Fuzzy Hash: 891427177586e5724c7f2101476574898536bd5a24e31e97ce320bc6eb84ae32
                            • Instruction Fuzzy Hash: 25918175A012449FDB14DF65C484EAABBF2BF84704F18809DE80A9F362CB35ED85CB91
                            Function 0069E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                            Download Yara Rule
                            APIs
                            • __startOneArgErrorHandling.LIBCMT ref: 0069E30D
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ErrorHandling__start
                            • String ID: pow
                            • API String ID: 3213639722-2276729525
                            • Opcode ID: 710cee4a7dc7609cd123b3d99121ec68d9f9a7cde1a84a2b46d7742662117be2
                            • Instruction ID: c5bcdb747189de4208257a62bf4bebaaf1c277fc11c54ae588161124fa6613b9
                            • Opcode Fuzzy Hash: 710cee4a7dc7609cd123b3d99121ec68d9f9a7cde1a84a2b46d7742662117be2
                            • Instruction Fuzzy Hash: E8513B61A0C20296CF15B718CD013F93BEEEF41740F748D69E095427EAEB368D969E4A
                            Function 006F7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                            Download Yara Rule
                            APIs
                            • CharUpperBuffW.USER32(006C569E,00000000,?,0070CC08,?,00000000,00000000), ref: 006F78DD
                              • Part of subcall function 00676B57: _wcslen.LIBCMT ref: 00676B6A
                            • CharUpperBuffW.USER32(006C569E,00000000,?,0070CC08,00000000,?,00000000,00000000), ref: 006F783B
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: BuffCharUpper$_wcslen
                            • String ID: <ss
                            • API String ID: 3544283678-523161429
                            • Opcode ID: 44a715e15142dc0254b7a7bbf74366de113f1984f6a544ceacb8cb8fd04891aa
                            • Instruction ID: f1dd2779b8599318bebffeaea3feba98fef814df14408a949d80d46e30527ec1
                            • Opcode Fuzzy Hash: 44a715e15142dc0254b7a7bbf74366de113f1984f6a544ceacb8cb8fd04891aa
                            • Instruction Fuzzy Hash: 25617E72914128EACF44FBE4CC91DFDB3BABF14300B548129F646A7192EF745A09DBA4
                            Function 0068E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                            Download Yara Rule
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID:
                            • String ID: #
                            • API String ID: 0-1885708031
                            • Opcode ID: a274a0a0779338ba89815ba82c07264c40002e346f1b6731232be186aef97803
                            • Instruction ID: 4a8e319cccdcf8f995574926788dd6f1e7864de1726ad0b75d04f55fa2c0ba38
                            • Opcode Fuzzy Hash: a274a0a0779338ba89815ba82c07264c40002e346f1b6731232be186aef97803
                            • Instruction Fuzzy Hash: DB511335500246DFDB15EF28C491AFA7BB6EF25310F248159E8919B390DA369E43CBA0
                            Function 0068F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                            Download Yara Rule
                            APIs
                            • Sleep.KERNEL32(00000000), ref: 0068F2A2
                            • GlobalMemoryStatusEx.KERNEL32(?), ref: 0068F2BB
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: GlobalMemorySleepStatus
                            • String ID: @
                            • API String ID: 2783356886-2766056989
                            • Opcode ID: 5efaa5cde9f7d49b0df757d9c51a71715d21faaa977fcbce2ef132a8773254c7
                            • Instruction ID: 7db92f159a8b1cb22f91aabb23967eb5b15e987666f82bb7399bc3252c8a7da5
                            • Opcode Fuzzy Hash: 5efaa5cde9f7d49b0df757d9c51a71715d21faaa977fcbce2ef132a8773254c7
                            • Instruction Fuzzy Hash: 7E5154714087449BD360AF20DC86BAFBBF9FF95310F81885CF1D9411A5EB349929CB6A
                            Function 006F5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                            Download Yara Rule
                            APIs
                            • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 006F57E0
                            • _wcslen.LIBCMT ref: 006F57EC
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: BuffCharUpper_wcslen
                            • String ID: CALLARGARRAY
                            • API String ID: 157775604-1150593374
                            • Opcode ID: df36f5721cd5bd34d179ace81504d7f8591e440a0d05d148c43330c617d5d20f
                            • Instruction ID: 8a710f762557dccd185ff8c46abcfb10d4542b32adc6e4d989b2198d772fcadb
                            • Opcode Fuzzy Hash: df36f5721cd5bd34d179ace81504d7f8591e440a0d05d148c43330c617d5d20f
                            • Instruction Fuzzy Hash: A8418E71A001199FCB14DFA8C8818FEBBF6EF59350F10412DE616A7391E7349D81CBA4
                            Function 006ED0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                            Download Yara Rule
                            APIs
                            • _wcslen.LIBCMT ref: 006ED130
                            • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 006ED13A
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CrackInternet_wcslen
                            • String ID: |
                            • API String ID: 596671847-2343686810
                            • Opcode ID: 9614cf67f5bb1587e9c48719c5df11d30a64dd576d808c86e9724e4c97869a2e
                            • Instruction ID: af07d16758c9cee9c4430325c28dde29e970aad2e87e729fcae1319da50253ae
                            • Opcode Fuzzy Hash: 9614cf67f5bb1587e9c48719c5df11d30a64dd576d808c86e9724e4c97869a2e
                            • Instruction Fuzzy Hash: 9D314F71D01209ABCF55EFA5CC85EEE7FBAFF04344F104019F819A6265EB31AA06CB65
                            Function 0070356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                            Download Yara Rule
                            APIs
                            • DestroyWindow.USER32(?,?,?,?), ref: 00703621
                            • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0070365C
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$DestroyMove
                            • String ID: static
                            • API String ID: 2139405536-2160076837
                            • Opcode ID: 6d0751940719cf859113f527f89e56c1f7f7f64d0338ae8f216d78bffe2aef24
                            • Instruction ID: 571b47f8d6bb39e510e3bbc07efdb2eaa0e6dddc739b50016345c4180f379e47
                            • Opcode Fuzzy Hash: 6d0751940719cf859113f527f89e56c1f7f7f64d0338ae8f216d78bffe2aef24
                            • Instruction Fuzzy Hash: 09318A71110604EAEB209F78DC80EBB73EDFF88720F10971DF8A597290DA39AD918764
                            Function 00704537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 0070461F
                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00704634
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend
                            • String ID: '
                            • API String ID: 3850602802-1997036262
                            • Opcode ID: a428897fae623c181d0174767a431a04364768d01ecf9f42951bacff054565e5
                            • Instruction ID: 5d6dd8c435de3d0232793154759a2e383d9cd8d8182ce985f5a5e832780e1048
                            • Opcode Fuzzy Hash: a428897fae623c181d0174767a431a04364768d01ecf9f42951bacff054565e5
                            • Instruction Fuzzy Hash: 123127B5A01209DFDB14CFA9C980BDA7BF5FF49300F10416AEA04AB381E775A951CF90
                            Function 007031EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                            Download Yara Rule
                            APIs
                            • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0070327C
                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00703287
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: MessageSend
                            • String ID: Combobox
                            • API String ID: 3850602802-2096851135
                            • Opcode ID: ba922d109648250556f6074e05d4c40fd76c3fe11e082fb1a028c811d3c5452c
                            • Instruction ID: 3ed8e093f0acf534d6cc16f43154cdd188bba9179abe8002366cb465deeadbb7
                            • Opcode Fuzzy Hash: ba922d109648250556f6074e05d4c40fd76c3fe11e082fb1a028c811d3c5452c
                            • Instruction Fuzzy Hash: A4116071200208BFEF259F54DC85EBB37AEEB94364F104229F918972D1D6799D518760
                            Function 00703710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 0067600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0067604C
                              • Part of subcall function 0067600E: GetStockObject.GDI32(00000011), ref: 00676060
                              • Part of subcall function 0067600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0067606A
                            • GetWindowRect.USER32(00000000,?), ref: 0070377A
                            • GetSysColor.USER32(00000012), ref: 00703794
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Window$ColorCreateMessageObjectRectSendStock
                            • String ID: static
                            • API String ID: 1983116058-2160076837
                            • Opcode ID: ed22c6237907caa0d8df194879b194e97c62251a13a75d455ea87bf45409c5ee
                            • Instruction ID: ba3f24f2d3f1d8f3af8f86a5c5ec463aa7ea8502094fc0bb0507fbe5078cd36b
                            • Opcode Fuzzy Hash: ed22c6237907caa0d8df194879b194e97c62251a13a75d455ea87bf45409c5ee
                            • Instruction Fuzzy Hash: 671129B2610209EFDB01DFA8CC45AEA7BF8EB08314F005A15F955E2290DB39E8619B50
                            Function 006ECD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                            Download Yara Rule
                            APIs
                            • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 006ECD7D
                            • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 006ECDA6
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Internet$OpenOption
                            • String ID: <local>
                            • API String ID: 942729171-4266983199
                            • Opcode ID: a3b063257298f4fee9b3ece8ec98a2d68826a830106e4f1af4b825f6f0a791a2
                            • Instruction ID: 29a35a9c926faef69157483d5b35b10a4c423e878ba18404edcca6296bce2e2b
                            • Opcode Fuzzy Hash: a3b063257298f4fee9b3ece8ec98a2d68826a830106e4f1af4b825f6f0a791a2
                            • Instruction Fuzzy Hash: 3F11C271206771BAD7384B678C49EE7BEAEEF527B4F00422AB10983180D7769842D6F0
                            Function 00703429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                            Download Yara Rule
                            APIs
                            • GetWindowTextLengthW.USER32(00000000), ref: 007034AB
                            • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007034BA
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LengthMessageSendTextWindow
                            • String ID: edit
                            • API String ID: 2978978980-2167791130
                            • Opcode ID: 49d577732edda4e4e22c59a2463f34814fbb968093fe01160a320cb648db43fa
                            • Instruction ID: 94151ee3e544798e99265e5beee970a0472610108e550c1b0f9e740058cf1c5b
                            • Opcode Fuzzy Hash: 49d577732edda4e4e22c59a2463f34814fbb968093fe01160a320cb648db43fa
                            • Instruction Fuzzy Hash: 48118C71100248EBEB228F64DC84ABB37AEEF05374F508724F9659B1E0C779EC919B65
                            Function 006D6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            • CharUpperBuffW.USER32(?,?,?), ref: 006D6CB6
                            • _wcslen.LIBCMT ref: 006D6CC2
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen$BuffCharUpper
                            • String ID: STOP
                            • API String ID: 1256254125-2411985666
                            • Opcode ID: 17b4339954556a1bedfd1178ef1ee8dd02abf2a58a600d65c9d15151ec7ebce1
                            • Instruction ID: b7da242472b0479b2bc52e47365ef324eaaa8636b9f5b4e410ec808ae10501f8
                            • Opcode Fuzzy Hash: 17b4339954556a1bedfd1178ef1ee8dd02abf2a58a600d65c9d15151ec7ebce1
                            • Instruction Fuzzy Hash: 8601C432E145278ACB219FBDDC819FF77B7EF61710710052AF85296391EA35D901C650
                            Function 006D1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                              • Part of subcall function 006D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006D3CCA
                            • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 006D1D4C
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ClassMessageNameSend_wcslen
                            • String ID: ComboBox$ListBox
                            • API String ID: 624084870-1403004172
                            • Opcode ID: 0b3a459e24c4fa72e4cb84622396b50a51b7077830efc4c742932edd901c3bdb
                            • Instruction ID: d3b77c9a1ebc37a6fbc4ee50ba4dfeebd0be08efb4c0d4fc82e8d57b72becc4d
                            • Opcode Fuzzy Hash: 0b3a459e24c4fa72e4cb84622396b50a51b7077830efc4c742932edd901c3bdb
                            • Instruction Fuzzy Hash: 1501B571A11218ABCB18EBA4CC51CFE73ABEF57350B044A1EE8265B3C1EB7159098665
                            Function 006D1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                              • Part of subcall function 006D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006D3CCA
                            • SendMessageW.USER32(?,00000180,00000000,?), ref: 006D1C46
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ClassMessageNameSend_wcslen
                            • String ID: ComboBox$ListBox
                            • API String ID: 624084870-1403004172
                            • Opcode ID: acc9188e078fc568af7e2fbbbc95386a7d34c79929fd7679830c1d6dae074044
                            • Instruction ID: c3fa7e1427ee16154a68b3c888f2c276f3e13ce3736441a7b27018bb2ad07130
                            • Opcode Fuzzy Hash: acc9188e078fc568af7e2fbbbc95386a7d34c79929fd7679830c1d6dae074044
                            • Instruction Fuzzy Hash: B201A7B5F91108B6DF19EB90CD52DFF77EA9B12340F14001EA40667382EA689E0986B6
                            Function 006D1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                              • Part of subcall function 006D3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 006D3CCA
                            • SendMessageW.USER32(?,00000182,?,00000000), ref: 006D1CC8
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: ClassMessageNameSend_wcslen
                            • String ID: ComboBox$ListBox
                            • API String ID: 624084870-1403004172
                            • Opcode ID: 7ad54a72b33ad4fdc898c448a73f8cf8bc75fe183b42496e0f3da58f9843890c
                            • Instruction ID: 3560209c48f78b776c4e3e51bfc6fa64cbddf8fbdd6750eeed730ef06d28e3ad
                            • Opcode Fuzzy Hash: 7ad54a72b33ad4fdc898c448a73f8cf8bc75fe183b42496e0f3da58f9843890c
                            • Instruction Fuzzy Hash: 3301A7B1B9011876DB15E790CA12EFE73EA9B12340F14001AB80577382EA659F098676
                            Function 0068A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                            Download Yara Rule
                            APIs
                            • __Init_thread_footer.LIBCMT ref: 0068A529
                              • Part of subcall function 00679CB3: _wcslen.LIBCMT ref: 00679CBD
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Init_thread_footer_wcslen
                            • String ID: ,%t$3yl
                            • API String ID: 2551934079-2110182000
                            • Opcode ID: f87639b936f96ea294ac81dcc4d6b51c3f872f0d9c1788d62aab6902e54a79b2
                            • Instruction ID: f923746ba7ee8dbe3c3f33cee556628f27b6f087615ecf9eebc2f5a0be25da18
                            • Opcode Fuzzy Hash: f87639b936f96ea294ac81dcc4d6b51c3f872f0d9c1788d62aab6902e54a79b2
                            • Instruction Fuzzy Hash: F8012B317006109BEA04F7A8D81BA9D73ABDB05710F50426EF905572C3DF645D428BAF
                            Function 00708172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
                            Download Yara Rule
                            APIs
                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00743018,0074305C), ref: 007081BF
                            • CloseHandle.KERNEL32 ref: 007081D1
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CloseCreateHandleProcess
                            • String ID: \0t
                            • API String ID: 3712363035-315198736
                            • Opcode ID: 20b86d8cb5554909b0ab7e39c25eed8db1b51fd9858a37053c1d23ce03e0d935
                            • Instruction ID: 3ec7e80eda04f39d2082f7ea7f465d65c09c3dcb05f2b6d29c7cb1a7cf988cb1
                            • Opcode Fuzzy Hash: 20b86d8cb5554909b0ab7e39c25eed8db1b51fd9858a37053c1d23ce03e0d935
                            • Instruction Fuzzy Hash: 03F05EB5640304BAF7206761AC45FB77A9EDB05750F008626BB0CD61B2D77E8A0082BD
                            Function 006F747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: _wcslen
                            • String ID: 3, 3, 16, 1
                            • API String ID: 176396367-3042988571
                            • Opcode ID: d1771dad047eebf6519445ae7141ce7c55d12ab03d470c942b82af3eec3e8c4c
                            • Instruction ID: c857ddec887922dd5d7b5bea5e32cda872b143231165048eb72c9f72963a08b0
                            • Opcode Fuzzy Hash: d1771dad047eebf6519445ae7141ce7c55d12ab03d470c942b82af3eec3e8c4c
                            • Instruction Fuzzy Hash: 9EE02B4220422410927122799CC1DBF57CFCFC9750710182FFA81C236AEE948D9293E4
                            Function 006D0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                            Download Yara Rule
                            APIs
                            • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 006D0B23
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Message
                            • String ID: AutoIt$Error allocating memory.
                            • API String ID: 2030045667-4017498283
                            • Opcode ID: f035cb400377b15f15c02a2454e637a242165cc21758624ffb1a0d2d5bb52d03
                            • Instruction ID: 48bc33df4ec890a23a3d6c981182329975b32786df0e240bb65c7cee553cb16a
                            • Opcode Fuzzy Hash: f035cb400377b15f15c02a2454e637a242165cc21758624ffb1a0d2d5bb52d03
                            • Instruction Fuzzy Hash: 53E0D832244308B6E2553754BC07FC97BC58F05B51F10462FF748955C38ED6249046AD
                            Function 00690D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                            Download Yara Rule
                            APIs
                              • Part of subcall function 0068F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00690D71,?,?,?,0067100A), ref: 0068F7CE
                            • IsDebuggerPresent.KERNEL32(?,?,?,0067100A), ref: 00690D75
                            • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0067100A), ref: 00690D84
                            Strings
                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00690D7F
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                            • API String ID: 55579361-631824599
                            • Opcode ID: e2b1c92d00ece44d71a11aa76a43953c7c7c532d0d211ffd4116ab3fc8679368
                            • Instruction ID: 84d08cba9686107ffa1b778a145251560400b4e5d265fe0c4dfadbd5781e3352
                            • Opcode Fuzzy Hash: e2b1c92d00ece44d71a11aa76a43953c7c7c532d0d211ffd4116ab3fc8679368
                            • Instruction Fuzzy Hash: A7E0E574200751CFE7719F78D8047467BE5BF14744F008B2DE495C6A51DBB9E4488B95
                            Function 0068E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                            Download Yara Rule
                            APIs
                            • __Init_thread_footer.LIBCMT ref: 0068E3D5
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: Init_thread_footer
                            • String ID: 0%t$8%t
                            • API String ID: 1385522511-3566158117
                            • Opcode ID: c6751414d57b6b24c93a67b00644b7c0f6f7a20d700845a1f27cb42980dc9835
                            • Instruction ID: 59e153d56623755417a78dbd24c9b2578d5d4c12cd231532948f9ebd29b700bc
                            • Opcode Fuzzy Hash: c6751414d57b6b24c93a67b00644b7c0f6f7a20d700845a1f27cb42980dc9835
                            • Instruction Fuzzy Hash: 8FE02639508D10CFCA04B718B854A88B35BEB06320B9042FAF102872D3DB392C63874C
                            Function 006CD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                            Download Yara Rule
                            APIs
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: LocalTime
                            • String ID: %.3d$X64
                            • API String ID: 481472006-1077770165
                            • Opcode ID: b10101e022b303dd3df20ad27e5c0d8e3a4548e7513fb8b96beda8a34b2a9894
                            • Instruction ID: 59b78aff741de97555ee5f93eef72ec09cebcbcf80b70c40d54288efb41f7648
                            • Opcode Fuzzy Hash: b10101e022b303dd3df20ad27e5c0d8e3a4548e7513fb8b96beda8a34b2a9894
                            • Instruction Fuzzy Hash: A8D012A1C08108E9CB90A7D0CC45EBAB3BDFB09301F50857AFA0692040D63CC64AAB61
                            Function 00702356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                            Download Yara Rule
                            APIs
                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0070236C
                            • PostMessageW.USER32(00000000), ref: 00702373
                              • Part of subcall function 006DE97B: Sleep.KERNEL32 ref: 006DE9F3
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FindMessagePostSleepWindow
                            • String ID: Shell_TrayWnd
                            • API String ID: 529655941-2988720461
                            • Opcode ID: f90b3d50f566237a22fa4b7b694f1ee596aa806da4cf3f0aa3906a45c069a2ea
                            • Instruction ID: dc56aaf86460a58cf71506c165c9a5b7d6318b27ad9448f60ddaa372c8b6c3f4
                            • Opcode Fuzzy Hash: f90b3d50f566237a22fa4b7b694f1ee596aa806da4cf3f0aa3906a45c069a2ea
                            • Instruction Fuzzy Hash: FED0A972781300BAE2A8B3309C0FFC666089B00B04F108B067201AA1D0C8A9A8008A58
                            Function 00702322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                            Download Yara Rule
                            APIs
                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0070232C
                            • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0070233F
                              • Part of subcall function 006DE97B: Sleep.KERNEL32 ref: 006DE9F3
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.1815183766.0000000000671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true
                            • Associated: 00000000.00000002.1815156124.0000000000670000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.000000000070C000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815237463.0000000000732000.00000002.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815284594.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
                            • Associated: 00000000.00000002.1815303550.0000000000744000.00000002.00000001.01000000.00000003.sdmpDownload File
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_670000_1lAxaLKP7E.jbxd
                            Similarity
                            • API ID: FindMessagePostSleepWindow
                            • String ID: Shell_TrayWnd
                            • API String ID: 529655941-2988720461
                            • Opcode ID: 3051555868429f236be361eda1b175ae5e93d83f3aedc2a3c5fd58af8fbf2ef4
                            • Instruction ID: 86fd1a057ade134631c4dcf0a8456e93ad79aed1458a53bacfa16168b411b268
                            • Opcode Fuzzy Hash: 3051555868429f236be361eda1b175ae5e93d83f3aedc2a3c5fd58af8fbf2ef4
                            • Instruction Fuzzy Hash: 0DD0A976780300B6E2A8B3309C0FFC66A089B00B04F108B067205AA1D0C8A9A8008A58